From e37da467ec6e607c24ef49b99e957f02b7f599f6 Mon Sep 17 00:00:00 2001 From: Colson Wilhoit Date: Mon, 23 Mar 2026 11:44:44 -0500 Subject: [PATCH 01/13] [New Rules] macOS Unified Logs Login Window and XProtect Detections Adds 2 new alerting rules leveraging macOS Unified Logs telemetry for login item persistence and XProtect malware detection. New rules: - Login Item Persistence Execution via Unified Logs (T1547.015) com.apple.loginwindow.logging subsystem, performAutolaunch pattern - XProtect Malware Scan Match Detected (T1036) com.apple.XProtectFramework.PluginAPI subsystem, high severity Also adds message field as keyword in non-ECS schema for the logs-unified_logs.log-* index pattern to support EQL validation. Relates to: elastic/ia-trade-team#847 Co-Authored-By: Claude Opus 4.6 (1M context) --- detection_rules/etc/non-ecs-schema.json | 3 + ...e_evasion_xprotect_malware_scan_match.toml | 101 +++++++++++++++++ ...persistence_execution_via_loginwindow.toml | 106 ++++++++++++++++++ 3 files changed, 210 insertions(+) create mode 100644 rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml create mode 100644 rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml diff --git a/detection_rules/etc/non-ecs-schema.json b/detection_rules/etc/non-ecs-schema.json index 5722fd0236e..cbadd3c9f5c 100644 --- a/detection_rules/etc/non-ecs-schema.json +++ b/detection_rules/etc/non-ecs-schema.json @@ -282,5 +282,8 @@ "metrics-*": { "system.process.cpu.total.norm.pct": "double", "system.cpu.total.norm.pct": "double" + }, + "logs-unified_logs.log-*": { + "message": "keyword" } } diff --git a/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml b/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml new file mode 100644 index 00000000000..d8efd51a500 --- /dev/null +++ b/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml @@ -0,0 +1,101 @@ +[metadata] +creation_date = "2026/03/23" +integration = ["unified_logs"] +maturity = "development" +updated_date = "2026/03/23" + +[rule] +author = ["Elastic"] +description = """ +Detects XProtect malware scan matches via the macOS Unified Logs `com.apple.XProtectFramework.PluginAPI` subsystem. +XProtect is Apple's built-in malware detection system that scans files using YARA-based signature rules. When a scan +produces a match, it indicates that a known malware signature was detected on the endpoint. While XProtect events are +rare, they are extremely high-confidence indicators of malicious software presence. This rule correlates XProtect scan +results with Elastic Security telemetry to provide additional context for investigation and response. This subsystem +does not require debug or private data enablement. +""" +false_positives = [ + """ + XProtect scan matches are high-confidence indicators and false positives are uncommon. However, legitimate + security research tools, penetration testing software, or sample files used in security training may trigger + XProtect signatures. Verify the detected file and its context before taking remediation action. + """, +] +from = "now-9m" +index = ["logs-unified_logs.log-*"] +language = "eql" +license = "Elastic License v2" +name = "XProtect Malware Scan Match Detected" +note = """## Triage and analysis + +### Investigating XProtect Malware Scan Match Detected + +This rule detects when Apple's XProtect framework identifies a malware signature match during a file scan. XProtect uses YARA-based rules maintained by Apple and is a strong indicator that known malware is present on the endpoint. + +### Possible investigation steps + +- Review the `message` field to identify the XProtect signature that matched and the scanned file details. +- Correlate with Elastic Defend telemetry to determine the full context: which process created or downloaded the flagged file, and what activity followed. +- Check if XProtect quarantined or blocked the file, or if the malware was able to execute. +- Look up the XProtect signature name against Apple's published XProtect rules or public malware databases for additional intelligence. +- Review the host for additional indicators of compromise, including persistence mechanisms, network connections, and other suspicious process activity. +- Check the file's origin — was it downloaded from the internet, received via email, or transferred from removable media? + +### False positive analysis + +- XProtect matches are high-confidence and rarely produce false positives. +- Security research samples or penetration testing tools may trigger legitimate detections. +- Archived or quarantined malware samples stored on disk could trigger scans. + +### Response and remediation + +- Immediately isolate the affected host if the malware is confirmed active. +- Verify XProtect's remediation action (quarantine, block, or allow) and take manual action if needed. +- Collect the flagged file for further analysis if not already quarantined. +- Review the infection vector and timeline to determine if other hosts may be affected. +- Check for post-compromise activity (lateral movement, data exfiltration, persistence). +""" +references = [ + "https://support.apple.com/en-us/102445", + "https://www.elastic.co/docs/reference/integrations/unifiedlogs", +] +risk_score = 73 +rule_id = "d33b49d6-dd67-4a5d-ad9a-c3437dffc487" +severity = "high" +tags = [ + "Domain: macOS", + "Data Source: macOS Unified Logs", + "Data Source: Unified Logs", + "Use Case: Threat Detection", + "Tactic: Defense Evasion", +] +timestamp_override = "event.ingested" +type = "eql" + +query = ''' +any where event.dataset == "unified_logs.log" and host.os.type == "macos" and + message like "*XProtect*" and message like "*match*" +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1036" +name = "Masquerading" +reference = "https://attack.mitre.org/techniques/T1036/" + +[rule.threat.tactic] +id = "TA0005" +name = "Defense Evasion" +reference = "https://attack.mitre.org/tactics/TA0005/" + +[rule.investigation_fields] +field_names = [ + "host.name", + "host.id", + "message", + "event.dataset", + "process.name", + "process.executable", + "user.name", +] diff --git a/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml b/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml new file mode 100644 index 00000000000..8e0846a72ef --- /dev/null +++ b/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml @@ -0,0 +1,106 @@ +[metadata] +creation_date = "2026/03/23" +integration = ["unified_logs"] +maturity = "development" +updated_date = "2026/03/23" + +[rule] +author = ["Elastic"] +description = """ +Detects login item persistence execution via the macOS Unified Logs `com.apple.loginwindow.logging` subsystem. The +`performAutolaunch` message indicates that a login item was automatically launched during user login. Login items are +a common persistence mechanism used by macOS malware to ensure execution after system reboot. While many legitimate +applications register login items for auto-start behavior, unexpected or recently added login items warrant +investigation. This subsystem produces very low event volume with high signal fidelity, making it an effective +detection source. This rule operates at default log level and does not require debug or private data enablement. +""" +false_positives = [ + """ + Many legitimate applications register login items for auto-start behavior, including cloud storage clients + (Dropbox, Google Drive), communication tools (Slack, Teams), security software, and system utilities. Review + the launched application identity in the message field to determine if the login item is expected. + """, +] +from = "now-9m" +index = ["logs-unified_logs.log-*"] +language = "eql" +license = "Elastic License v2" +name = "Login Item Persistence Execution via Unified Logs" +note = """## Triage and analysis + +### Investigating Login Item Persistence Execution via Unified Logs + +This rule detects the `performAutolaunch` pattern from the `com.apple.loginwindow.logging` subsystem, which fires when a login item is executed during user login. Login items persist across reboots and are a favored persistence mechanism for macOS malware. + +### Possible investigation steps + +- Review the `message` field to identify the application or script that was auto-launched at login. +- Correlate with Elastic Defend telemetry to determine the full process chain and binary details (code signature, path, hash). +- Check whether the login item was recently added by reviewing Login Items in System Settings or via `sfltool dumpbtm`. +- Look for other persistence mechanisms on the same host (LaunchAgents, LaunchDaemons, cron jobs) that may be part of the same attack chain. +- Check if the auto-launched application performs suspicious post-login activity (network connections, credential access, data collection). +- Review the host for recent software installations or modifications that could explain the new login item. + +### False positive analysis + +- Cloud storage sync clients (Dropbox, iCloud Drive, Google Drive) commonly register login items. +- Communication tools (Slack, Microsoft Teams, Discord) use login items for auto-start. +- Security and IT management software (antivirus, MDM agents) register login items. +- macOS system services and Apple applications may trigger this pattern during updates. + +### Response and remediation + +- If the login item is unrecognized, investigate its origin and remove it via System Settings > General > Login Items. +- Check for associated persistence files in `~/Library/LaunchAgents/`, `/Library/LaunchAgents/`, or the BackgroundTaskManagement database. +- If the login item is confirmed malicious, remove all associated files and persistence mechanisms. +- Review the host for additional indicators of compromise. +""" +references = [ + "https://www.elastic.co/docs/reference/integrations/unifiedlogs", + "https://developer.apple.com/documentation/servicemanagement/smappservice", +] +risk_score = 21 +rule_id = "e360db98-825c-4674-9dbc-0b3d42cc706f" +severity = "low" +tags = [ + "Domain: macOS", + "Data Source: macOS Unified Logs", + "Data Source: Unified Logs", + "Use Case: Threat Detection", + "Tactic: Persistence", + "Rule Type: BBR", +] +timestamp_override = "event.ingested" +type = "eql" + +query = ''' +any where event.dataset == "unified_logs.log" and host.os.type == "macos" and + message like "*performAutolaunch*" +''' + +[[rule.threat]] +framework = "MITRE ATT&CK" +[[rule.threat.technique]] +id = "T1547" +name = "Boot or Logon Autostart Execution" +reference = "https://attack.mitre.org/techniques/T1547/" +[[rule.threat.technique.subtechnique]] +id = "T1547.015" +name = "Login Items" +reference = "https://attack.mitre.org/techniques/T1547/015/" + +[rule.threat.tactic] +id = "TA0003" +name = "Persistence" +reference = "https://attack.mitre.org/tactics/TA0003/" + +[rule.investigation_fields] +field_names = [ + "host.name", + "host.id", + "message", + "event.dataset", + "process.name", + "process.executable", + "user.name", +] From eb5ab52973f44956de70cbb55ab8585c3bfe3ac2 Mon Sep 17 00:00:00 2001 From: Colson Wilhoit Date: Mon, 23 Mar 2026 14:11:30 -0500 Subject: [PATCH 02/13] Update Login Window and XProtect rules to use structured fields and KQL Switch from EQL to KQL since message is match_only_text. Use unified_log.subsystem keyword field for efficient filtering. Update index pattern and event.dataset to match actual integration naming. