test: add regression data for 77 existing rules

[frack113]

Summary of the Pull Request

Add regression test data (EVTX + JSON + info.yml) for 77 existing rules and register the regression_tests_path field in each corresponding rule file.

Changelog

update: windows/powershell/powershell_script/posh_ps_mailbox_access - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_send_mailmessage - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_token_obfuscation - add regression_tests_path
update: windows/process_creation/proc_creation_win_curl_useragent - add regression_tests_path
update: windows/process_creation/proc_creation_win_microsoft_workflow_compiler_execution - add regression_tests_path
update: windows/builtin/firewall_as/win_firewall_as_add_rule - add regression_tests_path
update: windows/builtin/firewall_as/win_firewall_as_add_rule_wmiprvse - add regression_tests_path
update: windows/dns_query/dns_query_win_remote_access_software_domains_non_browsers - add regression_tests_path
update: windows/file/file_event/file_event_win_gotoopener_artefact - add regression_tests_path
update: windows/file/file_event/file_event_win_install_teamviewer_desktop - add regression_tests_path
update: windows/file/file_event/file_event_win_powershell_drop_binary_or_script - add regression_tests_path
update: windows/file/file_event/file_event_win_susp_double_extension - add regression_tests_path
update: windows/powershell/powershell_module/posh_pm_exploit_scripts - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_as_rep_roasting - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_automated_collection - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_capture_screenshots - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_cmdlet_scheduled_task - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_detect_vm_env - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_directorysearcher - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_directoryservices_accountmanagement - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_dotnet_assembly_from_file - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_dump_password_windows_credential_manager - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_enable_psremoting - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_frombase64string_archive - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_invoke_command_remote - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_invoke_dnsexfiltration - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_keylogging - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_localuser - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_modify_group_policy_settings - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_msxml_com - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_office_comobject_registerxll - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_packet_capture - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_potential_unconstrained_delegation_discovery - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_remote_session_creation - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_request_kerberos_ticket - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_sensitive_file_discovery - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_susp_directory_enum - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_susp_execute_batch_script - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_susp_extracting - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_susp_hyper_v_condlet - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_susp_invoke_webrequest_useragent - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_susp_mail_acces - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_susp_new_psdrive - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_susp_recon_export - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_susp_start_process - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_susp_windowstyle - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_susp_zip_compress - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_timestomp - add regression_tests_path
update: windows/powershell/powershell_script/posh_ps_win32_product_install_msi - add regression_tests_path
update: windows/process_creation/proc_creation_win_cmd_stdin_redirect - add regression_tests_path
update: windows/process_creation/proc_creation_win_fsutil_symlinkevaluation - add regression_tests_path
update: windows/process_creation/proc_creation_win_hktl_sharpview - add regression_tests_path
update: windows/process_creation/proc_creation_win_infdefaultinstall_execute_sct_scripts - add regression_tests_path
update: windows/process_creation/proc_creation_win_instalutil_no_log_execution - add regression_tests_path
update: windows/process_creation/proc_creation_win_lolbin_ie4uinit - add regression_tests_path
update: windows/process_creation/proc_creation_win_lolbin_mavinject_process_injection - add regression_tests_path
update: windows/process_creation/proc_creation_win_lolbin_printbrm - add regression_tests_path
update: windows/process_creation/proc_creation_win_lolbin_replace - add regression_tests_path
update: windows/process_creation/proc_creation_win_lolbin_syncappvpublishingserver_vbs_execute_psh - add regression_tests_path
update: windows/process_creation/proc_creation_win_msiexec_dll - add regression_tests_path
update: windows/process_creation/proc_creation_win_msiexec_embedding - add regression_tests_path
update: windows/process_creation/proc_creation_win_msiexec_execute_dll - add regression_tests_path
update: windows/process_creation/proc_creation_win_msiexec_install_quiet - add regression_tests_path
update: windows/process_creation/proc_creation_win_pktmon_execution - add regression_tests_path
update: windows/process_creation/proc_creation_win_powershell_encode - add regression_tests_path
update: windows/process_creation/proc_creation_win_powershell_exec_data_file - add regression_tests_path
update: windows/process_creation/proc_creation_win_powershell_remotefxvgpudisablement_abuse - add regression_tests_path
update: windows/process_creation/proc_creation_win_powershell_set_policies_to_unsecure_level - add regression_tests_path
update: windows/process_creation/proc_creation_win_powershell_zip_compress - add regression_tests_path
update: windows/process_creation/proc_creation_win_reg_dumping_sensitive_hives - add regression_tests_path
update: windows/process_creation/proc_creation_win_reg_modify_group_policy_settings - add regression_tests_path
update: windows/process_creation/proc_creation_win_regsvr32_susp_extensions - add regression_tests_path
update: windows/process_creation/proc_creation_win_remote_access_tools_anydesk - add regression_tests_path
update: windows/process_creation/proc_creation_win_remote_access_tools_gotoopener - add regression_tests_path
update: windows/process_creation/proc_creation_win_remote_access_tools_logmein - add regression_tests_path
update: windows/process_creation/proc_creation_win_renamed_mavinject - add regression_tests_path
update: windows/process_creation/proc_creation_win_susp_automated_collection - add regression_tests_path
update: windows/process_creation/proc_creation_win_susp_network_scan_loop - add regression_tests_path
update: windows/process_creation/proc_creation_win_susp_recon - add regression_tests_path
update: windows/process_creation/proc_creation_win_takeown_recursive_own - add regression_tests_path
