diff --git a/rules/windows/powershell/powershell_script/powershell_ps_get-childItem_bookmarks.yml b/rules/windows/powershell/powershell_script/powershell_ps_get-childItem_bookmarks.yml
new file mode 100644
index 000000000..f6a1ad514
--- /dev/null
+++ b/rules/windows/powershell/powershell_script/powershell_ps_get-childItem_bookmarks.yml
@@ -0,0 +1,32 @@
+title: Automated Collection Bookmarks Using Get-ChildItem PowerShell
+id: e0565f5d-d420-4e02-8a68-ac00d864f9cf
+status: experimental
+author: frack113
+date: 2021/12/13
+description: |
+    Adversaries may enumerate browser bookmarks to learn more about compromised hosts.
+    Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about
+    internal network resources such as servers, tools/dashboards, or other related infrastructure.
+references:
+    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1217/T1217.md
+logsource:
+    product: windows
+    category: ps_script
+    definition: Script block logging must be enabled
+detection:
+    selection:
+        ScriptBlockText|contains|all:
+            - 'Get-ChildItem'
+            - ' -Recurse '
+            - ' -Path '
+            - ' -Filter Bookmarks' 
+            - ' -ErrorAction SilentlyContinue'
+            - ' -Force'
+    condition: selection
+falsepositives:
+    - Unknown
+level: low
+tags:
+    - attack.discovery
+    - attack.t1217
+
diff --git a/rules/windows/process_creation/win_pc_susp_dir.yml b/rules/windows/process_creation/win_pc_susp_dir.yml
new file mode 100644
index 000000000..124c6e4e7
--- /dev/null
+++ b/rules/windows/process_creation/win_pc_susp_dir.yml
@@ -0,0 +1,24 @@
+title: Suspicious DIR Execution
+id: 7c9340a9-e2ee-4e43-94c5-c54ebbea1006
+status: experimental
+description: Use dir to collect information
+references:
+    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1217/T1217.md
+author: frack113
+date: 2021/12/13
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    dir:
+        CommandLine|contains|all:
+            - 'dir '
+            - ' /s'
+            - ' /b'
+    condition: dir
+falsepositives:
+    - unknown
+level: low
+tags:
+    - attack.discovery
+    - attack.t1217
\ No newline at end of file
diff --git a/rules/windows/process_creation/win_pc_susp_where_execution.yml b/rules/windows/process_creation/win_pc_susp_where_execution.yml
new file mode 100644
index 000000000..e197ac668
--- /dev/null
+++ b/rules/windows/process_creation/win_pc_susp_where_execution.yml
@@ -0,0 +1,28 @@
+title: Suspicious Where Execution
+id: 725a9768-0f5e-4cb3-aec2-bc5719c6831a
+status: experimental
+description: |
+    Adversaries may enumerate browser bookmarks to learn more about compromised hosts.
+    Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, etc.) as well as details about
+    internal network resources such as servers, tools/dashboards, or other related infrastructure.
+references:
+    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1217/T1217.md
+author: frack113
+date: 2021/12/13
+logsource:
+    category: process_creation
+    product: windows
+detection:
+    where_exe:
+        Image|endswith: '\where.exe'
+    where_opt:
+        CommandLine|contains:
+            - 'Bookmarks'
+            - 'places.sqlite'
+    condition: all of where_*
+falsepositives:
+    - unknown
+level: low
+tags:
+    - attack.discovery
+    - attack.t1217
\ No newline at end of file