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../defense_evasion_xprotect_malware_scan_match.toml | 11 ++++++----- ...in_item_persistence_execution_via_loginwindow.toml | 11 ++++++----- 2 files changed, 12 insertions(+), 10 deletions(-) diff --git a/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml b/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml index d8efd51a500..f767eccd10b 100644 --- a/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml +++ b/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml @@ -22,8 +22,8 @@ false_positives = [ """, ] from = "now-9m" -index = ["logs-unified_logs.log-*"] -language = "eql" +index = ["logs-unifiedlogs.unifiedlogs-*"] +language = "kuery" license = "Elastic License v2" name = "XProtect Malware Scan Match Detected" note = """## Triage and analysis @@ -70,11 +70,11 @@ tags = [ "Tactic: Defense Evasion", ] timestamp_override = "event.ingested" -type = "eql" +type = "query" query = ''' -any where event.dataset == "unified_logs.log" and host.os.type == "macos" and - message like "*XProtect*" and message like "*match*" +event.dataset: "unifiedlogs.unifiedlogs" and host.os.type: "macos" and unified_log.subsystem: "com.apple.XProtectFramework.PluginAPI" and + message: "match" ''' [[rule.threat]] @@ -94,6 +94,7 @@ field_names = [ "host.name", "host.id", "message", + "unified_log.subsystem", "event.dataset", "process.name", "process.executable", diff --git a/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml b/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml index 8e0846a72ef..360da9fc28a 100644 --- a/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml +++ b/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml @@ -22,8 +22,8 @@ false_positives = [ """, ] from = "now-9m" -index = ["logs-unified_logs.log-*"] -language = "eql" +index = ["logs-unifiedlogs.unifiedlogs-*"] +language = "kuery" license = "Elastic License v2" name = "Login Item Persistence Execution via Unified Logs" note = """## Triage and analysis @@ -71,11 +71,11 @@ tags = [ "Rule Type: BBR", ] timestamp_override = "event.ingested" -type = "eql" +type = "query" query = ''' -any where event.dataset == "unified_logs.log" and host.os.type == "macos" and - message like "*performAutolaunch*" +event.dataset: "unifiedlogs.unifiedlogs" and host.os.type: "macos" and unified_log.subsystem: "com.apple.loginwindow.logging" and + message: "performAutolaunch" ''' [[rule.threat]] @@ -99,6 +99,7 @@ field_names = [ "host.name", "host.id", "message", + "unified_log.subsystem", "event.dataset", "process.name", "process.executable", From 562ec3f879cd3c8e1b3324d4ec60642043035dd3 Mon Sep 17 00:00:00 2001 From: Colson Wilhoit Date: Mon, 23 Mar 2026 14:33:58 -0500 Subject: [PATCH 03/13] Fix event.dataset to match pipeline output: unifiedlogs.log The ingest pipeline normalizes event.dataset to "unifiedlogs.log" regardless of the data stream name. Update all rules and index patterns accordingly. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../defense_evasion_xprotect_malware_scan_match.toml | 4 ++-- ...ence_login_item_persistence_execution_via_loginwindow.toml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml b/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml index f767eccd10b..f91433e3be6 100644 --- a/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml +++ b/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml @@ -22,7 +22,7 @@ false_positives = [ """, ] from = "now-9m" -index = ["logs-unifiedlogs.unifiedlogs-*"] +index = ["logs-unifiedlogs.log-*"] language = "kuery" license = "Elastic License v2" name = "XProtect Malware Scan Match Detected" @@ -73,7 +73,7 @@ timestamp_override = "event.ingested" type = "query" query = ''' -event.dataset: "unifiedlogs.unifiedlogs" and host.os.type: "macos" and unified_log.subsystem: "com.apple.XProtectFramework.PluginAPI" and +event.dataset: "unifiedlogs.log" and host.os.type: "macos" and unified_log.subsystem: "com.apple.XProtectFramework.PluginAPI" and message: "match" ''' diff --git a/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml b/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml index 360da9fc28a..88c3c7f10e8 100644 --- a/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml +++ b/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml @@ -22,7 +22,7 @@ false_positives = [ """, ] from = "now-9m" -index = ["logs-unifiedlogs.unifiedlogs-*"] +index = ["logs-unifiedlogs.log-*"] language = "kuery" license = "Elastic License v2" name = "Login Item Persistence Execution via Unified Logs" @@ -74,7 +74,7 @@ timestamp_override = "event.ingested" type = "query" query = ''' -event.dataset: "unifiedlogs.unifiedlogs" and host.os.type: "macos" and unified_log.subsystem: "com.apple.loginwindow.logging" and +event.dataset: "unifiedlogs.log" and host.os.type: "macos" and unified_log.subsystem: "com.apple.loginwindow.logging" and message: "performAutolaunch" ''' From 4eb2b803a3339a817af1fed32ae4c4aa98f69490 Mon Sep 17 00:00:00 2001 From: Colson Wilhoit Date: Mon, 23 Mar 2026 16:31:36 -0500 Subject: [PATCH 04/13] Add unifiedlogs integration schema and fix data stream references - Pull unifiedlogs integration manifest and schema via CLI - Fix integration tag: unified_logs -> unifiedlogs (matches EPR package) - Fix index pattern: logs-unifiedlogs.log-* -> logs-unifiedlogs.unifiedlogs-* - Fix event.dataset: unifiedlogs.log -> unifiedlogs.unifiedlogs - All rules pass local validation with updated schemas Co-Authored-By: Claude Opus 4.6 (1M context) --- .../etc/integration-manifests.json.gz | Bin 27004 -> 27103 bytes .../etc/integration-schemas.json.gz | Bin 7974839 -> 7975251 bytes ...e_evasion_xprotect_malware_scan_match.toml | 6 +++--- ...persistence_execution_via_loginwindow.toml | 6 +++--- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/detection_rules/etc/integration-manifests.json.gz b/detection_rules/etc/integration-manifests.json.gz index 7e812ab2871df31e03c1e06e490bfc054c29fdcb..82f2815fda0e4f16bbdf2f8da33030ec7e5b08d8 100644 GIT binary patch delta 131 zcmV-}0DS-a(gEMo0S6z82ng-4!LbKuX>hb3dpjAw8`qc1Ma$d6(&jt%(xlCP-Hc}Q zdPAM-(Z!#C8mu3=`uAN`+9=27&+)P9)#_}LiQK#Yc|2*p==`jG>bvRe`l)(>FT&|7 l%K_yuIyo$5IUJoFE@e49og6+XmX$}1IpZ`Cj)6dXx#1H`Wb`Ny` diff --git a/detection_rules/etc/integration-schemas.json.gz b/detection_rules/etc/integration-schemas.json.gz index 19403ba053311ed05946cc4b20f218479a332891..80df6526022a4a774c41747d14e3c70f33ec9e04 100644 GIT binary patch delta 13072 zcmcJ#cRZE<|399>B{NxN79p}_?<7e?8QElI?{Qg2<4Pzpud-Ljv3Is4n~;^2Eu&-a z@jWNit9rfOzuV`Z-#^!5JRi^d^D&;|I@j}*j832E9-lq|Fa+Y^p>k^<01$u$0mmWW z1O#A101gD;LI7Hc2LUG`03QMfAb=18h#-I%0!Sd>6aOW9AfK3#q8Q*Jr&}UJ> z3HLy9IO`q=;Nw1*G5+|{sp};T9Cr_-#3=C)Gh-{`geE5jqy=9PnK%)fgk4ZrjabaS z$x0%BY3an?F)84Se3bZiu7(6n){aS8fHrJuCdiM$85PT~0N@wOd39FibXJKv=@Fc8)e&Ckbr@PE6!{<#vDvW{xXMQCy zQVb?F0a-CJ4o+5}pSBR3XAE9|YmC8@fXjf&eBknJ0;6G0mxv+I9|ksXX%op zh6?m`>F*QwdK0QZBE69zoOM^r$&|rGc34H|6A^}#R5B}3w0}!VT}d@F-Ib&vh@Smi z?A;rASq%Aki4Bv|1}-mx>0kg1W@-Hp)P zh23*mGrq|v$YaAOGX1>eR@Iv^tL5r~MM=dm*Z1zv&8TILTW3r;4B=bf}Z9$mwd`-Auw zz{_UfIqWCKy02ggb5IPseZZ{*Rx<~A0fNfv1&t>paH2U#2FII&6u4B)yj7(PaIHCb zKJq>Y;5-YQI`a+wW)3pK9p-3x;H8oj78PuJAEY&*Yp7w*#m_vB zbjQ(9ZIN{#q&?A4!)s4Sn|z{S>xuD~Gs3t*4}K%p_!}DIzn7U<=5$^rzA9?}*dF19tTBN4oOA7nXck4L)_;?OAM z_FcrohAi1xT&&3UwdAu~1SZRi%;$IFOasd6uus7|PsnfW$#pWZ@MTmJ<<#RR*vXnpX9Br`ep zLl$?kk;g)n=j}YWqI>%$7++t@jFNsc^7OX1AbF44hXpRn3?oa8VpKt%hkv%spt;R( zenEx}_c}#Od;YW|GorX~k)$t%FtN_fk2p}V&5t#7#enHn(cb2`RIfzuf$VbMf!2}< zjdO+Wvw;e~o$gkx>-XzUPBUtK-Kd*-eMg!?1xF1_U3#5XT0kMx?Axb^(&@4L=-E3E z*pMI1T-WAOy#&RXB&YRyOWLWdQPm|K(`#j^TQNCP>E3Te(uPRu-dIegnwi^Na?~=r z>ok_+IyfhU9Gx?&h4y!?Lj6NfQkd%_1tFGR~xg{rtQLa?{Pd2x8-z{v@u?c|(*>0f36s3zMc67eMBnS+@@tg_;m`sOI4Xl#xqY>1b-6;s|GSW{!=U&%_RG?dCv|aBp*v-5L7m#e0FD z7Xt!k>Q>(EBu;haE3He+?*zC8#Bm`^(*ouSYu6g>I?U=M4dSh%I15ZfbO=efDxCYx zko>5X5hYpwUer>YU-0GV$D4_puKPaj8BFG)_@=VPq;7~@Er+FN-IA!07D0*8$|ZH8 znS@-2xOEYNsa0oQG0VF8^uZk2yxfi)*|=K){2T1A*2EpCXo9-x`O3NRpA~kPeH~r3 zU*XDlH-cF9;oI$5{iJQ(i}K|xp4H2wpi$SPXfBz0%KCPs?2sXgIzP1q@YCTeSjil* zOOET&>o<`udRgdJ;~AaB*)$%$;q^f)lP;BO(C={A`)f)=*GNuEzgbATW=l$k1N|7$ zb1P(^g4#0b&6#bUH}7E5*koM?ky^U^jTJMQR+B}GgFJZ1w5U=&n1-k!+yNcf`- zcnu@tiF+F(*FEg(ElrE^wY9P`H8d_E*Y&isvgD08$>4V?!sR4U~hrjK>4yC!Y7dP zItmq7vSBXjrJHS8bwVr7Pa<==z9@FD-ds$#iDDYx33~f3euP3fExEp1T)gt~-aR)D z-i3RvyyY+TTDi=q3IYe}7sgu(0uk+L64h>c-jkIWxAjvraHl!=;0Qox&`fO7!N_of(0?Dkam`>A1u<*_X`+J^)8 z&s6aTF4*?yof{nKSd}#;aNMDPl4$&uO^qzizyGQ=qaf*S*wcP>GKV4VTh0@bQlbK4 zv&#~Up=3?|lUE%Xw^bRpiC|Sn^s9)EBPfFnU-wajmmNSF_@e_TjI+|g5^4ZDID$%W zf+Gk3du0BTLb#!Dt0TxPArc%T-_A4>g3t|)Sy0+YHR#Uy+P5|z*q4Jy&b}$h!VnhR z)G#@r2?sZoPwK63ftw~^2{K?8_eqvQ8{Fvx-UM`>EEXGi*8Nk!6X*iMV@{wryo9b9 z4!VRsM(_hC@H(c3c-UxrO-y;YNEhV=tV{G=v5v3$na*gA6vx4X&L9Ke`MAPUtdtQR zbp~&oW=4g&NxiPnxzel9v* zGOp-Jo#29gAwtP%RgM0pz(Lh(RrSHDuAm^sfEsr*iDMLH1}D0J{H&wh9HUwP-_y+# zJ>B3ccaR2mi%>bQsTMW>K~Y#51j%ui&0PZydEgLqBWwqP?C_F1NPu(jNqIT`yA{7k zeayJqBzanQ=ePxZoIbTro>=7>Nf6u>c;$>N%ft!R92Lz zK>Hwz&#B@UR~`{yDMeomN=Tiu+Kb-ozpys%eQ-sXZ^j~izwZjv``n|lq@Hqhz`ASA z|FU>t@AIf){nZhpMNX`BMH;DkM5F0a7GPXm$W0<&O~p-8Qu*A)*~G1WOr%tJ*#xY* z5o=Z!XVzR|HNi+6Hgy1KNJ#3xE((UIRQ7DA65loA(_m=}=@2}rt7A{} z={{b?m8#I@#!;md{8|9GH$1-b*=o}G&FJ*D+@|~OPEYfw$eikSbu9ZNl?25VV+^ORGE=$(Us0VT!B1@kdP#1J` zFnSWQE)#b!UDhBeLI$Av5R>M0gKxJ_A?bNgYtQ>fQ^kD6G9>`Yj#7OsEn;6vb%2 zi;(tpiC_zhX;+_XS-axkt+AoY7X7l|afW9;7rOmYnToVG_+MqtZ6YW{Jjv_(I(kf^ zxO#=+*x!{=8j0Br8j{cXP1|)G?ATLUZQVd+XOC3Q8D@xl*$|vvR{QXkZx8$NMAAeY zY~_45>NP`w!