diff --git a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 0d8fc65ffd..5ff89ecfe1 100644 --- a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -1,4 +1,4 @@ -name: Attempted Credential Dump From Registry via Reg exe - SSA +name: Attempted Credential Dump From Registry via Reg exe id: 14038953-e5f2-4daf-acff-5452062baf03 version: 1 date: 2020-6-04 diff --git a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml index a216a7dac2..f273fad645 100644 --- a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml +++ b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml @@ -1,4 +1,4 @@ -name: Detect Dump LSASS Memory using comsvcs - SSA +name: Detect Dump LSASS Memory using comsvcs id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e version: 1 date: '2020-09-15' diff --git a/detections/endpoint/ssa___detect_kerberoasting.yml b/detections/endpoint/ssa___detect_kerberoasting.yml index c69e765be1..5c68d026ec 100644 --- a/detections/endpoint/ssa___detect_kerberoasting.yml +++ b/detections/endpoint/ssa___detect_kerberoasting.yml @@ -1,4 +1,4 @@ -name: Detect Kerberoasting - SSA +name: Detect Kerberoasting id: dabdd6d7-3e10-42be-8711-4e124f7a3850 version: 1 date: '2020-10-21' diff --git a/detections/endpoint/ssa___detect_pass_hash.yml b/detections/endpoint/ssa___detect_pass_hash.yml index 5c8e01cdc4..c454713d1e 100644 --- a/detections/endpoint/ssa___detect_pass_hash.yml +++ b/detections/endpoint/ssa___detect_pass_hash.yml @@ -1,4 +1,4 @@ -name: Detect Pass the Hash - SSA +name: Detect Pass the Hash id: 7cd8b9fa-6b0c-424f-92a6-9c5287a72f5f version: 1 date: '2020-10-21' diff --git a/detections/endpoint/ssa___first_time_seen_cmd_line.yml b/detections/endpoint/ssa___first_time_seen_cmd_line.yml index 13dbb48ce4..d948947380 100644 --- a/detections/endpoint/ssa___first_time_seen_cmd_line.yml +++ b/detections/endpoint/ssa___first_time_seen_cmd_line.yml @@ -1,4 +1,4 @@ -name: First time seen command line argument - SSA +name: First time seen command line argument id: fc0edc95-ff2b-48b0-9f6f-63da3789fd23 version: 2 date: 2021-2-1 diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index 51185fe9cb..96e8b9d861 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -1,4 +1,4 @@ -name: Detect Prohibited Applications Spawning cmd exe - SSA +name: Detect Prohibited Applications Spawning cmd exe id: c10a18cb-fd80-4ffa-a844-25026e0a0c94 version: 1 date: 2020-7-13 diff --git a/detections/endpoint/ssa___system_process_running_unexpected_location.yml b/detections/endpoint/ssa___system_process_running_unexpected_location.yml index 7dae442017..e99736c215 100644 --- a/detections/endpoint/ssa___system_process_running_unexpected_location.yml +++ b/detections/endpoint/ssa___system_process_running_unexpected_location.yml @@ -1,4 +1,4 @@ -name: System Process Running from Unexpected Location - SSA +name: System Process Running from Unexpected Location id: 28179107-099a-464a-94d3-08301e6c055f version: 1 date: '2020-08-25' diff --git a/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml b/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml index c12189596e..c813c5bc12 100644 --- a/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml +++ b/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml @@ -1,4 +1,4 @@ -name: More than usual number of LOLBAS applications in short time period - SSA +name: More than usual number of LOLBAS applications in short time period id: 59c0dd70-169c-4900-9a1f-bfcf13302f93 version: 1 date: '2020-08-25' diff --git a/detections/endpoint/ssa___unusually_long_command_line.yml b/detections/endpoint/ssa___unusually_long_command_line.yml index 60b3d22433..6a8e87d1ff 100644 --- a/detections/endpoint/ssa___unusually_long_command_line.yml +++ b/detections/endpoint/ssa___unusually_long_command_line.yml @@ -1,4 +1,4 @@ -name: Unusually Long Command Line - SSA +name: Unusually Long Command Line id: 58f43aba-1775-445e-b19c-be2b87d83ae3 version: 1 date: '2020-10-06'