{
  "Name": "FalconFriday",
  "Author": "FalconForce - info@falconforce.nl",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/falconforce_logo.svg\"width=\"75px\"height=\"75px\">",
  "Description": "[FalconFriday](https://github.com/FalconForceTeam/FalconFriday/blob/master/README.md) is a blog post series by FalconForce providing the community with free detection content for various attacks seen and executed in the wild by FalconForce.",
  "Analytic Rules": [
	"Analytic Rules/ASRBypassingWritingExecutableContent.yaml",
	"Analytic Rules/AzureADRareUserAgentAppSignin.yaml",
	"Analytic Rules/AzureADUserAgentOSmissmatch.yaml",
	"Analytic Rules/COMHijacking.yaml",
	"Analytic Rules/CertifiedPreOwned-TGTs-requested.yaml",
	"Analytic Rules/CertifiedPreOwned-backup-key-1.yaml",
	"Analytic Rules/CertifiedPreOwned-backup-key-2.yaml",
	"Analytic Rules/CertutilIngressToolTransfer.yaml",
	"Analytic Rules/CreateProcessWithToken.yaml",
	"Analytic Rules/DCOMLateralMovement.yaml",
	"Analytic Rules/DLLSideLoading.yaml",
	"Analytic Rules/DisableOrModifyWindowsDefender.yaml",
	"Analytic Rules/DotNetToJScript.yaml",
	"Analytic Rules/ExcessiveSharePermissions.yaml",
	"Analytic Rules/ExpiredAccessCredentials.yaml",
	"Analytic Rules/MatchLegitimateNameOrLocation.yaml",
	"Analytic Rules/OfficeASRFromBrowser.yaml",
	"Analytic Rules/OfficeProcessInjection.yaml",
	"Analytic Rules/OracleSuspiciousCommandExecution.yaml",
	"Analytic Rules/PasswordSprayingWithMDE.yaml",
	"Analytic Rules/RecognizingBeaconingTraffic.yaml",
	"Analytic Rules/RemoteDesktopProtocol.yaml",
	"Analytic Rules/RenameSystemUtilities.yaml",
	"Analytic Rules/SMBWindowsAdminShares.yaml",
	"Analytic Rules/SuspiciousNamedPipes.yaml",
	"Analytic Rules/SuspiciousParentProcessRelationship.yaml",
	"Analytic Rules/TrustedDeveloperUtilitiesProxyExecution.yaml",
	"Analytic Rules/UACBypass-1-elevated-COM.yaml",
	"Analytic Rules/UACBypass-2-modify-ms-store.yaml",
	"Analytic Rules/UACBypass-3-changePK-SLUI-tampering.yaml"
  ],
  "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\FalconFriday",
  "Version": "3.0.1",
	"Metadata": "SolutionMetadata.json",
	"TemplateSpec": true,
	"Is1Pconnector": false
}