#wWSic@agOP}gG?AO5{b7Z-~=Rz;ua!-+SgMDs3Ox@KpVOqsQL#A}p zALZuxGiH_7%aRRh_oomDKlSBHzJ5r=g>C!rDFtCm1aV)7E$Yd@)-}C8v&DFo4IUyp zSuhg6+M)YG1=+;L{x|EjO>rG(cRN?Xx!qP#x;S;CkBg6DFL+D#DXfrZ?Aw22tuJxd z&$5u>U9jmLlSA2skf7d)*xo&Gns4B1N<|bMLIc-=gey*bwRb_JZB|ONCGrGN@pvkh z_l65ZySNh!TDC^@NLaN+Ret&uQ;wwiYOJmEd4YSFJ%Ew=W*eoH7;SfK6-$xC*D3by)1Ohix|x>moG zAU11Z7}FcB!hON8%s98P>r}?l%ZftHczs4l#VTI`blR@8kt?6-_A@#N=k8_-8i12s zqV_l0>F8I__vz(g3_ie1rv}>Z9cun2X?Q2#a|n=}RZQ$EIk+koe@2oG~kjt*F{i z_=PXXiQ5~SGyKKsI}h}RZ4k5psC( zcr-r^k>mn)o6#_m9}bDx476s6E+$PU%oW<$P;^?%M_qbJ7wtu)Y z;C!!{+t;#{7VojDA-ue`oIU$`NOZHX3wG@%SCN!gZ&8(3$94jJeZBX@vdg8ZVMCwR zmDz5j{$}mUT>N2k>M~%4oVu@3kkeL_F#9MZ_`a)VMdMNoGRjZj9ktQ(+-rB4GD+(| z4+Qbd0K(n;WBb^nqLF3|iMM(qW^XK4a-+nJq5h9bYZk_H!J&~>;~~geW|_Av}s$ zSv!VdY92Tk(w+f6pvfQlUk2Zq6|!yry{kTqQX%n;w+}@{SSWkd6^oH)f zV_1KI93i8;-D`?|GkOBl)bQ{S5}v55;mQ3&{{!U+?%1Y3Y#0QRi=REhegYgVmG7b4 z!;JRB?myl4q^Do9u{VWv0zn^~I6uHk2)_Old~p1L2Sa_ZQFSM>VI_YMfe8!!^T!`l zL5%pg|KFoH~Og|<3oQu7RHxo=J>Ves>Ywr2%t$c+!=)aqSx^p^NH*kNTv46 z=KHk9jL^?=)ayrgU;Lzp>F3y={z2Rw$VhGfbmeCtAJUaz$>-pi<7A|8!V{3{&d+!s zpqI@NzBSpe$S{obzq56UqN3CvujEfhe#T(@32qNUf9FF7fusIwTl!;{GWi*N&95Pg z{eOn~J+Op-2lW(R|I^jSgS9;^oV?W_ zdM)LJZ^^~fixqwcqld$b!P&N!u1?Nx?i5sOdU`jI%LtUu8MJ?@DrIU(j@pmCeW_<* zr3XKaYgei)U@m|4PH;+C{2kOiD>o8WO?`oKu`)uWr$^c+6PI1_O6kE};h;CYjOC|= zvz-GMW+zvNmgV$JJ?Y8D61%m^N3$8yzq1EQrOZ+*K-L01d zPtiOjdXIbWMBambY3pikx?Wh=DP9)R?G(lcJaTAe(&}_y!r`k{KJ{=zL}`KQZ+?fi#V%phT#mk zUJ^_{eES!%wN@J_QZ@Z$^#_BiM}zKr_BZDyuTsSQFKe{rzf*P*lR^v%+JkEmN2&Ue zIliA>f6ok@_Yx#S)avqV8mbNSd}+?)D`;+I=SQ~w#nffDp|#Iq8SX}S|DSE#SyLwo49{NiQ-A|pCC1F;jl!%(=x zDO9a~DEX~OtA#%^_OMX@pJMU$GqLXuWVV>>@v^J|`WN!`U_zZs`*ogHJQB&_0r1Bk81tSZ(+ zt9G0EBNIrs{s2KXJQte2;y@RgPsJ-PG?%NRa4%UDBn>I;Pqa9!KF|{%DGO$(C%L_9 zo5B3tV0C<^iq=Xn{l=?)?!lI*C1tM2BILMJqaX=)zMr47DrH_?gUc`+aZniQ^ayrne`ybCb)kxU1%=6 zB(0+<-HfVXZ}D;<0-;R}pV#%JI8Axy(^pft*in(7N%!s zoZdZY_{7dV7_XL7v5<<$dT!ZYn3afrppelji_xiXUR~dwvKyKTzHqp#eG9cd zQWd4M7W7#&Za>V`hJo5mjk+*rlR9vCU0m2hv$pb<>GoW9X*?%t`<`lbpJ%B{2@B6& zK2=25YT5;Md9|Q)T2+xG$E#CMn@J;>juhPya85XS1AW~WolQP}4*H7MO`6Jdvte=0 zR@1G#Y_MlI`H|hZNOhyZB=-u{b|Aa>cPrQ|0%V3gB0y5ig9st% zGNkO#I`t65Ud5Z{ebbb}5*BsSlJ74D(@5IN^irND*pObRxIAz8`J%10n{heK;BY_J zk-AnK15#6I&pkx2`R+Gz>E#R)&g#%_2uG$E#TllTz%V5m+3%O5dvXU!__tuyNc4rP zRwUZbpASMr+$e49oyGLB4CaBEO4i+qh4U!z!t|p!2Coq>!BMTZ2T~G({azAccAbkn zt-$bTa2WCX3f1)aT$jEHVX1}(G1Vg>F$8Z;-!`>;^~N+c@|CvPzZjO38`mRVu%B1I zl0gXaOxC^tWa)n}EEwfuwUcN7<`n!tYI0N|OnaOxtP6u@&f?g%q=%}?8KiJ`QGE?u zliOkRR)tuTZ(M_k(ao?e3{t=)+h%RAx$&1pcMd=MX67uE+|m{Dnn_VUG6-Yy*D-N)c2L3LPMq+A z7?6r$R{M5P3hiG97n~T4{?)k@1>(cLF(8>igFSOy1feFMZqvUQh1)^VF!R*)W{2NA zC_i!v4o_Bm5zfRWf1CKfjx4U1o*z6u?jx_3N7x%f{3ex znxWwn)20d{p^igG!To^#9xwCM?CA^Wp+mw?{QE$}L>ec+HiP^J9p_b;V>UC)`wIO! zq!0sE0Ua;HS8eQ>|L>X5`~Nc&D0nOiq@sL~jY;SE@9z+pO9}L;o&GKiHi|`mM#zoE zT(L)i*n0n6jqmljFjWd_VX7*W{Cl>(&khBVGHgsXFHHIV{RVL~HO!Tow`E~fOhK4p zK_BHc8NW;QqSucmTVt2Q9~;szW{-mZnQZyaU;f^csJ?k`YKbliZ#_y~++%|e;?cn2 z31Ah@h|K5qB6t}sQ`Fd4h;_Nn9<7Cts_W>bk+B4ykH`E)A_3&on}DAg@cA@tG5^IV zd=4t4!*oqqEY&wtSdT=s>o^n4H+|pJ#ywW91;4559edePUZt5s zPZ(aU&!@r#<0XOm2#QYWdMIY;#H;5%%wbJDGze`Q9r3Xj_q>^J zQP)fI)tZMrs;n{5Dc6>=In2VLr?7k6v8;`!#k{W5ddLOzLrB=oE#1@FI;`8~*b8r< z)G!~*?l7z@n>uN2KrnEy*W6*AmEar5vUl0f5jrAon%!&51d39}bsS=bhAp5k9bqLe3l0(xG zb!$~SD@Io~`&GMomyWPwauZGV`(J8niw-ttPulL^?S5##2#4J;ox|=ik@LF>hjGC^DX~RqGXeK=-#o=VyyW8|na}r@gkfg#3(YAVk$5-l zHH4@{U9NpNhgjD9+GId$2?CYN<6%#qN!?LUDan(c9;Ki$jFg<)dm`oRF)$#GDzmL> z{M^^ZGJ!Y@7!o+6^{S!W+7DUgb+JBpd{j>|yirRsKSTK7&@C;P`$`fM@=AdL?M`wU zz2YIK0ewn@K1p^Fy*5dfU$5+Z;`&FA`x1pm;)GBkeXie#EGlvHqvx!|8odWe<&n5W zR|$Okm-Ztb+R8^B<&X?_q<~b|iJPT8aAyig&gT(4`q9&?^E*g<+2+OI{u6r8T(77q%gwG-S%k9&6?@#p?(>gYc1-S@`MvvUWoehpF~?hu$fE&Lt-C+5yo&KE{K+CRk~qhrL`f{@ECRgWZGi8PJUbjjS z=%TJHyjCL06dTh1^kph@XJ`W7uhMPNW%EpyVj$#J*E@lV>= zp#Ko{fmm7GhVDwo!y?6#)ca2=#d|lV=Cro;?8iKMlh!_YE>`OoFe11ttf&h2o|kbS_C{?zT<4xk*dgMq2F9W(dd)WnYBlfKE$@W$ za*%|?lH7M2-e;tZNQ4m2yyrX>Q30vvGYJ`V{8-Dt<@zp@P-bv`s;sibQBG-@Nr`3Z z>vWwa$$B-ZT)cr(j2(T32uU`>^NQhUl1vW-fCQJvuXKt9(6P%J-U=XJgn?%&TAccKAAZYPxG_*;Z2I#ZFaVZ@EeF5%&$Xlqh;~@lnRFk z4ELkur~$N80JHv7VJzY_ZXX}L@w4xb9?fAlnsvVD{0GEIuS=N0ez(8H&Q@J|;|=0( zZ1JKL=l^iyp2F7++8?g|a&St4c}nv?2GmyAR{Glubc97IlSe`S<_Cfe<4F09zrsda zXQk}P{wD}_)nB1RgtJD3Bg+297}(OyD4G9KArjT9F){AVDf!{EANnfc!rK;>dXd@q zfy>Xco0}0*+FpSZp0Bvgr0P10o=V=0rQTq`_fy`|@Z+AV<)ZOfG2706Bd#G*eg^5N zA%cuiZ)Z1;C}`H2%0!E9=`lGuy3QJ+mtrH@Z=+gR{`CTjzZ}0m<@uU5%&exm$ zD*xCces&nVF%vEGzHfH5Xh1Am>Wijn+68=+t+1KfXyYTtG_%eT3*-*(MMP>K!&mWL zRvTf5Y|UWJz?shpplJ@P>YW4ut~itKNd7GjFXq6s&fJ#lYMQ{pi{hbEeBLqKtEo^y z58uI^s*>Do9sPpRy1{BKZJj5VGpiBt5ViT4k&ya3d7Z=7f(l_4gVzEl$9QA8$`4-+ zh@V6xH|)3%bmhvWSlZp)-+NfjX>g(X$^L$)$BP) zXZ@jvOl5+;3U@lyCxSVs*JDik9}x%LnwY1*HNNwwRiwul^7n2y>sJ&jmz4hM_*#D} z`zJ64Nv2Z8fScS8ao=@Qcn>AVr%X9zBhEU(3J>LAU{`Sh!AiY7w*%eXUTbJ9)t<__Wi&j2Tul)Fxh%IKV{j zwvNa-yt?ZnG|y!IrEzZCI`sLwvzZ-lIAY$wV?x|?B@F(7&Y=e!_|GHtxVjp0J4WQ+ zGwz8_jR}bpsrv}~Ul^Oo+t1Xnai;Rw59&`!Hx;F$=n;%YNbx*7RO_{+R6dxBR>@w- zmlIX`#u6(T;s|bPs)*ewaSi;qb3oC~SbunSV^lPp)@VO{rUkVTf$Y^F(wXV0P92W- z+KwvsUd|vY%Oa9PS*p^?RaT{fTNJv53`0HO>(On`N~JV&RZcxkY&zGQ!UZzagUJv zbGDBd%3IYXPK$=sP5Bu=&p^aUrhv|e2-EH@mOO6dwVjZ0MW@oV#`501X5+TIP9&86 zY)_rf*EiX|$c&US>y#HvE9y4}>X!1RXApCwQ}1=CwOnZrCPG1`O>wTp66XH?}BBt z`N>h>ef^D&+RbuZ9)h$~bwPhyTKY@VALXj(sf6hrf|C}j;)O;!m_|DWXLrH*eesq3 zz0=-O)$UTkUQ*T9Mmut-4t!Wv!L2OB+m#jZowsIf!a9$s?E4i^3kX&%@sva-oz`o9 z1x@eHPoTItD(oSdcEQ!X?YQRq9IHn z^EStU2p{p=hWffKimXRgML=+m{+{PsSI;Gtw*KMIR=&{_TasWa%Pj$tUfpG)HXYHg zE=msG3&dU3vTbD?9*EG&HX#DW_`2ytu$X_zYqbOY?~(K~B(4m)EF|DU*OyvNV{g~9 zl-!pLhNo_A^Lbm}y|entmitXMpWH~`lpRjA3&uPiA*c>fu`LUQ>+H8&Ip6srtUkR{RuD15YJGaEGI8z55 i1|i=`GQ9K8%{V~XDQ)9l5jd1OWSI08zD6Vb6!?FMC^BOJ delta 12814 zcmc(FcRW@9AAe;WB_y+m6v|#1nUy4DX3uQ0cgH%3qa-8ih>$1=*&{REM9AJ-vNsvm z{M}3Y)A#rI{rCIBd9COBwcf9@?$P>X45x5#3+fq`Q%KnerLVSo$<$YFp21}I^G3I?cQ-~# z!oXD+kb;40Fdz*B*I_^g24rDC4hC+(fIJK+zQlrGh7Z*420e0inC?Xp8rDWF^8mtN__Y@5!-tjKA+%cXD23znwy=}a*A(L zqM1UrHE|T~k`3Vsy*QY%)HAZVW-(^Qh?$&YSvI)pSK>5mLOli6&4k0xG&tc7YcpYd-4mU*E1U!Lo znSh6}NYAeb&q?4TL}E+dP^AO&*E7(5Og%Dw+fKs42UvJZz-LgR4W%k9}=x*%}{ZAjFT(^h)mlCA}Y%fEv+`m8+h>s~qiPQT@7f~<+X(5vF94N;7QQeoEB6iNe z|7YSM%jseIo`;>V?tM^tVH?<61`Su_JrFSXOKp7j69-y@gx5)JdV)EC&(oW zkmH~^Vrv1?8k1GOW6e5}ekkn@o_ceQq{C5Koa%Qx_D5;Y`WSnnu*`S)J4uQ&j_~Sm z)Q<0qc1_OW!nYRGX1Me8OdfRAr@)D1qj_UlA*~&uMwNV}s_1B(0y>GuPLp(?;_!f< z;IO=1O>BJK%l4I`>#3w^%u25XpQ|PiN##fK^al3aj`ol2-?Yxqe{NN>+O1h=oiWuT z=Tw!GpI!#(25`)7poq>%PAv2%qLx&acLI_(I%{rb?38VVsDB!;JSD(Kp5A4_Br<*)^8YS^7yoiojZT5+jZ zfaAZ87{qOQ4m_LT@;5ywoFMPt{)yXtF{=}z>rqVU@0I3i;GZ8J&8g2CelImruwtiP z(T=*q)>_(LCu6>R+Y;UCOz(~q$lIk?-9OC`QFq*WkSD`r8mYs+)K*0xVpHt6RaUv7%7tO?}0DsaA^0)r<{K^lPGxIG)## z{KJJ3N4`xDO#{BULd%&jw`%4ztKLs`x(R33ITMg-?e;|?lyR<&b#sv(xag^=r#V(!n5 zv0Pt)ry;H0r)ps@?^6$rRN}LdB$-Asx3|MWv0O_fIqzyVtfRKKsTBrH)w(vh2IS2o zJmR(MK5v}L8l@}?%y&%McztE1fOdgVLuYL_$wjim6@3dzlhTiC-?VAVEhfAi%RU}H zM|{UTHj;KI4O5dENa!8X;ff&#^EjX%EgAWrHL*!UOXHwfeGE8 zvz~O6r?%hzB8(*3fM*dU8_WqkXafTHE3+Bul^`-~0}5cZlz1J5h1!`&lMN`1l>xC1 z!2)eAfGS;Goh>c0z4o?gevbCwi}oInTtMaOJ@(5{r{zMKYL1&6&cW6CE^d?Gv+h0E z+Qq|zC_90Sh`lX{i>pIZfFM3jpbTQ~1mXc4C|6WgnGwR{1YX4gj^fhz&+;QpPN2fE zx-2gqYc6~$a-D}9RZ&KA2xJE`L%kudyKGBm!f+|q0>5euG>U4cbm0$xgX+*QtQ;Z#f+%<$^gU2iAP_1?Exm;TU4XJVi zyQ^l5TzN{O_3Amzs1g$Nw!R6?qRZq~9>yZ@o1O&aW)?rl-inv=d0SLMHUD(=ydkx4RQwfw(%1*`ADE5EvLyl@=n0bE z-(I>ZIJcbCn&nG3c=pW2$4{>-FrEveXAHySQ0V~PK!zMJ7v?RefUlj%q60{al{v5n zLcCq;GiWBn#}O1mo;iY4_!5t=dz+p{>K#F5vE>@@tEeL#x_YJN(}0QH2LE=9w|s@T z$M%NcRP9&eB_4FN=M8ah7j$%~+yK*jm|IAc+fB7TL2hgL+h#wv?Fgk=mfIt z?d#rFA`7;dK`Jrq(&zg*07tP(dc0mD)GFcLF5}l_^>bTSAc?jh*D;CLh9!$Ra>q3L zxWWv;PIu&>3rJ5mcW`NLW#}F@KGNq5%93nHEZO2|olBY{JY;tZt&b?XfI?BOAT|DA zZjNU~G-BwAdAiAR0a1%fpAU&w^2m;r#vwGcnLl!}h72$RV&*Lf1a2PBi4ep={Za^8PHH+>bC)UDgOyW|0?*=P+XjlM$9EGPt~QrfYlNPNrUU0*w`*-k{eNOMqFQ0K5eYMV6?Y&~Ay zkdov-ujv^}Cr3m4;bm2OerHW}OX=t3z`4cb=W7jl90p!-(}#vaA-D8Jw!th<@aCg& zwDF6FwBObQ+?uBOx_TVF`sTOustRXIN@tyH!R%Ho3q+*Cb>;Pk+|@DWNVD$p;TExr63)5gF>4Un{g*DN7HYUh~3 zm&1)`FQ~5trPa=NLSIuyXLX?mE+m?aUT0kkExjU30(%vn#R|K6UiQj)#hz>E!fUnL zOHFyy-!()_J__Id^)7Q|dP<^@SL(3vi-4MOPO1bfNgd+|kdBRyyJd{iU>_{nO!tH8bo^FUcZ)VwLGVIz9PZDFi}_z z9xR$XUrJWkzuDh2F<uU1i)C0Hwh((L5d z0u0S_{iw=HqZWad2rRIV73bKP={df5>{ z6w6c!>+zeRrsDI>Q2HltH_Wy#&oEfA+qfdOu zo)D3sLut6QT&xlImabmT?IWrQVyDV{QR1i^7a`}?BXO(Ahn$(BOK`^!I|!t}y?arL z8exDya-c7@vhRh+-)e%s`2$XK(Kz4rgy$|uNibg1som%?M1u_71<9e_ zC+`dGhG^FD%YE$5-L+E-;yY^axn#@xVy1{+iKjb_x9?NS)rJdJTUpD@g{1+$%Ih4P zD~frXcD>f}eqRziTB2tASS_iD0JWBaAhoM49Yh-3WC<=bU*&qF%3i&2x!zN!&Y#^g zIwc84>J@a#Zm+q$tM;lf&{v=o6RfR;)~vO?IqT4+Tb17BTY8Ck;vNLsDqgeW3wqWP zrRDK0klo#3mm&2Pj85vyazH6XhYaeCWr0J0)@y2<07bJ0ZBMbLHapagU z=C(T}*`ut1EZ)OBe_&*MVCCTKD+$JFWcD5?iFaFCro$LX^ut-)dG z)rgNTc$T1{KlmX9{U{D{$`7Q&tB}bpeu*q#;XA&Vq<$O@vbH;BYB$G4HcCL8G$137h0e!Hi_sYGANu$j|zKx-&9&PJtd8+Fp z$LmA1NWI)wrU!KNcb5&&7k1uRzol+Gxtd>2N$$nHMEcpbmg+>jliqUHHO;f>q#XoS zkRQL1kYeMoXbFiOQBOCN)vVL~>YQL*ujozrIgRjh>Bn@61H^4^EGxG-$cs9vSu5!~ zXNbYw7R`C*N45BM`)7YuQk2EDa)ThVR-7Z9A61GHk6x)% z;wC?eC;1mq5Is0_y9M_E*?}7exDUR=GFiIpRCQI3*}CkVf9QV#u*}`f4_;ry9TJKZ z`_9dgtp$7+e`3Cu=Ewj3B+tHEtmy#K1cT(lGoQ~L&?V;l3Eng9hr~vf|B=ZbfW6!h z!(fmK`jOUMjCaGJ{XSv~5bDOg+ris(=Pn5!-LsNDyru&e4iH_!`HLushz`B~cAypK z1_`&=J1k>=iqxg|1mz;}5cbk`}G?wI(@ z8QPuE3h_sjBlM_l=OwG6F}v;}3l^^~W^1y7!@Yhs?*({V-nAXP2}~8Tr^(iqN!-zI zC5R!u%tuK4M5{^nyx@fck0~wVBMs(zD__1H)Q^viI6!$1zQv$P@Qa9G#PyHi$KM>4 z&_yFd@ zUGHk{b+Wo0{8#f1UdQPTP}_DqU7RMsXES`42L9=gj*A zUqUj{8&|nWE3e{Wn4?$Uz2dq3=w#AI3_&gjVcwheObDGnNM-vSboJJcEDra6*jx5v z{XfGr+Map;B7lJTO!R|WXYOH{TW!?**MgLd+o<#Z(EkKrnM25FOyktQh(GzU?0f0h zVK&-#^nJmr)2t7UJiqrRF&88quKgoB?jMCc>OmxeKx!LqQlI~EE%{Nh~J* zk9I0o=Egp-xA`NpA9eCyvq74IK}rDIg?CmFS_A9R1SEqwBP8SR`R5jNTXt6v-03-8IOQuY%$<$gr2~-mO$qt!)Sq3k&vE zC=1M(6{FPy`Df;ac+)2*Pu&dXpIu%*WHUY@l&l>%^99Ok;mAo!YIM3!Oy@f z?{aND8(-#snXcIxS67jexc&xP^TOQT?tQU;AG~pcFSF~C^=W})G!KYA;2Ys&`_wbG zGDXXnF?XXePwN&Ds{Q3>hXRjQ2jPRQY~i?E8pw-SG-BJkN#pNda&A>fUj2_ zfBabSdf{)-Z_EBil0RHO`kvcfs-eoJ*PzG~YG$fWFkGb1+gqH`gk$&qBH7BO$hBXn zpKvU5!r2D9_P6B1$kguqFEj@EpAI5fp&%Y)yPv@cwU2w9``*Z!A6f5p=G}jKhwWrv znX)OBFJW$NJu6>YeLC-7%+V47tk(66$m6&g1(S0*WZeO*rJb)9Y;#M}k4LrHZFa^? z3qt1hf{iFh-kV?RYMN<#^f zTUtC-27js$t3F4aPCQzYE;wLUN1uX@N-r&EG34Q5KD+1Bagro-reW7`I{J%?r-POJ zv3^D`)6JCZl7bA)K-;ha*A!13gONFQXspGxb$Z*XtNLK9Yu6EZ8v0dh4~`ux@a73Z zEgo9MsH*3w8k5;xJ%;4HsO5`mL*olM_s_;x&8$8+r)1l=Y`3OAFp^d{_^^P5K%Pdh zAW)v>Lcx+eOr!}Ft?$MHVBM`xtBL_~3%Tc(@uqLE z(&BBjyg5m(Y4-7V{;i`Zc|8W{DQJGcBi5$v15ldmUZ`fnyX&&B3i2F{RErv{&MVH- zOP`x1SlKYTuw%t9SGXZ1zOMB-w+Zjm+Q-rvqv$rSh zyhi$IH?@iT(#>;Q?G(jG@+Qh#PChH&bdNOeXeVFk`dryK{(y)iRZYJ@;h`Ovm9Msx(sPb!fmLh6h8N1b%KGI|6$-hMYy%(S5=;_Ek~XdH z^rYx*2i%-_J5QBrli5AkZCO-)?sX#axe z?K7{kPR+SD=xF0yoMAwli8|-YwMWtIIYfguS9wzWChn>ga=7 z(#W%{(yGDxiW?fddY_z`kn9M|+nc^!u}Zox`OC96q@#nmPZg$>==IM|*=o3z6!