sample-rules.json

{
  "rules": [
    {"id": "DR-001", "name": "Suspicious PowerShell encoded command", "techniques": ["T1059", "T1027"]},
    {"id": "DR-002", "name": "Multiple failed logons then success", "techniques": ["T1110", "T1078"]},
    {"id": "DR-003", "name": "LSASS memory access", "techniques": ["T1003"]},
    {"id": "DR-004", "name": "New scheduled task created", "techniques": ["T1053"]},
    {"id": "DR-005", "name": "Ingress tool transfer via curl/wget", "techniques": ["T1105"]},
    {"id": "DR-006", "name": "Shadow copy deletion", "techniques": ["T1490"]},
    {"id": "DR-007", "name": "DNS tunneling beacon", "techniques": ["T1572", "T1071"]},
    {"id": "DR-008", "name": "Phishing attachment execution", "techniques": ["T1566", "T1204"]},
    {"id": "DR-009", "name": "Security tooling disabled", "techniques": ["T1562"]},
    {"id": "DR-010", "name": "Bogus technique ref", "techniques": ["T9999"]}
  ]
}