Editorial caveat
Primary sources disagree on the rule count; do not publish a count until the vendor reconciles it.
Reviewed placement
Blue team · Cross-team · Purple team
Capabilities
Platforms and deployment
Platforms: Linux · Windows
Forms: Command line
License note
Detection Rule License 1.1
Official links
- Official project — official
- Canonical repository — repository
Lifecycle evidence
First-party lifecycle evidence was checked on 2026-10-11. Re-review the official links and lifecycle before 2027-04-09.
EVIDENCE CHECKED 2026-10-11T00:00:00+00:00
EDITORIAL REVIEW 2026-10-12T00:54:37+00:00