*6G zznOD&F%*99>^Di!N{Yb%bFjy-ei7AgWWbI7WowYH#O=O@7e%KWM83Fwn0?SoT6or0 zx-WQN(PV>FuLo{P?VN!gSJW7M<$Arak3t+GF~6&NMuMb!2MDW0w>gN6@@No@k=CD$ zu1;nSkGXN1H}%tB%yEoSnmgncU8U$fu&-Ay6-8vDFrT}$qcFK*571s@ZzpcW zGR((?D3gS>_?hLL`_IQ8YaVs?UXa@C_Ou$E+WppbYkTF!z?oTYcKpftYGuHvnYE3{ zI?kPzDn%$Xuu~+AkU{Or>l++=`SoqQH|ze(_^BRFJ+8u(EPFkYfy7^wdg)e;FNR^o zaHp}#P*$u1Kh?^=tK{lq!`R!Mt|ONbkecG1%?UN$*As!?q&CiYJubg)kc`;|gcJd( z5PJmknoom(L|Bf*W~2Xv+BgNz3WIM_^6d3q9`8@-!n`rF5X<$z*z zgp*iND8lmuq@*Nv=3tRlA^!2RJlQAAjgKN8xf}<|A`3AfzMgSW*s!cW+le?>u*R1o~V9lv)dnO5&!GOf(TFvtIKD+^~H^^E-g-3JGi zh8Kv>Q_OrIFAK}<3R7Ln6i^;1-axf%^fjw z{=Hso3piP%k<-|IB-8%=5QV^f8f1wGm?9Z2$@bA~8@0Y1x z^CcZc{KpBtf4a|$%cal&P*Yx<#0!Kg0W(xMwsO6X3nVe4-$FIHeHpX*0&TfPbhF=!j?pZe2E9k4>t(gjMrg)wqf|G(-D~$u}PUYQF!yH`^ORTS%c>p zk!icF#=a{hVWm>qnu9~5|mUdeO<8(zCdT4gWFhWtMpuEw{*P**jia4&!C08l_ zMqS!VnZUG30aR%;QFU%_+vs7)L%$RAnS5dQen{@ZO*$RT1o&n`wgIaQ{+Y3EQt(xE0f8HA(>eHiryS`e= zNKP!~TBP4!P`wmpIF0!)h`@2ky7v~vWcxS!^-R&N)r$I(ha6Kj@*gYjl2R|2&s-EO$bPv^UQm&R=Cbv6OoMtP z%*%>^?3HZ3cJ0}&-G`akYFzc*C9M#q*Sc6tNIz~ePjgHMy&j!60Wpc8vg}2*88hVE9Zko2 zAtv@mbWc6fZ0VQd#JO``#mlG{oVrEj7B`UB1bYz|e`B*G)6X{hf7o5NdygwZZ1MZ#-x_chyN?Z~0 znqJgHE~S8!xC(>rTgc@UkOIo1OR*E%Y5RTHe$HM@uRw-MT%? zHOezO{AxY4O=jPYrST6B>9GfnyBS$2Z#{tuTxzD5AW@GynhJHs*7F})+Zn#GYu=P? znh=~B&3?nB(O5hGh_Ex9@C>T?|MPv1aP`%=n?}lLB2A!Xsx@N-QsE0v7Tvgi5k6FT33&fwzy0|UdtNK&& zLaV9s>}4#m{#m@9)`u0Hx4+cANRkm}73S)k)s14adPv`Gp%P~+?zz&mMWeimCaOkn zB>FE8O*Pl_mhHToT64?tWH-<~?_QmK)--=|l}vP{sA#Xs`MW_t0DG|tM&7LK3a zPxaS|5LT9oL;nppB3oX|G92CSeRi!j&RK|A$|12TWznBrxKm` zvuqw>0set-fVs8^dEdC4 zD*1)!-rkj#b>m41C~xRl-}7;LmX8uS_vz-9wfvmvojLd;H%3M}=wpL!tdNi-WedMB zh;vL;P)>PuvyEkn+~uLLRGi~Wm)b}Sef~oo0imWM-moTZGcLcGf~{8WxnC}Ormw{H zimHup3T|*8R{163VXTSy`s-gd{zL`452yXU3~%L%blHOZUkj7;*WdhbjP-Q6tVx$E z;yz^Iz0AGU>FF#Iqj7(-YMJ(d5|xSJW|{9AKS^yHmsATwv?F_U1)kV+Qnx%v?T2Ef zbu6rN7$I}lr;6{IwI0Zu86~4mA6Tw@b$)5n(p5ya-Zfs?WKpQ};ikQ8x(+zA6DsBz7Ra27kV_!{VTcnx<`*A(a)+j;Im@Hj2;(xND&I|KEO z1a?a5-%ks8DOIaJ%5r-0RQfcWESN0p9`5RnG)nrcXbza_v)39YZ{ifk)_cF4^$=h| zIO*MLBWqeBs3->d7SBMn#cKj5R=nifDeI~orFu5H?_4-x>-{w?{LcEF-nPF z6c-xWZ2HdRl|yjubu{F^T}aF%ttl~wUTQ6OTy#mCHne-2~ zwhM-bK8O3}pgjfX{W`V$X6vfyt_3cJ3|k8y9-o+*ud0hxi}Ri4n{xG~FR53PI4&H% zJ-TTeGzG;Em`geDLZhwg%-LMumn0)Rc7W)Ea-*^dO-OV0qxoF#5@sTbt9n z{&`5cqE&YF>OlFF0nN+Wb34Qn1TKEUS574cD@ngP+eSKt5djxJQ#s8m@p8!ZOpxc` Y8^k>m Date: Mon, 23 Mar 2026 16:39:50 -0500 Subject: [PATCH 05/13] Fix unifiedlogs schema dataset keys (remove version suffix) The unifiedlogs integration package names its data streams with version suffixes (e.g. unifiedlogs-0.5.0) which breaks the schema lookup. Renamed dataset keys to match expected format. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../etc/integration-schemas.json.gz | Bin 7975251 -> 7975237 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/detection_rules/etc/integration-schemas.json.gz b/detection_rules/etc/integration-schemas.json.gz index 80df6526022a4a774c41747d14e3c70f33ec9e04..667f20c9c76befa566ed0bf48e2c075c2252aa12 100644 GIT binary patch delta 13190 zcmc(_cQ}=A{5am=(c&aRSw$sV_EsUItjgY5$=*HIAs&hl;wdvDgzUXXA|qta)3Nv7 z^Lq}}yL!Jrzw7h6uJ3hy|8T$dxL@~t?xSsJ?060451{rvaiT5D9e{wN5O53vjza(r z1mHpdhJyzICm`S?1e}6^(-3e50`MV#00IyYa25gxA>bSY5J3Pj1e}Ke5(prL05S-; z009>vfE)rSAb=7As33qE0xm(oWeA{w09pvR0s&Vc;2H$bLBMqgpoahk2w;Q&CJ11L z02T;fg#b1PxB&s|5WoQeoDjeT0o)M40|C4czy|^R5Fh{nf)F4C0m2X<0s%K6;1&ej zh5%6r5Q6}52)F|Q5)dE>0a6ek4FPu{;2s3XK!7X+$U%TS1SmkjeF%5}0S_TS5dxGT zKp6s5AV3uY)F40|0yH2%69Tj#KpO&dAV3!a9zlQ}1n5J60R$LAfDr^dh5%y-cme?? z5MT-cW)NTw0TvKo2?16RU=0B_5MT=db`W3>0S*xGG#3Dw9wB>*gU8x4(`2gm69Lcg zHhuq;Yg|c&@(K@b13eNUWE*FB+b%5buJ;C2B=k&GQ0Q%kl{D$zO(1;4Jdoe%@%i12 z$7e47&!CadxDo&VLw*K%F?-n(v;wl+O)rtx0a<)_SyDmqoAvg}3BlfR=QobJx6*I;SL$m?2AXLc+&pDb`T@sou2~LR%clQd)k;57M2=O*G{rnbal~ zCoPXf97!~<_)xI+^r=qh{zWi(w48K5Gc9zT+Na!J{&f2>I9Cru;H6J zl5n4B3b&tog99t*gBM^{eefhKk7)o+-u5E9MEJ5kNQz~g$Fk^ zBl?jX&eQ|1z!iGnNxUM{q}8U4TfaDX$myk+&_$1T*ck3=q&T_!3dsTD75pkfvDM_R$0=JGkLg$it9Z42sdiL@myxg~Z zsc(Kx)DwPZ0J7kbWVx{FZy$%F3_!LY1kvvV9*j1?^l8BWB*5Kvty{bJo6zYvyl4Ot zZ^O|48bk#*48E~E(@>R_!NlYwrLv~?s?(;T zHQ=_;Hrw6yvs^pf?F%0_P(76qNAoQ3M~*}V9DCZ!a?2H$%?7L(oqhbpAoJ{-;nPSx zg6qfY-Pj%9y-bTg=6U3@@LA8tN6yr!mWhw1a@^AH_Ed=K#^H9C(INT?KJ|2eGAiUb zdCdLhrL!k+{sNl=C-kdtq&1cuXLmbu>3AL6_SYGK?D@trQJ+^dSjch6u)K9Z$YUw7 z_8Ea3VrDKZ-gw?dXndwvU4D)D#W3@qEc=G&WQF$Yls1EGc9@}GIhhymH zSVixhC0d7dDOGBrL2Y}+YCL$(2&93VjX+$ym#0U`Q2hb0pAkq0@P4kbKC=${8-dqO z@B;o;A1H=Ne(B=j4&Ubc%mY_oY(pP|c))?F6*<_V!BuisEIFEzG#Z1k zcGvq(h5@badOH<2EYDCJul*gwz11Uj>3pIV(P<)ey#1)%O-gyZzkn4C*C(+Yir?IQb|Z44zLtiEa*Ye2 zovi=u_)G~sz@XHr(YE(I=Q=a1B;;dtoyNB~)AIdKJJYmqYC*|s3<6`Vv?@=ig>&lzW&NJ^(?Z|_-d<=|KZ3@q+_pW)H z$a=M)y+yri-j7uiNo}SFCaUc@EmBWYne4}GnCvq=&BEu`V)<-3D7tGr#&jhIjbjs- zYP*eI`bPim6f)^pvKzxYM}l`@SEM)`rld8NEpsp{Xr@N5rzr?MR;0agTP~~BW?ERA z`}&rzu7VqjVX!X9{!&YDCf9qc&3JpQ)z@a#>1inwM{1#^Lb2Iuc!$L*+hBdW#j4}C zo-#GH9Zn(7!S}{(i=5P-eG)(8C)?cbJIRvOvlV8G!bidlQsZ60tR}LoflzpK0*gQz z3$fisVSokc1KcTYdKTTa9sk$iCC**NB~jMCMU2my)K@o`LdaJH^j?RLpdCid*P1hm z4ErtGy06ZM%5-++36xv8_ya74f2Adin{aVPetDD4#4@Qpx{w! zc*PXFc1EC-ytA#>Ay-XC!w6O|!>k9C8OR8fm3J`k2EeRlpeUAc5_fA)X_^_1F#~B~ zc{9vf$1(-CzA8Hhhc=s?sI0z`FY>` zHF`>67G*A!J5zHtmD2K1uk7AbHf7q#DI2J;N(0S0e=4!9bqJ)2(z@uHDNssgf1~(~ zW+RIsX|``q&CDbF#nGM`xn<+#c}->N!cU)r<9E;1Iz4ab`eZP~ZuPd{9?Wh9a>4vo zm^0Sd+-lPcX0rl$urxVtGcyb79IR^zo`(gkKt?Q+5N`>r8J(^?53^W-d`eg!o19kQ zx`Z>YD}lET_eHPyMw()EJJPzm_2nh`o@Wtd-ntVij;A`rOli0Y!=KB1+M}Vd?+~L{ zZy*{dXbzBVB5-sLcs?R#O~V%$A?f;B(p40`Yz>ORuGSy|SW3Sdgvp`O3cLq@w*v8S zcT!%Abis>OAO)6Y#x|#c{o6E~e(rFcHORoXTnCOschS;01(!~Ct(a_a?QRXNPNR|- zg9E0_>5gIjGt8SL2N;9|xWMFzXsfYR8(1#m)jw)K#>)3+`-1Q+Q?QD3_9=r)x*kS5{x|{86p#lfmfiig7q4SVxS^n?ZRZJ+0e`vh* zSSHlG2O}KlfGJ;vJtlW2h0uA#@3d9uJQsY+9+bewKZ#pQ^4*ZNCw{o zG55BHr{E=Aq(R~a0ww@KsWW55Ha>hc5ksuA#QSg{#sankK^nHbo3d8?l+01%=*jnJ z(&9E>-OJgpRO^`ZN!U-ng&J=gUe=C+b~vNgb_QJli_I{25d;}vHb?L}PV)>i3T|=) zAK<(#9aV=H9YGeX;0msAcK(jvKZ?laQD)MiB~(xO`!r{vf{Pj<`;4l7*#?{C!i9`I z519Slc`c0L*XJ{uQ_hM|xJr_uxx5iqQMQ42<8Kno>OE*g3eL9VNR6C$qE_~~91M`T zT|PL@>Pc%8wbp}Ve)xDGsmn>-^hR{kHJND1YEhGcB;#qWdCJbgbMoamiw|BRH2{<& z+uGgjEz1?B#VyOeJ{1WGdu56!4__j=(D9UZ#fQcCvUjQAfql0er@tr zS#<*wEk5mW`=whWt=dl7s@M9nCdrb#H{fQHGi*XSnQVIHzHEc%brNU82E9KTL`F+& zzDTXNPSqg^2$-~uuyy5TomJt5P1RabH$JBox89xt@7?9dU*>o+F#g5q)OdnaHB~*) zhRzD(TVYPh4;@*F`dP^+W#q_=0+OgpRMhS&nyGUk zWKdJH)TyKLp-siCSQ12*2pP4iSlRL4g2R#rVJ?`K`8G_ zFQKnD1Y5QXp%zDbz7mX?_uuI1PK~j=PI1b+s&thP*V?215>FlePaxn> z1BJR_K8ftL%ItkH*fsd38+ZaxLzEe2T!D4mFgF0Nbh~jA9+=P#bBtkxWG69<5ffCS z_a`{q4ZMQCz~zjuUEQ^i`_*|?0Bb^mw146Jaj^ui%-!NU`3CS8(7f)vee{rL4{RuP z@>VZ&lr&Q*`6i1NG$#x%kdNH6u}tXs?p?}Lh?b$ag3h1WL_O9V%<1tuQ6sW0tIlnc zB3qoqm&9+Tt}brdTQqjcu-0e*XOn+6R;|5--?kUoAj_3GIJzYY25WM6N$;*Ze5!S6 z)Yg&-72=WhT{l&8W=W}u-Kcae+|i895q3JUd*5z$d_!|axTG-Z8HGA@Pr|q|%z1TCu z0p8UDe9lSe$3B|9AXqYcWKdfL89_CZwP-1*GJsBEM9p_hEy%p2GP9EqYojaMe{qMZ zSdO%Y=<77KBj^d=dPtfWb6)K$4uX#6Si-_YAyw>biY9T~6HI ztJGT9-2-#g!YJSX!XGHFss_NB&p_@_56or2MOHvMiwf5D07>ATXCVH`B3l6lC1+wp z3w+TNq{Q95)-)9g>w1DB@SX?e_?8Ll;DM<w#Jibt=W?_&L z)z4y){g4Y(k%`K@Z8~vnE9b_lgj569Vx3~_6`k)n-NO4@zqeV0(g zTyU-FQhz3yR{5r!6n9UCAJV9e_EcBz{epxuw=3n@h|l1P{sq1Y9{t{nbA-t7$h{+M zM=LPckqiwc(uNxAObw#9Ee}S(8g5T>`jx<7C8Et2Kj=dxx4Uns&I->6QtZ`~3tww!O-GyZgH+}l>iqTO z($sk;`#jC6xOKxbWbRS2*;TZ=Pch$Z2wM7%(CXxTRwUZe_)O1`q@A>$3;$-kxLSNo zmy=*O_j-7PP4Kyj+Zkt>a86hL0|YQ63cO$Cck3i@mF%^S{4*?av#W*67GG1et0ngj z{x1bAatyxY1rlE$625R~2D4pv|E-9}5oZM17QWxcBPUZ`P#VSDxSoT=co*I5JJCn; zVYwHeD=xLu(+VE=(MwRC;|xOQ=L9}s@@e5n_3<+ZHo=O8BmYtKBRK&=g5QhbZ&)7^ z)Kr#cu(A*6iWlgOw?n3J0hWFay5PEuppS~cC|}SO5MEnw6FCEa_rb#eDA{Z)T7DZ^Htf*W zJ=42`9oj&x$AKiM;YA(wR*ST18L^wV3b!7To;@#yg};FF_=^)rf;5=LAM`xh1!wz% z?iBrEp5#P?_r%x;E5&fINJY|(CoeC?eZ~OzmLEuhdmw?Syg*X(pE^32xz>Hnln68R zJ{?;9Fqi)=+OOEG<}_6wU!1r`^X9n@%`+^b(@w^9$4^18oh9OAOCX#XkEJka7{C?JcAN-{(ywo7vrJ7-sYXxIx#i!GYjX{VhW8E-G{?j5N95~AER=g(3-6*WlDr8*!i z$J(+c?5~%cTgT$hI6x!7zbWY8tU%fmc&fRPkt4magnhaG4+Iy>@_}y!V&+qJU(o^_yhDevn9{; zCb7rWzhvM@Zu|@JNb|#RUq(pEUZD#j`tkzvZ5?~6`5z_1zwKTgq;)O34{LYe?MF7x z50bl}X!!80g29~-EOG(Pc!Rkik&`RhoBhN6B|boIbzyby{1cvrPXRLepR_M1el|DC z&+hA)ow2tUD2^QX`hz?Si1Bz(nZsN%-4A+<{Mnl`|1J);R6=Bm_Lv!y(wNGgUEj#S z@fVU|g5~PbWfAqfm=Uw55eSS-s&eu@Wf3u$_&y`vRiLC(qm<8MTbyLiWJ$w_@FN^T zUAwO)c%^LyHFYg@DjK=xu!~UJ4Gl*n?+ef6sy1+>M(*cmwah4$GW9;bZ}qT5E0jxc zxt587Xg{%lL9o70>3y8`)nOAAUTyt=FGC=iJ#R|+Q%dcA6(TX7$+E1?wr=gdhpFN` zlX>>(&V3rg=FDS7vk6_>%Gm+5+-8~Qr?`dZde+o-x~9@NNxmVSdBakd3^dcf>1~^P zE0`i!$NS@=tEZ`CpOR!Ro|JpnT`-QCD=n#2p3gXMcK_@YcbXaLG| zZ-(N9;aj!v@YwO@fOV!d%_B6Uue6oreLXx$8hG6cU2SEsa!RakOfzqIa zCIRPWwRP+Eu}Ik+u0E>FFA5gz^cHf_!3s?*{+q>k#3g2SlY0a~9oF2DLSL0O)sB$M zDhD_yLKGj$o#xH*6p5%8gOUeAbH5C2PRwRIlQE=lIz2Z=+6~xemgUp7PdDhVbUB8a zZ~8i~WUIx;oaUeP0|#m{9+bDZI8Zjbr#mGV5+zy%``cLzctxIS_V5dEimTtJFgG3U zp6{q6k%%03WS#@f!y#ndR>_16ZZLIEhV3BQYF=?*P`39=phU;CxvUGbgn4In&t!gL z6rP%`_P|BtyRvP^V581X;??e^*5+|f{D2RNTKOU$w7>xwb@Gl3V|7tXgHqNUU}M)n zDJhn$Rh3Y)kQ!UntS{bp>yI*bXj@2cTj}=6AO6~$)m%GrnKEkK7)B0JIL&Q~Kj}5u zlH*UFdoi`#fGTLvmfD;C7&X{e>cW*jL7AH_xQ*nQ?G@&nOX7Ttn&ToVo(3&f(w;d* z*DrNwT8W?s6(eto^5d1M}X9HsjjLXfE?{wSNBsN-KdO`%kma`v~)C%_R;Q6M0znj`$u8GO)Z( zdxUj~RPiZn9D;d%a}EIs4;s@?v(A$Rkwb49aFr^X85TcIE+ z38IJ@;|K98r%m4-@$*rzWGLp*SS=Kj7q&rSqLlN!N$gdyQ@oqiEFrfB4u}peOE%&O ziENZ?nwDi-?;;&dGd3OV2V?tm-yn+0sp%-6gK_d*y3=X3R<8cX`H;o5e5CiU#@DyA zKWMne%#qvpFXWzN$Sa1+ino(JA6{6}sq?su@De1$B1)GLSmwzO=P(YWCC~p+`@@mI z%1b>Ten|>axEd#YC*&o=1x5B`{U3}|{h=7PPno24JnJ{oN#7Omt=Lm?umTKn!sIZB z4_m?@a3&cQsbHr{_#m2{R~n{z2U3WC*|@68pJl5*S@+F~qbR&};N_g5El*tWg@L9C z^E>c++Pe~={!Eluor*uttwV~Hg??NO){VqG5$;EVu6Ohcg5oK7Snt*cz8?O~k;9>H z7J3Qz61~KI|9FZ&&cI)u*I!EU72aS*?q*kz^_9_Aho|1bi?ZxPv=rPL1~S1n z-+)&%y%;Z~VFIG1|BVD$_m?nXBmLbaOeXOZn$O}Xr1*lY|FcV#{T$auorB>UZ$T0g z0$XN`7Xs{a_OBxlGkb1DVjhea!azV%@4w??GrB@w+th&VLcw7*e-z=Mz<29guS#Ny zL`#qNKb(3d_rE&)zpew_sK#Avy-DEGw_rJNgMPgByYxS!E&hLDv_-DMf#H|{mf>JI zPT1>ZZ`eHoGnwEp&{cLam_XUb?$zP+417QQYs)&=v9P-s%Rkdof3o85O^daE8=Y<2 zYqdZp)3^Bmj)?(D&wtO$p)?l2EDsu&z#ppxvr8>TgEvCoVSXA7fk86yD`pbC{#dnd z_Wi$Yls}@rpOx$j%%eTj`D^FF?nCcqo!xRGO)&0AVN6qwvuG^9gN;B+ax@=n9P@L9 zVpB+}3Wf=zL2me640uuZr8c`OW=RgieUi$nRo()vU~di;)iGNYtM!spS1E3!({|Un`4LugfLWD7MM^HcWC?GezS|WLtHOQm&PJsP;8L?<2;u z7amZlt3*P@!XB$rp>!E8%=+6X>R^RxC3N|dd?qT!Ew`e8jE!UI$mem0c{4R6dc4b; z4>fWTKNi01Lu+%c>{_r^qu}e4qkfn1@P@|R>lmMck8h}dy@Sl&6)6Cp7D^^;j-CH} z7P%$wEC3iVJ4AnKcH8!)B}Hk4dRE2M67Zyiuc>IToA%ds>Mkw?$dISfmQGO-?1w<8 zy)IBWQ@r%!i|+RoP37migyfD9`_Waedf?%8ZK2}m3Rd-G#`9*c$|UAS+W8sf)YXse zc0|?Yb#g{m5g(K?ZfrEz%YvF-7ZAc&7- zZH$*^e|h@4WY39fjsAsj-e&8-{<`xD<7}!>=|eFO8F9{y^u?6rz>qI48@zOQD7WtV z&62j*{hrASUQnEVkFjPVow9z}?mEHgIK1)7ElRR-{iOY9i>xoUoAF76XD3F z<+SNB-&B_YQ}(^`z+!