Rule name: "Skopnix: DragonSpark file hash match"
Rule type: Event
Test stack:
  - and when the event(s) were detected by one or more of [any]
  - and when any of File Hash is contained in any of Reference Set - "Skopnix: DragonSpark - file hashs"
  - and NOT when an event matches any of the following BB:Skopnix Known-Good Exclusions
Response: dispatch new event / create offense indexed by Username; annotate "Skopnix hash match".
FP-safety: BB:Skopnix Known-Good Exclusions = RFC1918 + the customer's known-good destinations; the set only ever holds skopnix high-confidence, multi-source, warninglist-clean indicators (time-to-live 730 days, timeout on last seen).