From b15aaa55df2bdd382b0abf002b24bb975de1c86c Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Wed, 10 Mar 2021 13:27:00 -0700 Subject: [PATCH] Moving non-passed to experimental and deprecating some --- detections/{web => deprecated}/web_fraud___account_harvesting.yml | 0 .../{web => deprecated}/web_fraud___anomalous_user_clickspeed.yml | 0 .../web_fraud___password_sharing_across_accounts.yml | 0 .../email_files_written_outside_of_the_outlook_directory.yml | 0 ...tiple_okta_users_with_invalid_credentails_from_the_same_ip.yml | 0 .../application/okta_account_lockout_events.yml | 0 .../{ => experimental}/application/okta_failed_sso_attempts.yml | 0 .../application/okta_user_logins_from_multiple_cities.yml | 0 .../application/web_servers_executing_suspicious_processes.yml | 0 .../cloud/abnormally_high_cloud_instances_destroyed.yml | 0 .../cloud/abnormally_high_cloud_instances_launched.yml | 0 .../cloud/detect_gcp_storage_access_from_a_new_ip.yml | 0 .../cloud/detect_new_open_gcp_storage_buckets.yml | 0 .../{ => experimental}/cloud/detect_s3_access_from_a_new_ip.yml | 0 .../cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml | 0 .../detect_spike_in_blocked_outbound_traffic_from_your_aws.yml | 0 .../cloud/detect_spike_in_s3_bucket_deletion.yml | 0 .../cloud/high_number_of_login_failures_from_a_single_source.yml | 0 .../cloud/new_container_uploaded_to_aws_ecr.yml | 0 .../{ => experimental}/endpoint/detect_rare_executables.yml | 0 .../endpoint/unusually_long_command_line___mltk.yml | 0 detections/{ => experimental}/endpoint/windows_adfind_exe.yml | 0 .../network/detect_ipv6_network_infrastructure_threats.yml | 0 .../network/detect_large_outbound_icmp_packets.yml | 0 .../{ => experimental}/network/detect_outbound_smb_traffic.yml | 0 .../{ => experimental}/network/detect_port_security_violation.yml | 0 .../{ => experimental}/network/detect_rogue_dhcp_server.yml | 0 .../{ => experimental}/network/detect_snicat_sni_exfiltration.yml | 0 .../network/detect_software_download_to_network_device.yml | 0 .../{ => experimental}/network/detect_traffic_mirroring.yml | 0 .../network/detect_unauthorized_assets_by_mac_address.yml | 0 .../network/detect_windows_dns_sigred_via_splunk_stream.yml | 0 .../network/detect_windows_dns_sigred_via_zeek.yml | 0 .../{ => experimental}/network/detect_zerologon_via_zeek.yml | 0 .../network/dns_query_length_outliers___mltk.yml | 0 .../network/remote_desktop_network_bruteforce.yml | 0 .../{ => experimental}/network/remote_desktop_network_traffic.yml | 0 detections/{ => experimental}/network/smb_traffic_spike.yml | 0 .../{ => experimental}/network/smb_traffic_spike___mltk.yml | 0 .../network/unusually_long_content_type_length.yml | 0 40 files changed, 0 insertions(+), 0 deletions(-) rename detections/{web => deprecated}/web_fraud___account_harvesting.yml (100%) rename detections/{web => deprecated}/web_fraud___anomalous_user_clickspeed.yml (100%) rename detections/{web => deprecated}/web_fraud___password_sharing_across_accounts.yml (100%) rename detections/{ => experimental}/application/email_files_written_outside_of_the_outlook_directory.yml (100%) rename detections/{ => experimental}/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml (100%) rename detections/{ => experimental}/application/okta_account_lockout_events.yml (100%) rename detections/{ => experimental}/application/okta_failed_sso_attempts.yml (100%) rename detections/{ => experimental}/application/okta_user_logins_from_multiple_cities.yml (100%) rename detections/{ => experimental}/application/web_servers_executing_suspicious_processes.yml (100%) rename detections/{ => experimental}/cloud/abnormally_high_cloud_instances_destroyed.yml (100%) rename detections/{ => experimental}/cloud/abnormally_high_cloud_instances_launched.yml (100%) rename detections/{ => experimental}/cloud/detect_gcp_storage_access_from_a_new_ip.yml (100%) rename detections/{ => experimental}/cloud/detect_new_open_gcp_storage_buckets.yml (100%) rename detections/{ => experimental}/cloud/detect_s3_access_from_a_new_ip.yml (100%) rename detections/{ => experimental}/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml (100%) rename detections/{ => experimental}/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml (100%) rename detections/{ => experimental}/cloud/detect_spike_in_s3_bucket_deletion.yml (100%) rename detections/{ => experimental}/cloud/high_number_of_login_failures_from_a_single_source.yml (100%) rename detections/{ => experimental}/cloud/new_container_uploaded_to_aws_ecr.yml (100%) rename detections/{ => experimental}/endpoint/detect_rare_executables.yml (100%) rename detections/{ => experimental}/endpoint/unusually_long_command_line___mltk.yml (100%) rename