-wak=~LtfeB1c)y{rli1*Wj;}#N>3r?}{=~|nxTLMV;^Q@6 zQRGU$-XyXC#xs83cwH z7!hO?-kKaP@`0;0?6FMFH8rA-FFM7LCQI9D!6sPLB=!#ph6MLJNACQajkO;v=Gv5< z_=drRZ<*Yu+y`63@1@LlHE>T$Xz69}1Q3TTf8{_;TFe;^k5>=NosP%-cFfp4=cd{v z=2s*W)%iC?4)J>=l7Gpjb8d>{9_syv2>JM@lRtzlUB>Qv?QrFL%tvN=`>_i&AAgVc zQ?*R~w7yF2-x0CWEe7Tme1t4s{PC@CRzkmq>~I9jQ&tPU9SqOJ>8;q`9Zz7A?Ke(4oC#akUJl1ssHN357KI{ zb6D=brzfw;w89D%+Ad+eN86ywN~rrvI$fN?s*>xLQoJ_#s}YYb)Q(CF8A&4v;tS`t z!vhCyk|OOQn~98cRF6i9fnRy{qrkyL-91K!g}q&7m?zN zM!oHqE$a7MXBMrvnEf+7h~(70Te5X#??1a!uA3f^>r&{b<7t!n zk|C6LOd<2v+Q|nb^BZ|2Tp~rgT_#E+tXIuupM{nytdFA9h_o~I#3>(^$BeFD!o0(5 z%^-yZHl$~mwW8U*MlWYAADvAr*7l5J&v}(8=VCFb*~;k|g4UZ}5aVGjQwh75b;Y7o zBi}(aEs5Us{g-&b0q3o$m_44@iDeW2z-v|nwX`oDBVrj^CeZ5qPq|ZaX8Q3ki&FR(JQ@E}MgsMz#=gvVZ_Oxr|q z>P}ouJ}w9WcLbB^sM^mkp z_);PizcLtM$U@OkXP42~>~E@*skTb|jFBN z_)%wQ%I-v`Hw{|to-Ah&xT^5fq54Mg_8qF%0$jdpvg#cHw>CL6cO=Jq%8jdE*pxb! zsFkz>O^i-LFT##}v|79po)=MRgl1F~^z+iR-yKki7e@y&!IQ(zZ+Vy_K87wvFO@<~ zsHLzP%E7&+Z@ujCy1Tnf?Yz~<1%IX}U%xrSY^kt&ecWnS5SZV?dv==}$D}sMg*s~+ zLcN%26rHN4VA6iGO`1)o?s){U`pORN=7jQA_plIy&#N_$w3vkZNaw*Vz2ZRnee{hB zA0BLV(05G{+xhT|N5;x3Bqlv*rzcfQ?8m}iY`!#E;}j%&m>fHGvQ~j2YZ7Vu=_%aR zXO6c@-)TMmNSfC14=In4UYv$3(*Dx=Kw6gayO}&|PWx$*-~3<=)uy26UyiYi_S37Y zx2>KVIs{ZB_f@V8>nl(tD6`sJx~=)jYZgH;m@jy}*p;52@|mXp=tllKBNxoiW&|FV z-JYW6B^Nt{V_-Y<3qK>@B7^kk3Z303M37)JRl?-cf{0n6xVj;Qr{@vq*HL4UUBc9R z!nGuFhM*eN69Ee)XI*X=GOy+vtk)j+3kU|TUJKNHhs^BowT)1udmcJYL9oI z-91D13aQJb$~C{@WtJYWvy)@05K-ynvVX5oA-{a}jo`iP(I@$d&r{X+*SF+y<{h$y ztpWeksOD=u*CQ&oBI>K&I$m&H{${luSRhF^`9R@u&Wv@Su$Rl4FbxU1iyl#qHcncq zmb!9MBw*Gk_eosw!nDID5^?6X$)u#bo*j4HokV1oeYWKiE6UT_0A~JXY|S&d^5S(v zarv{}w?(@)GGl91}ZUbY)`?kGxF9@?s)+4)Qz@%V{jU$6T} z$ML{&6emTAtF?TQN+XHK0{?P`%VM`)7RBzxuL;4H{<8b3Wo4?Pd z@?_J5#6{mm%~!~NVJ&1|jYF|)c;3xlULuLMop9=eohSco$`}m!^r3`GjwkL&ApqW_ zx>_2fC6ykp{EcxkWJTKXs!-kWB{#uKh`P8xjgn}09={s@94UAS8Stk?X%N-OQH-Zo zcq6U9hrvd5y-%GnLw(?EDbvoGc&_0Et#)@Bu+%BAd1rovXMTjd6d8;X=@xj~IF9bx zS?#TFupAHL8a5@=s?bd@$&S`veC0K0dV`!&mSaGxKoU+7kM9}K;*cXjtFnqlcdev; z8!`^?ULFD2?|zoKORe0nJGOM&d!kcofn4rdrdr0vcwNOX6^u9Bl}eEInMzQ}37lV@ znyD1!@~|^WUo!I_MsAPX2p8-URI!oa$uXLY?^3K@%@mN_KdCsGHNn5ejbeK4Oc3rp z*7H?zxk-c-3B^4U>~^tyD>#zri^S9RTLleNN>ZKeVC?^}Wa`Q^85Nbr7x@!|(|M#H zQE7Pw;^12*Us{pVtf{V=U|{0)H3yW}>{Ya{wqQB|qo}TofR9E^H@GFW;ptFjm`MrQ zR9P3Oam{_`meLPf`O2Y<{Ko85-)79aCy;h(+xY}tRdQK+8P_P|iPbIS9`eYMBm4Wu OkIV z@A18E_4HKF^ZC8Luh;MQ`-As!9Otpl<24f&gI%5P<+u2oQq+aR`ur07(dtf&gg< zkb!_J5FiTyS0O+S00eTRi4*>=cUfIS2_K!76zI6;6j1h_zeD+IVffI9@-F9bl&yQqOOcP%u9eqLcEVj=4$8>u|U z;<4Q$Qutrwqs0%YYElGNk4Ra9wine+(?5lro}Q3v30(YmGl6-AK-5FlWmPXCBRg8o zr@=(3+n4+ct}u@BkguBK!qQ?j=YhbodJ~Fg-$b7aBXt_JkU&Y1if8peCxP-GSdhu2 zg-@D-tT2x$NPy>+%EC(spEU(3u{{3Ie*}0AsjhR%u&OCY1v8q06nJyXiIHNkj48;5 zlM|Dria*gB5aH$Y|K3d34VCDK+9TVj1 z+S?=U^)5_-RC+y4IP;FSvl*kS?2wAk=Mz{cu3%B3X#Ms&c{$nKY)6uoC}yU=$h$l8 zvRHcm`fbDJc~0vr)4PfT`wlJODHb^eDLxiklXzHBEoMUn6)i&a+*Y_oy68EVDN*0a zE8p=-(X>pF;gCN8oNETs!Z~KhWOg*`*JYgAUSMk4iX-(bMBK;lKN=os12VpN1}0?gCr&B6(=d3m>-;G)?RptAM9J4W`t;Z3^;4K#DKinlY znp*a4nrjbhx_gedj_o6z3h)BQY*qSc58=KO$wd{k~gh?D&(+@lYq&z>as1D4Ck>K~ivMS0_!9yucoJU3pC?Q=IDiSqV8 zeNGOG7T*P<4}UUGQv2NRUDUC{4!q=;@@VaIFV5lQBx?GQmy@y6G-x=r&;R+PfD0-L z%RFYLdtcSOXZDRpRt@1^o@M>UgBHyRCaS2K*L+M0FIj-}k@r9%fU1$NvV;+SZULTy zmG2>o@-%3Y`WqZ-0iMP3gm~k(MLu%eMyxp=)_e^9W&u)}U8Aq7 zX3sgEaWwrto~CM(tRpeqvASwL2V%OUV|AO4O}2z0KKw|i z;+(w)cT9KBIMdr}8PU@3hM(N_7Chah{&Ak$D$UqRvj~%)>k*J;J78ful$W1o%dtUX*&e1YSI)a6+Cqu4e2#HX#s^W^KYLcN~T8dA(v2JP+eXO3%bR% zY7vSvO-kwZmb6z{r9!_xqTkGlUN)t!xZi6{+LF?_zK}#UJ-e~!q-}o3dGxj0z^qXE z$gFXB#JiE%$v64lg$0|I9t0JNoyp^tl20jaJ)>2hep5uQXPUnz@U@Z_#SMqIX0sV~ zzcOGV5|UEVchl3qFuUl?IKrKL{Il(Cy$|zS^cRJ|{VaD-Vv^ET3pb{Cc4d-7XvY2H z1)&Bsrg3NLSWD|dile4 z;$(ZC(wfBFcA#5e95>1gl@d5xP_tTZ-)4@MG>o^2=E^q}(IqD3E_dlQPrrm&9#)bK z=*BF@`G;JNd9;zZ;kM^4Y4|xHS=? z$rTqqF)MU!>Oi(^ZcbaaY}~EDOY7`WtKyDSw80&<{AE1HpBA*4lYSjpaaiU~`!I}J z^5NgROodp2RRsJ4|1XubN5mM7rL9cuN&>>%HV=zI*>lUJ3dRbPL$F$@8B{HUJ3uAX{EyVO1D5j1(L+?Mt4^t?oB-M6`i&tFU zz3cA5H-FcSuk59MGq*Waeo$ZS{8&?d5UMprqRL(0d*T%Bt*~`PI{S0nhU9QS(_dzA zmjkGT`@VLP7FKltnc;p1kcUvRxWr3QkCmGo{^S5E1Je|6Hog|j=KxCFp6vWa={Cy+^6+=)RXXmFXYv{(t5ICXZF{g z)w!UaY*bR#O-WY9@Q{YOiE%ABq@ip=f0-NHFa?X#19yPOnF=lNs2$P-()LJGEEE}g zqW@XLW5^o9e9qt%*vK9v#Y2|R#~2Q^10}F)NRF%fctH!h!rWvF@&Y!+25vYWJI9(4s(@PqQasz|c#z^d+`0M?cUz{qJ=j{G9P!_;b5_Q1yOAPbz}hLn=W9mK;i z$9liSHqyyClKKDKaGprR!MXQAT40k{Ik%w(HU>dK_|tumnsCX&E%1Oh<)s>&b01W~ z+yAV*6#sJ=pLfiC;&e)9`f+IdQMZy0ur6WU$b&h*vM`CR4gxCz`{4wyva#;=ee|fm3z>oQ zrpmGs73dIb*`F+aVcCxeM=9oNa65X(~3}%K~bdHHC8QT}}*x#p$@3}0Ap4JHBJV-Bj zVn~zU*2d&X%(g_*#(Y_mv@kso(}S9@Ko7j%I+@PEi&=fvJCeMl@r}n$^nu-6?-E{D z!|Q_P$CC{iTlV%`BRP?d+q?Ah1^S&kIfWT3D;K0fHMD~%n#Y#-VuQn5+os;r6HSLH z5k*ss^tuY^T$c#3w48GDxt6&j4&E9aylmMk3m#>B>T|x+Kbg5uXZ=!C#_R@)Ld5fQ zZBJX5X*74YP#pV*Qc7bn`vIfVv;I@|ZTs5}l-8R!Fj-l{6|+WZB45@8XO`4Ie&yfA zeKh`hJPx*YITQVsG2d|x_*#C_y>sz1y3Jt?47NxwQ|K@7;w$qMIXlqf?!(+!H65;9 zG&pERPxDD`?o!%}@>*$VWG$4K_?D;QX{zBJ3bE06#ASHQ(USJeN``)udZd3VJ?22`9woRb zVP93{wL3tp2o-chk>2<_)xEAz^%=W)^xk@8i&sf^ zbh>p34@^5C*z6xM9zk*7R`pVX#Jq`dRDY-vcz%a*iD`Cy$GMcXn+=1R_UcDT#VTLH z*KN7da$5Ohr@!(33!YBq;66CXHF|G@ot|OkT#rGXRbSSe!nje{H?4&2`L7f7bQ@{1$gmc1{Ctd7K;L@ffG|%Lwx@TsC0brUpm*(@!~h*I9LA(DFnx+ zd_{~%Uj7bZVlT@a>-0?WAAd-6xIlM&qksBz{Rt<(!Lvet!@?j1RirO?8m}MR>gPfz zCfME=*~cX|qie!oBVX_WEbWWzBHgjsLtkJSL=($X9101$L$kg47*83Z;SgVt16OpV zFdJ(^iRx!rF8sK{unAN?u>V5)2e>6JF8q)UocW@wJx+|)T9Nd;!<9xdDj5@uwts%9 zr6$VUk8yo?;<1q9^G73jDX7=3V5d1P)9HgjG26c8OwoncQwg&Lwzd@QmUGb@FX`i5 z$tUItf~-_!=RR4Yc*MH?@_^?^CpFyq^f=Z=M#va9_)wsL_WIxjuHk&krS}<>L1Xwk zTg&bN9ozHgRu#Jn2xYs>;&;Ym0}=~nqEwNoOIF6a(Zj2=-7Rf z@t&hcPSZ#9l98)_QkGYhRytaU&!eD=o=hozbDxa{oR`!;eM>kSHM2!VNfz`3CVdF9 z;7Ml6t;S->3$VjOkOVe*2of=SYX;q`;-G!%BOt}#Q?P%7p(9$&+{;#N!GkWsa%d%= z-n9i*^+Rq!p8J7k@fbUTOO4^ghoCGz={@N0_pL$m7=@2S^{CxN1!Zj^yPFO zcoDII9Ug%k_-UOPc7T>2yyOQ`5sD_67qZFNQXzLGkC2C{FOR?zsNs~3(<83~;>z=O z)Ll$QH&{N~Bsr#rjsI;@Q(hs+WnIzvD2ml1_Q`7FAhQY&(8W zPxoE1tTJgD*vO}Od8RYnV54SvHvXV7c?sVCyfI zA83r9LJq$^v`%w2SKDCbe6%IFQO1#$}Hh*WeoD(f>0`-1UTD3Hp4GD|1 z9t%ys>o@k=dh%j(nAy;4?zXh4F-`rqI{Q1EjDu_;eG~6Y_{x1&P^^8XXu0_UcTt0H*4-msF`f_w0 zyGhC`QN4NuOH@B_G@_%%|A@eEa+t~=c|o#Fz7?>0)rUzcG`{}U1ltdm|GP1_v4`|# z&Wgh()xq{lPI;-v`Clh2OGfR#Ua-I5-OFl2UPL(X$o7LEpKJAJ95wv3Vool_Mn9?h z+MNWmBr=zXf}^xm3@`LtJ`zf48A@r0Suz?JwC8S9x^aZ4=1R^X|2#N8&UtI{_ z3;=!bJsB7lZ5_rh5RtN~f;?F>8+nZPaN16Y&!Tr&o#xXfc-@W{B_uo;+ zSef)-{_FMQ*lfx?l8?cx4yOST@ ze2>3=n0l7|$!~Dqk(|s9KKBfKgi{PBKLa12K3{z_P}B9L@t=t!Df40{eK_}RTUMsa zUYh8gE>r$jZOdk^s@L!wt?+VJf*G`x=f5Qt(JYkv?~fb|Erev*S-Cm8yi?1s((?4K zJ1rwnHfz}Wxw3@0DJgm{_BKb?{Bqav6z(0V(!klg6}6Bz;qhu1p1aoWq-2C2X=&m-*q#U31_(k&Cg7%3@*v(o656`!=oX{R@T_e;U-oVJJf1t zQJg=}w=nPagB4mqhAw4Gb~bYeo}_(p;xFLtvD^o}(l%!=HMkI(heatM&t(l(G?$Ya ztMz!Pn(>@#egmlwsd?5(jZfJxr8TGW|3MI!3Sy;BOem4iSJ#!#vtb{%*~S0R`ql1# zB>A^*lOMSqrfRAlrD}F9;*5qlmN4ReNi_BF{U2awquy7jYIfd2NdL83?%c2q}|8$=3- zuhenUksoO5Q7}x}rgyZ5ge?hhzT(NNGhMn&EcU9)usoQ@E`#uOjEiC4uH}5TEqgaY z>y~L%+GaTxQ#ud1b=8g^&1uN>=||k?;*ncYq}{*RfKQK#bKUzGYoO3M zMPF%==_z8hqRh4*Z5z@%kt#I%qBy0kA=R9!Zg=R|@!_IU7ZiSjl}Jo0gGIU*m+y&` z^t!UNE5V;fDmDZM(gH&6D|Fd4^_woatgdTI5=Ur6OZ-((YFBn=WPogT&5VEBT0*gS zS59(Uo2%m!UhMkE^7*^HsCR}lm1V)x)v!d@U_fVyLS1RG9aTR%^{IDU!=8h<4v1B97&Yo>yqCRQXOem!?l38f3Z+>+^ zt?d|BX|~-7l@afX#!J@LfgbZyGt)WwCXLuq-WVt zpUJXMXE*RP9wvo@3QERyHecSX%Puan-0ZRRu&EtzoVMtjHd%g7(za93B;^<^v9ZS_ zupqD}Mz67Pb!}_XesD76{K1mWEzH_*Wwh>UaKBdEUbverBaOQ{O+oesP0-MqxUh#- zO~oy1%6WEq_25)GRgu?DS0|q|l0`6o7j#D4 z)Z*7~aAElu@wO)>>-5}N=qo`dSu*p@x`kOgE%&n0fv%yfZ*H!|>1F!*FN1mMjYU7W zJVJCHc#ayBP5g;i_(sfYTv3c?#h`T~C#rLk^4QqJxO)LIC2<#wPGxJM%-Vh@Op`xnJ|0gji`%y=tpd#m zDT@VGeTlqPVTuK-fR`^;Y#mtsuWG3O|7Q&`a42%XQa;GSF2uRRdkgHVd}KLOKZL`H zG1zY&F(8Bfe=p(TqMn~D0kyHE6-xTCdjE8jf=DT@f=HOt`AOeD?<&5xl7&*^mMn~e zv=XfF3iMH4mGS4O6}|qwIqN$df7_#mu-g{=PjlwEeED^o`hLZDZ)l4y2ygl&FYI1~ zdE-F}ssefk-TvSLdgRIot-Su@LP5GTHvzm3pG*J=4C*#n#^I-i{5}nT5Mf2kw(?k8 zOR+yUOeC2Ow>Jyd2SN{ZNdDNFu=`Yp+ptW3Yaxsik6bC$ww7WYZZqGn(C>MqEy4%! z$VXk01Y|4v`yVMB27}ac3g4q*LzL(rPW;#XTJcBJ!_5A*D-vzo7GJzW}*m5vU(;)i8Uid=rso= zxY7;7T1JL_9K=0u=2@bJy!F>?j+($!TX>r+(Cs#ZuAsk! z{p{jh?ac%97U%AZI!aB8(X2M3iqc6!8$+VL{f#=)&p8^K+5KEWb%Bxz-W@a5jTRr64Qtq_+FLWZU36HnuXSw;KO#5Y;IQ|lrlxRzV}{Uf?@s4?TTg{f zOIr*5@iSa`c_6BAIyY0GB_#)qg4R%uJK?$qoueXiwGvMFv&<-B_W9B}x!O6Kvu zCuN+T_(FS9S0vtDXB8zXfzEMw!6}wGw>lBnT#Ulx@On5fWYDzbS4i?|za`EWv6UUU=Ro3_Sw6KmJ1P%&NYe&_!+W4oJdR?du85_};d{M70nU^NKf8d@H z!gJ*{bNZEhL%Qvx6b8iuE<=Vl5eB4Lg~%@^l0gbJp#p{+|6y57;>IV>8HrT}57LV7 z>?VB${OS8f%fQoN(HPsf zxb9BN+4E;s8nz8&FoFR!!{^0stG9}^d8Jgnk9ihP5+cR*obo!+8@!IAmJbS~brRf1 zj(T^(CzC-+ytdAx-aUsTK0@v#;&ot|(_--{c-w0Kn4JB^gQOaf>63zA9sWJKeU-R6#$nYHcxHlr^^|}l zp>K^%^1IK~MBRktk)*0@9p=o??(5cX1UhIc3a%B4GRKCtK6#nU(jJz;|I_m(eWriS zy+amWO$JW_$N~dlmaudRcpAtrW-uhsI$U_%-OM^II5-8QVnod?DIMnYM~e3(T1Py* zdSJ;E@C*a$UxSC!soT;Gk^0d~sEkbccF#vWQNtFf2>rS>qww;$r`Ni4w?=hCeQc$} zNDX{eOrX1Wcy-0kch1Kv4fWlb@tJK+L|6J)I4?yD?6(HWdBk&5;!h5ED5aLCfc>wm zD-Fm=h9}ukK5TB3wegl}{^b`B+83$}@|jTFmey1SyU$8_4!WZ^ zAFlDtCTySJs=^M&}GJv19VQ=HxFj?keWi&VM_2n>0DqvA!l+ zE~D`7jrwi&ixDqw++cYdb{k>E^WKy@MqsI52T%&2l>(Ugo9s{}PV@HBk)OstOd7*) zH0plQ{lf>=1)&$mufeeTx7aUMmE8C}95#=_H!lCAq4IZv;9Z5U>vTVI{h8sU0?VY< ze+1M~*i!m4i$m8FFxfkh9EF4~`;X9>Z+2z>(+s!rmr8w)&KB_kRr;rozD>Qf;<+#7 zBGJv7<73`jk{|p1k*@^j-#4+=ip<3KU4E9;*eIog@(LRFjN&nuLbn$_k-QU2v(9+j zUwKp0pJ%p)o7QL9d@JvrxTZ)Mb-I(LNct;{R(6Ys{6_7`41{%0eU+W9=b|af5gXBZ z!{TjzhxXTuL$>TiYtL_jALH+JzuxRs`BfkF-C*Fxbd1bjJu@qXePUTsU$o3p&L79v z37fl*)cZN5n70pGrf>6IKqUt;eih$gvlVvC(hAWEn(j{k&9d24)e;1_<4ijvFKu#q zu>_^G=QL$i(FPS<5D%N=_kP8*k__c{@$aiu7Uyi~8swLt2dcDnbRS>NsEUVBG#1pu zp|xtc?L#(#3gMOm*McTS`C_@t4x;+R2~kOP+xPoAa^&7v+27gQeOSh2c)sfK-oA7$ z(%oUm!51Qde7PmCl$xQjVqdGP%akgjjap`82oDu~YZ&X4sjQlks`mNf>}l6PQMp*B zMAyb=2)_PX{9=3-^`eM9Y3uw-)-0sE_RvG7BEdj~Cza|m(Ja*MF{<+qi-(LR<{E5{ zZU3$n=`ouAs~O(f6~&50r9TYc8f<3$?HKDxrb5M#=d}MlH`IpkE=G=DnR3$DV@({N z=`)^X@BWuB-YtH4bMWiVbG?&yf>A^s-SYWmW4r|ZO2QK#(^VJ9Jq)PgdhZvd>aH&n z5_e;^&Ni&f8%GEGH}wr)3gl#fw3bdPf3+M27dl5V&NfS?ktvgjMJwjDROZOX=uNtn zyZnZfljc&#DI&Ig7_rTWCvy5DMTg!_B42I=rmPPe$U2Z9}(Rg)Kw8BrL z;?vg?7ej`X#VXn;6RV@C+@q$O#;7e1e7~{f8xE~Y#GF>tTB&ei$t!3II&S~%Uew;r zfek^0?aE}Qpsw;e?Y4V1FK#{_VBFe1&mb8`62CnSwoX!k&FNlhO8$^VK_e zREUSZm@y#8C2XJb__IiT?vA>gwqg0dn07@cM}@>sX!r;RoFARe-OJFlb)oXv3+{cL zY9>lg(Ipro#fy4+px$jqsk}cKqmnhBCnu`(jWt#h`B~J4mWr5Kv0Kom?R|m#Bs=#2MLr<*YA5$WBUCv>N~s*;D|y|$vuyqD5WlxCig!&s@($yHP)gPRn31&o7T z;M4d6tHXlY9fZ9H7iP zH(7IeR<}{1V~WltDfMODyNxC-cbrKn11>&sIak|Y_dFv~%Di1(Fr~291mE6pD_cNq zQf!}OhQRfa=oR|JU={gP=Feoa2rKXUNKWyNbe#2b{0Y?#j;|4`H#}G>!VDC$-)MFC ziJv8{Kep^E{)dt1hYbL<8$>l6TfXqS1;X!;N$qjTvr2E1pm-d3|wrpHT^lB^*ZU`NNmG4)BV zl7UK?!7=3ZLS?