Basic Forensic Rule Composition

A forensic rule must contain exactly one forensic event type (for example, Event Type == Unseen Command). The following optional clauses uses attributes of that event (for example, Unseen Command - Parent Uptime).

Below is an example of using Unseen Command event type. For more examples, see the default rules and MITRE rules.

EventType = Unseen Command and Unseen Command - Parent Uptime (microseconds) >= 60000000.