update: windows/registry/registry_set/registry_set_install_root_or_ca_certificat - add regression_tests_path
update: windows/sysmon/sysmon_file_executable_detected - add regression_tests_path
chore: regression_data/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_mailbox_access - add regression data
chore: regression_data/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_send_mailmessage - add regression data
chore: regression_data/rules-threat-hunting/windows/powershell/powershell_script/posh_ps_token_obfuscation - add regression data
chore: regression_data/rules-threat-hunting/windows/process_creation/proc_creation_win_curl_useragent - add regression data
chore: regression_data/rules-threat-hunting/windows/process_creation/proc_creation_win_microsoft_workflow_compiler_execution - add regression data
chore: regression_data/rules/windows/builtin/firewall_as/win_firewall_as_add_rule - add regression data
chore: regression_data/rules/windows/builtin/firewall_as/win_firewall_as_add_rule_wmiprvse - add regression data
chore: regression_data/rules/windows/dns_query/dns_query_win_remote_access_software_domains_non_browsers - add regression data
chore: regression_data/rules/windows/file/file_event/file_event_win_gotoopener_artefact - add regression data
chore: regression_data/rules/windows/file/file_event/file_event_win_install_teamviewer_desktop - add regression data
chore: regression_data/rules/windows/file/file_event/file_event_win_powershell_drop_binary_or_script - add regression data
chore: regression_data/rules/windows/file/file_event/file_event_win_susp_double_extension - add regression data
chore: regression_data/rules/windows/powershell/powershell_module/posh_pm_exploit_scripts - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_as_rep_roasting - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_automated_collection - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_capture_screenshots - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_cmdlet_scheduled_task - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_detect_vm_env - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_directorysearcher - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_directoryservices_accountmanagement - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_dotnet_assembly_from_file - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_dump_password_windows_credential_manager - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_enable_psremoting - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_frombase64string_archive - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_invoke_command_remote - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_invoke_dnsexfiltration - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_keylogging - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_localuser - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_modify_group_policy_settings - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_msxml_com - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_office_comobject_registerxll - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_packet_capture - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_potential_unconstrained_delegation_discovery - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_remote_session_creation - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_request_kerberos_ticket - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_sensitive_file_discovery - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_susp_directory_enum - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_susp_execute_batch_script - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_susp_extracting - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_susp_hyper_v_condlet - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_susp_invoke_webrequest_useragent - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_susp_mail_acces - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_susp_new_psdrive - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_susp_recon_export - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_susp_start_process - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_susp_windowstyle - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_susp_zip_compress - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_timestomp - add regression data
chore: regression_data/rules/windows/powershell/powershell_script/posh_ps_win32_product_install_msi - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_cmd_stdin_redirect - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_fsutil_symlinkevaluation - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_hktl_sharpview - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_infdefaultinstall_execute_sct_scripts - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_instalutil_no_log_execution - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_lolbin_ie4uinit - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_lolbin_mavinject_process_injection - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_lolbin_printbrm - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_lolbin_replace - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_lolbin_syncappvpublishingserver_vbs_execute_psh - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_msiexec_dll - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_msiexec_embedding - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_msiexec_execute_dll - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_msiexec_install_quiet - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_pktmon_execution - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_powershell_encode - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_powershell_exec_data_file - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_powershell_remotefxvgpudisablement_abuse - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_powershell_set_policies_to_unsecure_level - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_powershell_zip_compress - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_reg_dumping_sensitive_hives - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_reg_modify_group_policy_settings - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_regsvr32_susp_extensions - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_remote_access_tools_anydesk - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_remote_access_tools_gotoopener - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_remote_access_tools_logmein - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_renamed_mavinject - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_susp_automated_collection - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_susp_network_scan_loop - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_susp_recon - add regression data
chore: regression_data/rules/windows/process_creation/proc_creation_win_takeown_recursive_own - add regression data
chore: regression_data/rules/windows/registry/registry_set/registry_set_install_root_or_ca_certificat - add regression data
chore: regression_data/rules/windows/sysmon/sysmon_file_executable_detected - add regression data

Example Log Event

N/A (regression test addition, no false positive fix)

Fixed Issues

N/A

SigmaHQ Rule Creation Conventions

• Regression test files follow the conventions