+ra2xYT+W=~22b|jzU*6k2Ov_YsvtuL5SCOl-sJN#&T<(5%(=x&9N^&$dTiZr{ z^i>XBmgX~0cDGYe0u?LGJ@GD0amy|=!3V+VA0!z+1mvXcr`s!S9ls)QAa%ev;VpcP JR`?12{{h)69~b}t From 10bfa5d1831df28a52ead518d1a59a27636c9ec2 Mon Sep 17 00:00:00 2001 From: Colson Wilhoit Date: Mon, 23 Mar 2026 16:58:38 -0500 Subject: [PATCH 06/13] Bump version to 1.6.8 Co-Authored-By: Claude Opus 4.6 (1M context) --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index 6e030095472..73358dd11a9 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,6 +1,6 @@ [project] name = "detection_rules" -version = "1.6.7" +version = "1.6.8" description = "Detection Rules is the home for rules used by Elastic Security. This repository is used for the development, maintenance, testing, validation, and release of rules for Elastic Security’s Detection Engine." readme = "README.md" requires-python = ">=3.12" From d886ec68093b2df1796d205a1709453bc622242f Mon Sep 17 00:00:00 2001 From: Colson Wilhoit Date: Mon, 23 Mar 2026 17:17:30 -0500 Subject: [PATCH 07/13] Fix event.dataset to match actual field value (unifiedlogs.log) data_stream.dataset is "unifiedlogs.unifiedlogs" but event.dataset is set to "unifiedlogs.log" by the integration. Rules query on event.dataset so must use the correct value. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../defense_evasion_xprotect_malware_scan_match.toml | 2 +- ...stence_login_item_persistence_execution_via_loginwindow.toml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml b/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml index 8bf5378a770..33982de887c 100644 --- a/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml +++ b/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml @@ -73,7 +73,7 @@ timestamp_override = "event.ingested" type = "query" query = ''' -event.dataset: "unifiedlogs.unifiedlogs" and host.os.type: "macos" and unified_log.subsystem: "com.apple.XProtectFramework.PluginAPI" and +event.dataset: "unifiedlogs.log" and host.os.type: "macos" and unified_log.subsystem: "com.apple.XProtectFramework.PluginAPI" and message: "match" ''' diff --git a/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml b/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml index ff4b7954295..fd0296d9ffc 100644 --- a/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml +++ b/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml @@ -74,7 +74,7 @@ timestamp_override = "event.ingested" type = "query" query = ''' -event.dataset: "unifiedlogs.unifiedlogs" and host.os.type: "macos" and unified_log.subsystem: "com.apple.loginwindow.logging" and +event.dataset: "unifiedlogs.log" and host.os.type: "macos" and unified_log.subsystem: "com.apple.loginwindow.logging" and message: "performAutolaunch" ''' From fbab6d261c21a2fa50b67277288164dbdf13ebe0 Mon Sep 17 00:00:00 2001 From: Colson Wilhoit Date: Mon, 23 Mar 2026 17:35:46 -0500 Subject: [PATCH 08/13] Convert loginwindow and XProtect rules from KQL to ES|QL KQL cannot query the message field (match_only_text type with no keyword sub-field). ES|QL's LIKE operator works correctly on text fields. Converted both rules to ES|QL with METADATA and KEEP. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../defense_evasion_xprotect_malware_scan_match.toml | 11 ++++++----- ...in_item_persistence_execution_via_loginwindow.toml | 11 ++++++----- 2 files changed, 12 insertions(+), 10 deletions(-) diff --git a/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml b/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml index 33982de887c..e51401e50fe 100644 --- a/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml +++ b/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml @@ -22,8 +22,7 @@ false_positives = [ """, ] from = "now-9m" -index = ["logs-unifiedlogs.unifiedlogs-*"] -language = "kuery" +language = "esql" license = "Elastic License v2" name = "XProtect Malware Scan Match Detected" note = """## Triage and analysis @@ -70,11 +69,13 @@ tags = [ "Tactic: Defense Evasion", ] timestamp_override = "event.ingested" -type = "query" +type = "esql" query = ''' -event.dataset: "unifiedlogs.log" and host.os.type: "macos" and unified_log.subsystem: "com.apple.XProtectFramework.PluginAPI" and - message: "match" +FROM logs-unifiedlogs.unifiedlogs-* METADATA _id, _version, _index +| WHERE event.dataset == "unifiedlogs.log" AND host.os.type == "macos" AND unified_log.subsystem == "com.apple.XProtectFramework.PluginAPI" + AND message LIKE "*match*" +| KEEP @timestamp, _id, _version, _index, host.name, host.id, host.os.type, event.dataset, unified_log.subsystem, unified_log.category, message, user.name, process.name, process.executable ''' [[rule.threat]] diff --git a/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml b/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml index fd0296d9ffc..00e417b59c9 100644 --- a/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml +++ b/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml @@ -22,8 +22,7 @@ false_positives = [ """, ] from = "now-9m" -index = ["logs-unifiedlogs.unifiedlogs-*"] -language = "kuery" +language = "esql" license = "Elastic License v2" name = "Login Item Persistence Execution via Unified Logs" note = """## Triage and analysis @@ -71,11 +70,13 @@ tags = [ "Rule Type: BBR", ] timestamp_override = "event.ingested" -type = "query" +type = "esql" query = ''' -event.dataset: "unifiedlogs.log" and host.os.type: "macos" and unified_log.subsystem: "com.apple.loginwindow.logging" and - message: "performAutolaunch" +FROM logs-unifiedlogs.unifiedlogs-* METADATA _id, _version, _index +| WHERE event.dataset == "unifiedlogs.log" AND host.os.type == "macos" AND unified_log.subsystem == "com.apple.loginwindow.logging" + AND message LIKE "*performAutolaunch*" +| KEEP @timestamp, _id, _version, _index, host.name, host.id, host.os.type, event.dataset, unified_log.subsystem, unified_log.category, message, user.name, process.name, process.executable ''' [[rule.threat]] From 06aa300a356abb4a692cb352f8ad88de037df2b7 Mon Sep 17 00:00:00 2001 From: Colson Wilhoit Date: Mon, 23 Mar 2026 17:39:53 -0500 Subject: [PATCH 09/13] Remove non-existent fields from ES|QL KEEP clause user.name, process.name, process.executable don't exist in the unifiedlogs index. Removed from KEEP to prevent query errors. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../defense_evasion_xprotect_malware_scan_match.toml | 2 +- ...stence_login_item_persistence_execution_via_loginwindow.toml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml b/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml index e51401e50fe..5584a87b0cc 100644 --- a/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml +++ b/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml @@ -75,7 +75,7 @@ query = ''' FROM logs-unifiedlogs.unifiedlogs-* METADATA _id, _version, _index | WHERE event.dataset == "unifiedlogs.log" AND host.os.type == "macos" AND unified_log.subsystem == "com.apple.XProtectFramework.PluginAPI" AND message LIKE "*match*" -| KEEP @timestamp, _id, _version, _index, host.name, host.id, host.os.type, event.dataset, unified_log.subsystem, unified_log.category, message, user.name, process.name, process.executable +| KEEP @timestamp, _id, _version, _index, host.name, host.id, host.os.type, event.dataset, unified_log.subsystem, unified_log.category, message ''' [[rule.threat]] diff --git a/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml b/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml index 00e417b59c9..b3a049e69c6 100644 --- a/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml +++ b/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml @@ -76,7 +76,7 @@ query = ''' FROM logs-unifiedlogs.unifiedlogs-* METADATA _id, _version, _index | WHERE event.dataset == "unifiedlogs.log" AND host.os.type == "macos" AND unified_log.subsystem == "com.apple.loginwindow.logging" AND message LIKE "*performAutolaunch*" -| KEEP @timestamp, _id, _version, _index, host.name, host.id, host.os.type, event.dataset, unified_log.subsystem, unified_log.category, message, user.name, process.name, process.executable +| KEEP @timestamp, _id, _version, _index, host.name, host.id, host.os.type, event.dataset, unified_log.subsystem, unified_log.category, message ''' [[rule.threat]] From 496e0710ab80d157d05e3ca6a405dbbb6dbf8945 Mon Sep 17 00:00:00 2001 From: Colson Wilhoit Date: Mon, 23 Mar 2026 17:45:08 -0500 Subject: [PATCH 10/13] Add log dataset alias in schema for event.dataset mapping event.dataset is unifiedlogs.log which maps to package=unifiedlogs, integration=log. Schema needs a 'log' dataset key. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../etc/integration-schemas.json.gz | Bin 7975237 -> 7975266 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/detection_rules/etc/integration-schemas.json.gz b/detection_rules/etc/integration-schemas.json.gz index 667f20c9c76befa566ed0bf48e2c075c2252aa12..36e49d8aed2a7e4cc3ba6500ea086c3256b8e23f 100644 GIT binary patch delta 13265 zcmb_?cRW>p_;`|oh-7CKq3mRYYb8lSva+-Hp2xb1Lq&u*Mv@5Go2(l`b_m&#z4so! zd)xKt`+I#~uix*Fd!Iet&-0x3`i7hEBzU-o@x^{8Foyd_BM_QO@Ev9fMctPZ1PD1g^KKn0NBm|EMTzJ z;an6aL(adTNX4ac8^PO ze!-RGyhZTwXdxG#h4V`lhCm!+}3NJhm|flX8@OJ7MPrZ?K4Xkt?8g3+dH%oT08C;GQeayfXTka=AStY80^%R9ckC6H7q2t6 z*MQHOprdh_fJ8_QZ3ucQE2+NtPKa)A>lgI$MZ|Fy+p0(J@eLbSJ zjLP>F!nPVd{T>U!fU{JfbARvn-H8>SrvCP@CWEs)^^|qAw}7Wu#%mJPIWNST_c)&3qBcx5luHU+6_?hZ5 z5d1s1cB%gSPDWS3<;Y!1@Hi{|Li zo;I`&Ctx3QbfRb)A6SXDe^2cCi-EK9#{Rt`JZ}b`$Nl`I?XlE>54>y!o{Ka`kJk3U z<*{!vJhUuW>gwy7pRVzdD-HJVPtYC>czf0k?<<&md)At6zIC*e$b~Y8uQ=~6Ar*F= z&&7X(W}ND%{;CKio$q4!n4xfcM2NJF@SG)mrAk8*?k7;0P$eVdP4Yg8xss;tljG!H z*qnrGL+W0dNV^@fAl*oZ`~)kQY~3%!cK3W?e041&M&k9*!`oi`WL+wCb6gf_`W9+M zi}|_k53{WMO|1v>^3$xj*U6h&^Cldaiwfq6d!7*{)DQ;{1p4IycEv`;$uidRIkm+pMhU zEUvgWa?WJo3D|Z`HmTcuSPW9K2@4pGDC-rknTfGS$s5AuS^^q+{R?|_>q7Sz^QG-G zBIt&B5CZ+R6ovidlx+dy(7IGpqH*kuNB27UJejD@K_gOuyvy8oI&}DXi@#T;STCQJ zNrOWX6}`6GbWV$!>CkvZtpBOZ;So_{26F-YMXAO4o&6;hnN}yVM*lj-g}eEqpQ%&4 zhAMij-77st(oeTa>VHAZI#M)FP8+y<^bb@j)(bGukJk%8#FLrMsq#*Pqg(>CuL6x- z^vI~p<6Dp&$cd3L9TlkJaCF~j!?jJ>GFJnIUG(XtYp$A=ijL~};Yg&j|RQH7E&- zqZv4}yIPsW@Q5|YhoMg+W<|6zdwki|*wZ7r8ZC?q^E5Rw89FSiMUPuvV3dqJBlm>) z{V5~-yki>oIlhzL_>x7_KCkDa;4@C(g=3k7{g$w#BghNCa0Kab%8Wk^@xUXFpa`5} z1Cqh@j-cxC%F{*azU+@UYa?MVTaXPoZ>nlltm`6qbTz<9f zy{R3iftBn)Cb-WI_#lre$B4!wVZ;q(O+(%griu39k)kn9FN_@qi|KftZ%^hHcu zm|tXSS(Gu1wBg~{RR_jxCC2R&aJxMy1mAK%pMXpD=sOBj11c5NP)d6IbKse9~g*=mKWtt2{>V`a&%|+S(^>) z$wnq--4tVC2oGtfANwK*hcuLp>8x;pn?