LoFP / some false positives may arise in some environment and this may require some tuning. add additional filters or reduce level depending on the level of noise

condition: selection and not 1 of filter_optional_*
filter_optional_ms_winapps:
  Image|endswith: \svchost.exe
  TargetFilename|endswith: \pocket_containers.json
  TargetFilename|startswith: C:\Program Files\WindowsApps\Microsoft.
selection:
  TargetFilename|endswith:
  - BloodHound.zip
  - _computers.json
  - _containers.json
  - _domains.json
  - _gpos.json
  - _groups.json
  - _ous.json
  - _users.json