{
	"Side Processes": {
		"description": "Check if one of the following processe is running: `WPE Pro.exe'.",
		"countermeasures": "Exclude `WPE Pro.exe' process from enumeration or terminate it.",
		"type": "process",
		"enabled": "yes",
		"arguments": {
			"name": "WPE Pro.exe"
		},
		"score": 10
	},
	"Sandbox Registry Keys": {
		"description": "Check if `HKLM\\Software\\Classes\\Folder\\shell\\sandbox' Registry Key is present.",
		"countermeasures": "Remove `HKLM\\Software\\Classes\\Folder\\shell\\sandbox' Registry Key.",
		"type": "registry",
		"enabled": "yes",
		"arguments": {
			"check": "exists",
			"hkey": "HKLM",
			"key": "Software\\Classes\\Folder\\shell\\sandbox"
		},
		"score": 10
	},
	"Sandbox Specific Files": {
		"description": "Check if the following directory is present: `c:\\analysis\\'. Check if any of the following files are present: `C:\\Symbols\\aagmmc.pdb', `C:\\take_screenshot.ps1', `C:\\loaddll.exe', `C:\\email.doc', `C:\\email.htm', `C:\\123\\email.doc', `C:\\123\\email.docx', `C:\\a\\foobar.bmp', `C:\\a\\foobar.doc', `C:\\a\\foobar.gif'.",
		"countermeasures": "Exclude files from enumeration using filter driver. Hook GetFileAttributes function to return appropriate result.",
		"type": "file",
		"enabled": "yes",
		"arguments": {
			"name": [
				"c:\\analysis\\",
				"C:\\Symbols\\aagmmc.pdb",
				"C:\\take_screenshot.ps1",
				"C:\\loaddll.exe",
				"C:\\email.doc",
				"C:\\email.htm",
				"C:\\123\\email.doc",
				"C:\\123\\email.docx",
				"C:\\a\\foobar.bmp",
				"C:\\a\\foobar.doc",
				"C:\\a\\foobar.gif"
			]
		},
		"score": 10
	},
	"Sandbox User Names": {
		"description": "Check if user name is one of the following: `Wilbert', `admin', `John Doe', `John'.",
		"countermeasures": "Change user name.",
		"type": "user_name",
		"enabled": "yes",
		"arguments": {
			"name": [
				"Wilbert",
				"admin",
				"John Doe",
				"John"
			]
		},
		"score": 10
	},
	"Sandbox Computer Names": {
		"description": "Check if computer name is one of the following: `TEQUILABOOMBOOM', `KLONE_X64-PC'.",
		"countermeasures": "Change computer name.",
		"type": "computer_name",
		"enabled": "yes",
		"arguments": {
			"name": [
				"TEQUILABOOMBOOM",
				"KLONE_X64-PC"
			]
		},
		"score": 10
	},
	"Sandbox Host Names": {
		"description": "Check if host name is the following: `SystemIT'.",
		"countermeasures": "Change host name.",
		"type": "host_name",
		"enabled": "yes",
		"arguments": {
			"name": "SystemIT"
		},
		"score": 10
	}
}