_)9`lDSU|4i8yc*F)h4idKD37q*NeUBPA z!4Z9DBjE_LVHXqj!xtUFEAU-gkQmcTZ$miL1{B5glJuCC|GX=v)m$X=ru>)&V*P9& zJmLg05P0~Ndx(@UE{3@_zpI0H?<+N<>cT6Q_gr)~v|&AtH4LSQ13{$Oi=R@Wp(U ztsHn#qLkqrH&6~|FCuPK9D^zzcYK5@P~KzxE)wS1!WOEXb}Ddt9*_e2>&+=}`$NrF zOwQ&%(Rj~cM8QiC4S9kTE1jNws~(%w<>TnGfZ%0#$sIh6BbHz6Sp&DYgSP;%$#f&q z79Md25f~W-&UW+Air_C@q!?VR{h$eHdKg){vi{k^PW7PJh`%**9JxD|Wu#chcmH&C ztl;_KtPF9cO?A?gC6c8HEvu~$FXQf21%=eW%s4;qTcuzGXMBRMea0G`8r3ISV ztmx&B3af$GGJDs2x?8&Mk1XZfNF6Tl$qqEXy-F8o+i7Uta_>%YN%_XE|| z^rsYwgIwOMTdHTyxOEQ=C4JDQ^b|XhyUvdF7L+I`e~O)N zq8X}%`5(6}8Fw)@9kOwa!gX^^`S0m#WXo$-@g8?c&8Lm-@*_bDHxWSwgD&iexJr`U ze!j}a{aSg}57u-dl`n)fo<{cOAfovX=QGD?x_K4!Dt+UMEZrH3BAvbI$652(nsV=J zAjFb8?K`%6%L@!gwDZg*^G9jQ7OoMzp1jD}GSJ$V>KxCyc;Q(r%L$M3il2SkvyFB> zI3=kyJr8S0^VUO#=F2E~ie|EOI^|X_tB`aT;`M|5K;kWNKBUJ+PeA^i8g+M9=k*0u zT;&$5;$q2=6kY{*g!K$9CEaGZc4E^9j{TU&T7uUnp^{kt6nby}^fpI?)}VYx@_1nH z;4D^eW#uYO^ueY0=DhI*zW$NoaSB&( zwOX#UkSUz(4A4J##@)#j+}o4r9J61~Mn}JTwnsP5qBm<+_RHO}1@#v@bJJsVw42lv znKikw1Pg_%%rDsA4)F8f!t_Y=!)P25qykP%WDQ>Y#h}#m#*K2Ur{%$I#&Uf7H%P(5 zp70U6OBD4d5D|$gv#-}S%=fQOusctCe6xF!?EMJ`-+?oNKfwF|Ic1~|NQTn~ZufDb zF-F+d2YsT5ZpBoE!FPSY^RR>u`cAz&E_?7ZEQ!{{(Bxm4_}!t|UY8h7>D9m?J|O!s z;nl)Lj0pv@k9noAZk2uusJv(UndUFxlCU(7`;FI6{aH)n3t^4=s+h+e&NQMCvDn}m z+b5S=s-jJN88(K-`~~fw_zmYxA`_j#P7@kNvcmxp>)z%};rW*nFJ=m?t;yTXXJgo- z=;ED8$7TxxEtI5YKbRxAMY`U(!?VQW@-DsF?CZnBBn+Duks!au#=v>bp?ve@HyIRx zqqw`{E3OYacIM8m$#oURe{s#-U7B#eaX5ID!kTN`X;4En)_jodkY9@^>Q&(2#f;~KZ<7ZaIv)0Sjq%}(?!bs%q$I6aa0~;ISjiWCgY?7~JcASeA$Ug$M){&oQ?&RPhItxq zC&}fhk*Et9T!qp5!KVV&h33yUxWfr(9r*2i5FdZ0V?OoHvJyf9Ch-I5@YiGc(zRm9 zTOPs0exT$resi^9_?{m~3)}gD7w}Y5GzJN?0CjlD7o@;wO z2NEE?ZoaxuDNQO08g9Oxs;gdIvf_>OmpA4bT3A#PS{YR@pyi?x(& z$7Nz@pUZL!9T8IJC${wCuRg8+IOp0OCjZqnJ=)g%!==_2aW%M>6%m>44rS#nx4Xvl z`N6v5xe2jTopm1>m^pjiF{#%AwbDI}%2CWsrP4ajRaklxlM&)bRo&wG1LU~IAF&fH;r(IyRq?xj zG~ma2i*`?i{48c4U!pj`xVwJkvlZ!)(@hdzu*6#2d^Q{? zC9ppn;X88TFCenG%px+3skZwQRyXws- z9vc5%ag6ml$@|TiOW$2$D`(Yii}G+MibDqFpFceYmWXf}=HV>7DQ4I}%D^9!jCNxO}&Nz?Q2`{>Bl4 zsw+7sIgSxr{SLnZ&q-N)L4cX+>D^oRCGj!H5gnnk z-^{eDUmW|bc7zC?rMGW=3Fxfu8dYgUl)>2#Kyut8eHsC{1E*n?N1*qyxe=^kSR)Wb z9@|**S%j}WKx1BRZwuj@4?!eAPrqbnXAHMJ1n*PxA>J+>slg^B=D{FTRDl0I{kv!& z053lRsVoVJ|A(gjH2FQTZ%#0xBmZjU?xz~;gRgOZTK^qT`TuXgsT%C86R>6=x+LgA z(7*$M;4S13((QjY1Ws>1U`hQp1T~l;U?K>n#teasdxEs4XGp!TwKVDtkst{c`BfYx zNtKg-fTcKA#yz1DUXrS-$4E(TUgbd}gvWwTC)TB2v_Jy^81WdSvc7rsf2i^gn`7VS zQa?6F{+pNY?*1Khl!Z|{_Q74o`w#J07^Be0(QA*D3_nuwqd_cOg$}90!f5xeYjq*~ zr^(j~0Tb{O%Qq+Az4;t}c|Y|G+k-!Vn>{Is4Se=7=!aDdCqD-7AwORA>#yqi-1uwZ z=#+Udi~hRy9WNF}K2Nop-7X{EXKgFS&PvyC>@9F|SA*#_6y_EZi%!p%2OJC^4$g;U z*;u$ZI=xoTM+tg()sso`m(A$4eyl8EYD$dRkGsv@HMi1oJcVmly!6pb-l}p)Qh2=b zBDaC1D>19OE`OOwDPg*Yd&);6=UqgFME~yP;Md)ZWtX#@0_Ud2RtJ`)b&O=#5b#I{ zdIxK4W_J-OiyLgUF)hyT@137>`A!P1qD7aoD?6Im1y0gDIPnfJz|Ot*Ny6&Pr3NQ_ zldx!6^y6ZK#c968#<$u$l+8GfReu2Sn$$eY#Ks`DOKHuiyni8tr2-hP10zx>^x1WV zbF7%R0BnfAw0^hyACmmx+wgmCUsE+wiB>Yc7D26QfVFl@v>0ReHTt(&eJ>sFk37E?173OtQX=oF z^rD9)gEzmine9?~^Iu3!RtuUN6!%`ih&7M2_u<@CmzT#EIoZnX-Qy#x!*=GEG#%F` z2p1?dwn7>lyLPbin0Vw>VF!^I2d*Iv^SJL zIheHDIH72Wv{ufg7)sS%@kOp6#Bg-~d==CaU)Cy!JQ~OJb zbTay16h&nBzu4~LyCWM*K5jF^pcfoVJU6=B?X}0|{UpX!nbUkPhEjZU{7$~4YU4Za zUfmu)SBKmT9rAdoBG4^V6p<8|_rTh_yPqI7q^_l-d()yKYuiyLo2_vnO(o6y!Xv%D zB}G}WDdbYdtl+}hjTnK&B~i=4CZ$+c;pHAHk9RCG6-p`PqFxHu_{%O&EYjavD(ZT* zD{@_}sn==avevjImepk)(IHiGhopmrisD{1dCzxpX)apb=$a)Kx2@=>W^~M*P405; zuiY66zLm`#-mW*RQ991O(%xnf>d!S*AUNSnS%XyAzp^>#jKHm2cs-%;tWI9IyTX~q zg$+S0Ahz(B?eNgfkfz={o2cmW45G)9kL;NZmkxzs zM4GOvAcIV-Bf>mAhT9NbvZvt3^sT9{9NBfXgFHQtLd@7YMO zmw6?*>yn-ONvF*>(Up8)R|WlE;?eH5E*AxI-J>Ev%hmE|4Y!BVg$mCbFCDIqKWHS0 zU}BR|2~MR|68grtsMFxY+!=9Go%cV8d)f4jT%y}i!8~;O!qrX#Sqm=C#pz`_gYz>s z>aJy_{aw&BUMER1(@hzSP6_1#f7xJ6` z?UpJ;S8!UoW|)_ldtTct{mOG01F@;?s>v49)wqb+!*)a8mY)1oib0|p&ky_im!~C~ zX`oUfEmzUtRY%(Q+x>J6Z=SH7RZWhJ)-K3jXU;x0#a~pWsT-6M{Tr zRZlp+Vkgne8`mQ+4z8qq{?U?O4I)R&XPA>i-}O9igw7|4o;%|J^1&0WQ9tP$qI!z zoE!J~`@H&gh?(AOd_$)#3tx;vzt*sh1*@@Q;j_``U)A^GKyPVuL|Gvl-N>g*7wW&S z>bHgJ+z#fF!~~WV`s*zGen2j0ggaEq{q&7GCUjv^6UK@`yO(_iRv$$_cmA(duk+tU z|K$9?u73LhJc3S$d`c6ulCPEjb^8EgMT6I1pJ(84o%(+lACrgd?ci7#(?9!5rN5Qu z>m0yO6Xl+u%O`W2=wCMt=ppD%dL|CrqlW-yj02JK@lGYTGkl+Zn<@^vKX;!&%!c%9 zs+i<(f8T(tcG(4Sfr|Za;E{Orz!Q~lqP-CPy#6p*kUxj9;?ciHpmQKJF#Mk`IoTf> z6#T0=zcOI5{zq|i%|$5VidL=d_)Egzc1$t;FNq)v;zHtz!Z(BZ8*oLx*sn}*x3@N~ zA5P^~P3TOQOBd%n|GJS~$YQl!ixRe?3*IiD^;n;%lGyHN#vXrp?<#gQxv|<)4J8xl z{~`~8Qzy=yzRvf=?966&S@BTC`a-6wZH33|pceNxb~{o6v z*(pLY#k1GBtE$#x5YMU_c~fd0l}#G2%jIqN_Y()3hR6z7f7&@4cjB5fQkhc7iKx5f z3dqZu72~3*tx!yDvTb!a=5ZOMaK`7%8ZxqwBvsC@~fqE+n1vCa}{Z0%N}vgSj)fT!m&BXELi|g zy)Z*iXE7iymvkS}i&kYaSPBv+uj;#-;=PJss<+g+@ z9H1r>^~_D@r(ZFiwqko(g?y|R7m{&vp{8C)XbX6!);bwSvEQc9#=}9&+@vroEc%9V zbspt+BWu+LodP z^qRz(0o_uw3F{x+&AyTKwq~Mti7Ntzq!tr4KX^=uuF< z_DlblU`o_mYSBLZhoj#GYxJmu&8_6GqDrSlCHmYpaG7D`DWX3}ZE#OE^I`W@%a{D^ zF=p}wNEXfT;hq?6OZfs8P14^b7_wovm__ivY>fTNP-cVc6&QozYlhEkwFM3tX?me_ zi!{VnPWx7XNvY3VpKmK59R+E`8R(IkXE>iwTqj7v={RbBuRwyK5@#m?gTtqi!Be<; zDL6Z?aXR3W$sidLLrDG9{KK$PfnY7=H#fftym%9s?; z3Gfbc&_jUl;P#>6CJ@#5hU@ zsaJSSlPNQ_`?_Tkzq|Eg8|Q1nOmQR^<>g*7OB(;2h-DE?V&C?k#l_XjJwA$7RS^V#`VT|n$y1&37DIodT5AM%U>szmX4dd^=Cv8O!V9^xtG!kj? z@5$BB3VFGSmwl|>V50tbZO+{yx9iEhsMyl{ z+zhkBoR)iWlxD1uh$K%b?zunkROT> zwpiPXDa7Zw)fX40Znw{)bn_XJ7tAdw3-%tDavyfbY~5eyo_Vozf)j;15=-7~y4hQ$ zZeY8-^YkJIacCT|nd{&_BW*+i6y!DIA-9NplzcXWkU=YewG>>g?Jx>s24}}hE1Ddn z<(JvzS;nU)I@O8SQ6$pwdXCR*>C=RWvlt$i55^K_xFd1X!R65_?IMrpF3d`Ei_;ed zd_1Tgo7TUx;1=PkQMsP@l=wg{w{~vf@KxgYM90RuaJi)H>m-%iY!@P)-nha1D(to_ z@^um-FR9!<;`ZMX&_Wi>{8JfY`&{kz(c$mLKYcZZ-)PkOto08U_@3;)f_>9hWV?WR zbK|?M*^flfc@!o&{UZ$n+35}1uetsVcY}FcmU-Ou9|1LGx268h;;ZK|nB+A`ie$Th zEd3Gsx5$}Ed;c~&R{671KccfnJpHea-YxC4;@QvTLNU#1Uq-z+#p?P3;=`=M28_c; zY1bC5Vy>whk27#0D{Gf4nkn;B?3_4X604>7?*~*TkXCk$1fqYZ@{cdqsI+1WQEla_ zOM9l;%4Qmo->5O3;h-jzjwb2YCTH0x<04vbn7+#I(3s9}QWIv!kds`mRttY;{E#oG z36lyu{aqjV&7i1b+vMaj|Bk2iM)0iSmTK>Xht*{?!M%fmD=!9KYZSQlrFj!J#!rvR z2)7-`(!( z=gVq0L;vHO+r%La*W)^}72c?&q$+>BFhl12NLV`VrNWyJ!sFM_Q0WJ|(cT$(Lo1@) zGi>|TdUd9|WW@{JTimIX9|>k~)~{Gr*k%4A@1vz3?r?iLdi|*-SFxn?yV-sBgjc#- z34a;h=H65J;TYrTg>Gs#7grD>4Watq@utIX(7|0kfN)PsYFv9{Kv3ajQjY zX^N2QbT_<|HNM62jqRmPp&~clrp}dH{b2qmLH=|Nk7qD=G1_5ZnNSDPLGoe$&rhpYURF$SXwdVg+#x^Bx$TaZQ-Ill;6}^=w?h6c?;ZN zshJP)^g2b%pctUIZ@0>|Xo|dik1)L<4NMWV^6(m)Ofe1|B@~$3HEn!cx}RA;rXRzp zUM4DSG`J()gM8_Qid_%AWM{PQDbR3jgs^*3g`)Li(^4!P+#m8zT39yz(UnAFIB@Oa zT>d6WE*?q&+&ZBs6~UmuD7yt(iKna53_^M+rlRu}(F!usg)I}rgvc-A5rwf(IC7ii zDSMe!s6u#|Y>Hx%_Rv20$JURTgNy~0NGSjMvbg_#F%h%O9r2m%l`^mKv_jRIZg73L zb3w7vvt_W-tqU0J_J8SGcs}^0u3jf%?>JW<@xn}b$KqbaP;zH}YGfAseWEg5mOx`T z{zV#@?eIwQCc?8Q0V#ijbp#LnugkIZ-QH3ASq_g|ItQk28uCicBtFY#pG@!OkE86t zr5F)B_!qqRCInK24zsFuVKOM1l!=1SzOjkBLNxg%8T9W<=?idy*LI0=G6}k}_UxeTS z5-ofBr$xlt8Dg|2AHbR z2N@xQk~@l1C2%cyL`91r0b_j4L;_eu+LNE#=DlAxoC?f_1h*!&In?-iBgRwl}v>hr~yY93EmHxxJ&oC@S>;_x}Lb CO`P5U delta 13255 zcmc(FWmr_*7q5yOR0Kp6R7ycb8bLx*1q4(|rCUlQhxAZG9Z--Kj*=n>NOw0PNQg)b zJr3PNcib6KU-ft>4~zoqY~_92y!UsKfmO=>3iyY0q&7AmAVb9D)D> z2sjJ@gb;w!5JA8Z2sjD>#~^?h0**rf2?UTr02u_FfBmLe0s0eTSd2m;r{eaO@-S zG@SkjB!c}Pfv=BbXN0fO`&Qb++4>;G;ng=?B=AiGkog#8GT{>~(T1i*ex#o^S9q+|{WL=L;&P1WHy3&Y03wJp7bEbl&MflyX{HaZX@KoJBJA zlsBIA4TdBhGj>pX06xggaf$VZWNpp+L{0BTL@Sv)z2`Kt59d|k&VFZ(EE*Gj9`ZIp z=T%5Sc5BnS_bpDzVl7dG4SZ3$=QSEAb0D)57xw9ezNPbh*g0`8_>CdRK}4D3!fCKY z0LK`DTt5Vg-vuHVV~Cs6ydg+RxaHcgdhR!)69K$n2%aJ&?kV6_ffbBEYGluF@l0$Y z{cuhZ8;4)h(El}w32hpDWp%u%CMS!H%}GXeRX?c9rm8LQmdF;@-HsEy+ua@W>Fem8 z>ZpSSmLwwwVge66?d7=XO2}mcR*lX+{$!Ya;?*!QQlIn+L8BYDmT{y zDqL*%V~_~=9*Te~jX^4d_yB#~)2f8Z?n-3`QVj3n_{R%KSkDBc2sZ)G9a`MC z9K&0T>o2_Rz`)ri;CXy%BIL%1zz9I|`&R*le5;{skB z)UP`8-(>8NUi0j?#$=9t^Q*faSEDBy>lyfIS9!^FQVhNl%#<+$EXrM)?YqzNuCQ}T zL%xX9g3&`#`ii*>Wk?ES*-^`y$iZO#@|UvH(}>{vjLNca9%3clSDf>G!lG|a#oNin z%i6crqgpP3DwxeJu;@|iEPywC4UN@oicf0vuKJkDd4Iw9i2KyN8>^*|*~kn|Qr~r2 zpr58Q-HTf{-D7#0Ln5fn@zHEhe8*&r?P4D0uuX89?G|S7EAyLU$mByQZY*ycN#8_V zl;Lrhx}&*dm4|zNX6p2NT0$^mB|7W3bNdIAyn99B4`PfN+YBnL}@NJK$wx znKP=iEXLZegw>-(V`XD8jCxr}|7GL|#$nWAwKc26sNb@^`w})>whL7tREcm2__k%H zNMmYP&wo6y#Xehd*1oQ8Ne|T9`Lg)9Cvh{z&P7s4QXa0%K|YYQ>(zA}DKyU2i_Mhh zYYA7&iDLIAqS6*L%k6ya0Ads4B&Hpnw$@5T$kuFqaVm8c6YdP=p@nkdvY!ccrwKg$ zXcFsywTq0wYOkkw+bDDkv~EU0i(tts+I-BTj#*TkYWFzmLMv0Wa%Va|R*TKw$ zZlmDODoqKk2s#XjziFzUiB{pdP&sv1d#^*jx~!&gKD=lSUV;_OL55?EPYm-bDmz&O z0^wG3P#Uj1Ot`tLJk1U(n&X~Cv^mHwy!lyqdgYsMC*C%%@!&@V}G^ul~yx{5ml~VPuz$r8p*|Q6aU)(A-GjLiATKP4z`eqqEf5>tFc$*k$IH}&t?V4=ldzr@?o&Y+ z0kYziWra2rWRSZdxq$OS9f;9m1V7Pxs|v;>t1al4B?17Eeob<+t;9FW;?y{%~c z=5vs5sgdA!(Cz0AGQs_}AUzS?1?(VcMg#oK7Q938sdQw3lNlQxWEYaBbK)sc(^>?q zXOH_>%CZBQ3AJC2ZneM*4&Y5#*B*ypZHP@L7hbRjZ@^V{xMe`!&2_d^g@f%tSt6Zq zETmRZ_`7!v8`|<8nP}}T8yf4$3I{vjR;|h&*ZNM1;aIZYWkfiZ7rto^O5y7tB`m+v zw3Y-PbO5>V^$uTNyVm3|jY*=3U=2%(bnwyq*Gp48wOWA z1!)LdznzMtfptJo5WWH8x(I2Qv`z-QgWwswOa(VR1up0QVTQfpu{pyVcg4K?2~x}XySZC{IB-5zuSEH@(HHb+nn z=5oYMrgerLJr6H{APZh*B3yi3KB@t?ID!uj=N4}J|Ko{l9c8B)T159$zRPeHDLSVa zw#TaGpKG{LDO$|h^MKv|jraT*Nn;_a1?{XDjjJ>jhS!Je652MHX#7>8d7~$TSkZ|u zc`_qMo~T!RtONsPZ&ePCb9yn_#H{up*&jY0NJcqnm|cx+xhxwiT`O)nkZdx|i>2)v zJgHEbxA5QvQWHQsa;@Io+O%4BTG+Je>r<7IvR9#r@${pR4c^#Scg@ni-_Dtr4r5QmSA~ejz_IZ`0VN(_toCeX_{@jLf*>DzM*FE%qpd}6hXq5~VIF6-{D#F!U%&NtSGN|~a_X&4V&{c#>8~i1 zrmVZlB4f@Ces1wmU2y}GEI;h>`Da=q5$#89HR=O6ljSJi8S=5o8?_*vOgFsqU$nzm z-K5!wL7#NP=vb+Z=V^`BX}Xkwfs?jTwyu1fv#J8HnfjNs^^X~)ZMUYtdv|#Xmw28G zjDK=EHl8R`OV>!TuDi_oTJ#$2`_7ysgPat!3UXvd@sy5y>Zfa3X_mrDUUuv?_Jal0 zS31aA&@nqJ7`CqYut6=Ya;MJfhc;ES=3j>2zi2mHKYFBIvR;G}HNk!DZl%$17s*%f z!dxQey-zG=YKf***&#H~WaE+jn&XXvOzigU#Jy&wT(jchCc$fO{JM-Ewnb0bNmY7m zHSHmfrVgnbAXC}9vxvFU6l&EWN`h*&zbLMCR{7J+}h{$_OT{?2?dcAfJr%>&|W%g2eo98oRo@&8VV8-dFApI ze;-r3Sm`zTnvA5*mOa*Me!|-^g*x9R3S5@L0>WKRCC$pLzEZ*}w%ti+8WI+5Le(-M zBhV?`bGxLiW9+M)7$Li&7U!a_h*Z;}OqjZluh}PTIPCPEedQ|=QllmvjMhK}5JbPg zFtxgMO^aeWbZrgy^rPjILcdfi=PK|(6d#uLUWtu2EkDy=U3naBw3mIyr{1|CA5K#* zn0EXs(4Db$I$6|75G1O1@s^ynnn^@D&B`2|IL75b(tOaSiiV5mU&NP7m-H3EnA`O~ zNU@D)v8ltqoPT8aA2H~IWBphEtN?Q&!3&p3$1M7dg zTYjTnw+Gghy98?IJIh+>l>Jh~i&_(h=cz~T*;pm^eDf*iFUH8yT*MU4Y@i=&4d(TD zAE^^tlhfd{NtG*2zMd>-uAw1m+gmbr%&6XY;P8gv>|6DYFM_tcO>(^1gQJ_`V5k-! z>dwxZ!-sm8W*u$Wa1nmw9ltd*b!U#$y0`1quEpD0Z}UW*j_lmGn;l=*nh`B4j`@n@ z50;F)dtJ*xxz$L$uo2lp*@Qv#(b;HUDd;Pe7?@THSCP+|a%YP|Q>C`uZ7u3i+)>M& zeA#9DwP*M3@!>$9+Uw5An8&_ay&zaNdtgvU6&Xc0le1tYtU7=>pUjHJc23R9zMwO= zlagp>s@Qveo32!zs*d9GG`%C}1&eurSAe&irsO*Yu$~7<51;b@&tFoN(CK98#Wn)* zm67yhV(Q3CWF{@lJQW4+?L`6_^X4|{0!obFSr70g(M+J}GDu=#WyYuwiCICE90Gq=;2i zu$7cgPZ4D(d-S*nEN&@(Vx8}c%IJz4%p<95blsNVZUiN|ljZ4j=r#j8IHAN-}kSHRyNWPzGj$-Zk5Am1J_jw#K_2R8LcXdB4 z-gJOayjp?l)bXE0?7KKKz;r;9EaO+~ch7wUcp$Prf&Jm|9V$%z0;EFzMCpbr_HzyK z^AYGf?DmoS%TqUb9=bQ>{e)i*TsuH=gWxanSxER>LPNGeMBf zVqHV9k@^mO!O=c1^BO+A$Sm1=v|M&o9qv=?cbh^MzmaKoUGpdr|I+NCZ$#Na)yPY7 zBSBI1umU=sjJ|DXKtXr@Y<4S ziKD*c|DpfofM*W<+PFXV@$7yQnCpuBZ%ax*c3hZi{@X1g>N9Hd%A*`^z?