{
  "id": "windows-defender-powershell",
  "name": "Windows Defender & PowerShell",
  "description": "Malware-, Defender- und auffällige PowerShell-Signale.",
  "version": 1,
  "enabled": true,
  "rules": [
    {
      "id": "defender-malware-detected",
      "title": "Microsoft Defender Malware erkannt",
      "description": "Defender Operational Event 1116.",
      "severity": "high",
      "score": 8.8,
      "enabled": true,
      "kind": "event",
      "event_codes": [1116],
      "conditions": [{"field": "provider", "operator": "contains", "value": "Defender"}],
      "group_by": ["host"],
      "threshold": 1,
      "window_seconds": 300,
      "suppress_seconds": 1800,
      "summary": "Microsoft Defender meldet Malware auf {host}",
      "tags": ["windows", "defender", "malware"],
      "mitre": []
    },
    {
      "id": "defender-realtime-protection-disabled",
      "title": "Defender Echtzeitschutz deaktiviert",
      "description": "Defender Operational Event 5001.",
      "severity": "critical",
      "score": 9.0,
      "enabled": true,
      "kind": "event",
      "event_codes": [5001],
      "conditions": [{"field": "provider", "operator": "contains", "value": "Defender"}],
      "group_by": ["host"],
      "threshold": 1,
      "window_seconds": 300,
      "suppress_seconds": 1800,
      "summary": "Microsoft Defender Echtzeitschutz auf {host} deaktiviert",
      "tags": ["windows", "defender", "defense-evasion"],
      "mitre": ["T1562.001"]
    },
    {
      "id": "powershell-encoded-command",
      "title": "PowerShell EncodedCommand",
      "description": "PowerShell-Nachricht oder Kommandozeile enthält EncodedCommand.",
      "severity": "high",
      "score": 8.0,
      "enabled": true,
      "kind": "event",
      "event_codes": [4104, 4688],
      "conditions": [{"field": "message", "operator": "contains", "value": "EncodedCommand"}],
      "group_by": ["host", "user"],
      "threshold": 1,
      "window_seconds": 300,
      "suppress_seconds": 900,
      "summary": "PowerShell EncodedCommand auf {host} durch {user}",
      "tags": ["windows", "powershell", "execution"],
      "mitre": ["T1059.001", "T1027"]
    },
    {
      "id": "powershell-download-cradle",
      "title": "PowerShell Download-/Execution-Muster",
      "description": "PowerShell ScriptBlock enthält typische Download- oder In-Memory-Execution-Muster.",
      "severity": "high",
      "score": 8.4,
      "enabled": true,
      "kind": "event",
      "event_codes": [4104],
      "conditions": [{"field": "message", "operator": "regex", "value": "(?i)(DownloadString|DownloadFile|Invoke-WebRequest|FromBase64String|IEX\\s*\\()"}],
      "group_by": ["host", "user"],
      "threshold": 1,
      "window_seconds": 300,
      "suppress_seconds": 900,
      "summary": "Auffälliges PowerShell Download-/Execution-Muster auf {host} durch {user}",
      "tags": ["windows", "powershell", "execution"],
      "mitre": ["T1059.001", "T1105"]
    }
  ]
}