IoI rules library
Reusable SPARQL signatures encoding invariant predicates over CASE/UCO knowledge graphs. All rules are case-agnostic — substitute named graph IRIs to run against your own datasets.
IndexedDB Cache ↔ History URL Semantic Check
Detects missing Chrome History URL entries for domains evidenced by IndexedDB cache directories, corroborated by USN journal modification indicators on the History file.
VSS Directory Presence Check
Flags absent GUID snapshot directories under System Volume Information when VSS infrastructure files are present, corroborated by USN deletion records.
Event 1102 + USN DataTruncation Timeline
Surfaces the temporal ordering of a Security log-clear event (Event 1102) against a USN DataTruncation record for Security.evtx, returning both signals sorted chronologically.
LNK vs. $MFT $SI Timestamp Divergence
Detects timestamp forging by comparing the LNK shortcut creation time against the $SI timestamp for the same MFT entry, corroborated by $FN agreement with the LNK value.
Office XML Metadata Timestamp Inconsistent with MFT
Detects timestamp forging of Office documents by joining embedded Office core.xml metadata against the MFT $SI creation timestamp for the same file path. Fires when the embedded creation minute differs from the filesystem creation minute.
Contributing rules
Submit new rules via Pull Request following the schema in CONTRIBUTING.md ↗. Rules start with Community status and can be promoted to ✓ Validated after independent reproduction.