*}Q51ezO z_(6XV`!3AELRjuOh&=4{w2B|rdjTr&94FKL+1y7=Kg=JfB{)vTC0sRs;6FCxKwhAT z@V8R94WELZ&dMBC_60o%&S;*6WuAeqhet36#o$3d(BqKUaTx7~(`?SWnSQTx_y4`l z$KSxz66orlIRkjR>*=29hTUF(r{G;*5J3KqX5XKJ+Zz4<-Bur`<+82%^4nH(;kUZM zL;p5@tAn*42UDVl7j!k+EHi3lC2kNZ-h6oCv;>Zj|DZVHJpTL$k~9Nm4*E9!Tg$%oqla0~UtAGc8d zqn}>?jQUm6%ly%Po*xO5&$B!`_SWN1Ld8ptvA5za;{FNxJH#I|!x7im=SN6lJLg?_ zUmqXObym|tzEr#!rG9g!EM6*{qI4@c{k9M`Zf_0guoa&g88JYkHPtbLZP7+wl~icS z*o1lVIp-P{lZ}u`9d~$3opWp6H|+*yye*m8?qHl88Sg0V?j5N86sFQL7r;?F6*I`p zt2Q7i&-rClG(bNkzkwrwb$~%ga6{O^S&^zI_*iT6K~@+O2%b6U3*QLF9j>{3EoIzG zjm@c<*Oq)qJ^+shvfaCHn4RZ4LEUhVTg&6Mfl-Lo;Jus(pe31`i>jH>rdsn4(%;IJ zGSi#P9pCtZg(s!?FUB*&AE$j0B`tT6DTLzFbKI@K+heW&IFbJy_u?lkeBAeJKhQk; z4(_ay(Zkn@hPT7;%-L7OV;;r29DfmNY9)K~f4qLVe`ju@@Ugf5fx~cJ5icco!i*V z!t)oCWs1`xS@fB5D0-gHNZ2z71xF{>IQbp3j2cXOmzCfuRMw?ge%*6Rl5*E{QPY?_ z9S)9``}jWMVVQO~ zukcbm8x6%?QW1-AW1sT7c%4hbrm6xu27#Z3z%%v&$kfWGv^xE&6cYTC6*(L2-8y{_ z(71b=v&?i7CDebE;{+Wb@H!zQ?Y- zB+6fnB$36DoAvPU7(waNGCTT8U;2cxfrod`RgTrQx?JxvQwZbE)+s>oVxl$KOjYW} zgUso)4amqQ-?BZ5j9po+8H-2c=B<>gXPWM6qEdZxN?F2EbbNDgWP-xeoBl%O zA&D(Q&aLWe)*WNfa@)LpblIO2EjySkK|2%FOL1cS%D!t@)xwJ}Ymi zAE1^~33O0`Xx>*kVa*GaDCieLQU=2FKMie6%;q|uVM)E_^vuL=z&^X8kg;RB$zU1f z7;drQ=e(S&o)AYYIO`7%)MY)W{Nmz3+v=X_lu}HQga{3=vmEe_KGy2#ALta{xJP4Q zHjM1Xc2-kLMUOkO&w&<^5VB#jY(kbWl)fj+b`XQWDh&+E^?nML>YTQab77aV=*sPx zEKG_aQn%F^IQOPv%Q4irtLxNCcS~FAxED#_dnN5cvG>~GfUE{}XO@YEIBr0zXbo_2 zYoe8v%2sR2=sBoN5Or${S6>I9EgagB^O^0--M)pxpIdWU>qjoo#;lpZ$RQf1xh=^j zy{4P;f+=&)rNO#p`daB}Sh$l7}&}NIeWd;x&n^ zuQLovLMHG0o3Z5AV(z+mterfO@t)MHfWFRwj5&L|!qif&f!Qew6^GIiE?Pao8e6Z) zBRC&|wVHA(&VJ(G2-b(J-K4%cme*ojy+5Fc79lib|6%r7A9*38g;amQS-fVV06%U^ z?lK^QD;so1I2Wmup2CPQkQ#Oh1Id34#7O7KqUfPlO@vEF#>kuX?}y6BUgmw>Vel7o z6lY|7CB+q}OIIyyVdkJ;O5HcmJ@?U`zo0Z*YhUdF9>yhccfx2FQO!ZW5f!dh<6~pR zzh&5W#VgK8agmj<<1&-|0=nV1EqOWyRtU#|RS(C3{W%aLE3dyw>Q%H;x|`D~CBF&| zhz~AFHxr47t(R?>RpeUlARW!JHXQ8--}dRfA}gt+XQF)u#w(!orZeght^owsk)@2+ zsqSA&XzbvA&~%TTC%^e$%suI_AeIYCw^F-KUsbP== z&ykv^praM-)W{#iatqw)4alP%hF|D#yM9`~^lwH@Fvr$lvf(R&rzEm%;KiJgEq{FJ z*@2b`i`(!!#=BDC0c^B*pQ=A!bo&w~2lKc(92bd45D8Wj6yk1W4@Q7gls8Zz))z;E z_TO>eZ@%RoVr1Z((YRj^-b8{#THdT@GYpDCFn9jVgjn~Nu`x^C5BM9815Zf;jh06O zjm-5B>;J@4-OqD*)HxJZd<9ZclG?K4vXJ7h-G9B{a9x0jz;%JbE8Opsy3rt&mi~W( zz{9%8T;I}!pGVRDdf@8+f^@gB?UHn3@JmK!qW|$?Grj-W;s5tyFpX;7h25iYw=3Zh zU?p&sdA$DHonQM^bMO+Z7mYLSMuSKRZ&sN`#8M7^buDiHKGpBt5Mph66u%VGjR*h! z=GkwB)`*u&KKR9@g3Dinu5y#1q$<94LHo@W{BHQq0||ddas1O<29s5PpGlnkTbNwi zUc@|;Y~RKMxGff>I{mF6kJdy8*Y^xA!9N}Y+!=H*7Q79=i35q@-8Uem)Y;05=2G~k zHxc@3-~abX*w^`PR=O{^fN|gFuX6=|%DkI(cFT)4g)iVLQo8khwNIG+vj4R0SH<`7 zZY;7BpHCpFO>#zDZAZ%F$N*D@y1wKZgBfjuUhf0mqUkxcSQ-B9+*c>eAsfgZe2!4Y7pW>g2~$NCuzJ)g@|I$(NL+V=gL$#QI!O<;C8Pj8aX)Xh1+`E;*r2r%AQupgwDrGP1 zr|b9jCYBc@rELwA9-5%XH{{CwNYzk#Y4p=Pqj$ zGQ>EtEhSRyJ#SmYW7)jR>J;hEyCh5(x70&TzjJT@G`!^n_qs-IoBm6U4<9V$-H@C3 zisM9Yn%<|~1KT3+rD9P{eA80e`dR#er^1##^Pnd!=ZuEOYlr2D69~T|51F{<-B3Tz z9z;1&TX;k42QQ7c{briZyCIgp@Ae-iV)qKj|9Pohf;wB6G7ZNf#q6C7?uLu!!vUHy=@#(mgFOH8z^5`m4SBk!V z-=YcP&9{F8Mtz^veomJu%H-{}32bVYv}pqG*K;QRdABpu+tNQv8z=BEP$rtl? z1X2hGE)~*=<QJO|Cd308nN3oEdQfp1x%+Em+3HeiEBMNhA4zc_r*-6 zc*PZE*G=UF9qOPFPZWAvHSP>$GbP!lYg-Nv9QY_pbV_U{vNF*uXT|1WBd-Oui(!tq`QXQ{&?!2IE zc^At`t+s1kVHo}Cc?o{b3e|{vITtObw#bIo?E@xyaE}==yT88p&Mn zYG9|*Hm_f^w?f;8{|a;1%R6^2y$iW7^FHC>eHNT375L#x=7h_v`Nu5b^7r5or2Kz@2z&WIGE^1*wo2cDEGC33{yPVC?A;Z6 z+9-ah(4HrnWtnyLs$269LS#cq&F)8e?ncYDPo$)6$JZ4KAS>XFN2{j-G9;I)r#iCs z6a;K*3I&}N$?SXPL;0Iv+0pFAo;uaA+(xz0G;8JSsZmOwS&VUFvG}O7%jnzOuWFNN zw#tI6(P5wO7{9}d{qJlm{!sk158N@X@&3yni4RZ~L?36UxE-6>GKknYTFD}GN%5&e z?bXt)+jK95c>Px8G&%!sZt!SrOON+dn$$kGDR(SWFY5qWSe-miQQB$Yvd<7+=-^wW_B|qq3 zrczJp$J1Zx>ltz;sYvb!d2ad??II=4WU3D0DZ&*G$D8GEv>&HaWpw@{D&VZ=rXkCW zzr5a4RiyqNrofrkK`i!L9(Q^qa6g2RdRldRiCdJN>lBTH?J&>%jr~dtGh?fC zcVfswgj?wnC!ZEY&5Fb~3@JW6O@?_HGZu{!rQa2;r<6AW)#;uHSt>j0@wuGwZoSHR z`9Xk?aPZ3IV7)iU>`p)1C?%$6;o~%%oMe@=3w4nfGHX{P+RK`h>zLoP3#oPz zM-K)qPR!=DZ<&!FO9K%wSiu$$yh=9V%Dq+ES799bX!1#gN`^$ZJ*bFjp=Hla%5$*{ zO~9J66sorPogV0Fz5U6cXeT&Reh4!>IscyCVsLclI8zW(k5`QsyX7yP$aqR1LAL%3ru0&s>DRZ?}C{b;u^qd!5%5qug z*3Y5YIrlj+)G9!3PpzUtZS;DPVEi24dUlg$Cu1DXbxl`+uH?<}N%07&wLKL+f6J3w zw=(IOE0EWGoP5hnTQY^aUhuBz2EX!vhiJ=WCa8R6oeW#P<9JD=fnd>1 z_&ixd{GUO|jN6Zc#y>_2pGOA%8BrcWH*ye{DTrvK?e{YHs;*ZW9xQvMnji!MYh}dH zk?4ZGhNhQgkJdE?PL#84A5Y*Np4a|3YPd(|oZCd0Yjt1UFm&Q0Ci~GLtr0(jyC?bD z`fG>94u{1qp^e+v5q|6lbvZH=E!Hjcx_KOf+Ft2xY_b}U;2kz2*RImbEX$2GSP1eS zG`mVoE5|dST_g>sN+$FSX!FQZV$?XrV^Pa#Ux!QreU?T*?zMQxtm1mILcW@H-QcFox|c(RQ8q1PQ)6AE&O7(MTgD(_`7@6W@+-SjW4npK ru29CYE$1UlH7OOD6}+RYM^-kGyT}6v4(#m_9KeQVoZ8`kM)ZFGJ94M; From 947d1497ad9d4ebf51ed8686ef098cd22512f1d8 Mon Sep 17 00:00:00 2001 From: Colson Wilhoit Date: Tue, 24 Mar 2026 09:15:32 -0500 Subject: [PATCH 11/13] Update loginwindow rule to match actual log pattern The performAutolaunch pattern doesn't exist in the actual unified logs on current macOS versions. The real login item execution pattern is LoginItemsLauncher, which fires during user login when login items are launched. Updated rule query and description. Co-Authored-By: Claude Opus 4.6 (1M context) --- ..._login_item_persistence_execution_via_loginwindow.toml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml b/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml index b3a049e69c6..628aaab5c20 100644 --- a/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml +++ b/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml @@ -8,8 +8,8 @@ updated_date = "2026/03/23" author = ["Elastic"] description = """ Detects login item persistence execution via the macOS Unified Logs `com.apple.loginwindow.logging` subsystem. The -`performAutolaunch` message indicates that a login item was automatically launched during user login. Login items are -a common persistence mechanism used by macOS malware to ensure execution after system reboot. While many legitimate +`LoginItemsLauncher` message indicates that login items were launched during user login. Login items are a common +persistence mechanism used by macOS malware to ensure execution after system reboot. While many legitimate applications register login items for auto-start behavior, unexpected or recently added login items warrant investigation. This subsystem produces very low event volume with high signal fidelity, making it an effective detection source. This rule operates at default log level and does not require debug or private data enablement. @@ -29,7 +29,7 @@ note = """## Triage and analysis ### Investigating Login Item Persistence Execution via Unified Logs -This rule detects the `performAutolaunch` pattern from the `com.apple.loginwindow.logging` subsystem, which fires when a login item is executed during user login. Login items persist across reboots and are a favored persistence mechanism for macOS malware. +This rule detects the `LoginItemsLauncher` pattern from the `com.apple.loginwindow.logging` subsystem, which fires when login items are launched during user login. Login items persist across reboots and are a favored persistence mechanism for macOS malware. ### Possible investigation steps @@ -75,7 +75,7 @@ type = "esql" query = ''' FROM logs-unifiedlogs.unifiedlogs-* METADATA _id, _version, _index | WHERE event.dataset == "unifiedlogs.log" AND host.os.type == "macos" AND unified_log.subsystem == "com.apple.loginwindow.logging" - AND message LIKE "*performAutolaunch*" + AND message LIKE "*LoginItemsLauncher*" | KEEP @timestamp, _id, _version, _index, host.name, host.id, host.os.type, event.dataset, unified_log.subsystem, unified_log.category, message ''' From 495066c42175213f41f51e816cf29a69b877808f Mon Sep 17 00:00:00 2001 From: Colson Wilhoit Date: Tue, 24 Mar 2026 10:41:00 -0500 Subject: [PATCH 12/13] Promote rules from development to production Unified Logs integration is now GA. Rules are validated and ready for production use. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../defense_evasion_xprotect_malware_scan_match.toml | 2 +- ...stence_login_item_persistence_execution_via_loginwindow.toml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml b/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml index 5584a87b0cc..eb1bed74609 100644 --- a/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml +++ b/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2026/03/23" integration = ["unifiedlogs"] -maturity = "development" +maturity = "production" updated_date = "2026/03/23" [rule] diff --git a/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml b/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml index 628aaab5c20..bcc6fda1154 100644 --- a/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml +++ b/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml @@ -1,7 +1,7 @@ [metadata] creation_date = "2026/03/23" integration = ["unifiedlogs"] -maturity = "development" +maturity = "production" updated_date = "2026/03/23" [rule] From 4b3d3b817a9e61947fa308b696f125b47e8686c7 Mon Sep 17 00:00:00 2001 From: Colson Wilhoit Date: Tue, 24 Mar 2026 12:23:17 -0500 Subject: [PATCH 13/13] Add "Resources: Investigation Guide" tag to loginwindow/xprotect rules Co-Authored-By: Claude Opus 4.6 (1M context) --- .../defense_evasion_xprotect_malware_scan_match.toml | 1 + ...istence_login_item_persistence_execution_via_loginwindow.toml | 1 + 2 files changed, 2 insertions(+) diff --git a/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml b/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml index eb1bed74609..dd6f5aa3221 100644 --- a/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml +++ b/rules/integrations/unified_logs/defense_evasion_xprotect_malware_scan_match.toml @@ -66,6 +66,7 @@ tags = [ "Data Source: macOS Unified Logs", "Data Source: Unified Logs", "Use Case: Threat Detection", + "Resources: Investigation Guide", "Tactic: Defense Evasion", ] timestamp_override = "event.ingested" diff --git a/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml b/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml index bcc6fda1154..4c89998c867 100644 --- a/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml +++ b/rules/integrations/unified_logs/persistence_login_item_persistence_execution_via_loginwindow.toml @@ -66,6 +66,7 @@ tags = [ "Data Source: macOS Unified Logs", "Data Source: Unified Logs", "Use Case: Threat Detection", + "Resources: Investigation Guide", "Tactic: Persistence", "Rule Type: BBR", ]