detections/{ => experimental}/endpoint/windows_adfind_exe.yml (100%) rename detections/{ => experimental}/network/detect_ipv6_network_infrastructure_threats.yml (100%) rename detections/{ => experimental}/network/detect_large_outbound_icmp_packets.yml (100%) rename detections/{ => experimental}/network/detect_outbound_smb_traffic.yml (100%) rename detections/{ => experimental}/network/detect_port_security_violation.yml (100%) rename detections/{ => experimental}/network/detect_rogue_dhcp_server.yml (100%) rename detections/{ => experimental}/network/detect_snicat_sni_exfiltration.yml (100%) rename detections/{ => experimental}/network/detect_software_download_to_network_device.yml (100%) rename detections/{ => experimental}/network/detect_traffic_mirroring.yml (100%) rename detections/{ => experimental}/network/detect_unauthorized_assets_by_mac_address.yml (100%) rename detections/{ => experimental}/network/detect_windows_dns_sigred_via_splunk_stream.yml (100%) rename detections/{ => experimental}/network/detect_windows_dns_sigred_via_zeek.yml (100%) rename detections/{ => experimental}/network/detect_zerologon_via_zeek.yml (100%) rename detections/{ => experimental}/network/dns_query_length_outliers___mltk.yml (100%) rename detections/{ => experimental}/network/remote_desktop_network_bruteforce.yml (100%) rename detections/{ => experimental}/network/remote_desktop_network_traffic.yml (100%) rename detections/{ => experimental}/network/smb_traffic_spike.yml (100%) rename detections/{ => experimental}/network/smb_traffic_spike___mltk.yml (100%) rename detections/{ => experimental}/network/unusually_long_content_type_length.yml (100%) diff --git a/detections/web/web_fraud___account_harvesting.yml b/detections/deprecated/web_fraud___account_harvesting.yml similarity index 100% rename from detections/web/web_fraud___account_harvesting.yml rename to detections/deprecated/web_fraud___account_harvesting.yml diff --git a/detections/web/web_fraud___anomalous_user_clickspeed.yml b/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml similarity index 100% rename from detections/web/web_fraud___anomalous_user_clickspeed.yml rename to detections/deprecated/web_fraud___anomalous_user_clickspeed.yml diff --git a/detections/web/web_fraud___password_sharing_across_accounts.yml b/detections/deprecated/web_fraud___password_sharing_across_accounts.yml similarity index 100% rename from detections/web/web_fraud___password_sharing_across_accounts.yml rename to detections/deprecated/web_fraud___password_sharing_across_accounts.yml diff --git a/detections/application/email_files_written_outside_of_the_outlook_directory.yml b/detections/experimental/application/email_files_written_outside_of_the_outlook_directory.yml similarity index 100% rename from detections/application/email_files_written_outside_of_the_outlook_directory.yml rename to detections/experimental/application/email_files_written_outside_of_the_outlook_directory.yml diff --git a/detections/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml b/detections/experimental/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml similarity index 100% rename from detections/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml rename to detections/experimental/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml diff --git a/detections/application/okta_account_lockout_events.yml b/detections/experimental/application/okta_account_lockout_events.yml similarity index 100% rename from detections/application/okta_account_lockout_events.yml rename to detections/experimental/application/okta_account_lockout_events.yml diff --git a/detections/application/okta_failed_sso_attempts.yml b/detections/experimental/application/okta_failed_sso_attempts.yml similarity index 100% rename from detections/application/okta_failed_sso_attempts.yml rename to detections/experimental/application/okta_failed_sso_attempts.yml diff --git a/detections/application/okta_user_logins_from_multiple_cities.yml b/detections/experimental/application/okta_user_logins_from_multiple_cities.yml similarity index 100% rename from detections/application/okta_user_logins_from_multiple_cities.yml rename to detections/experimental/application/okta_user_logins_from_multiple_cities.yml diff --git a/detections/application/web_servers_executing_suspicious_processes.yml b/detections/experimental/application/web_servers_executing_suspicious_processes.yml similarity index 100% rename from detections/application/web_servers_executing_suspicious_processes.yml rename to detections/experimental/application/web_servers_executing_suspicious_processes.yml diff --git a/detections/cloud/abnormally_high_cloud_instances_destroyed.yml b/detections/experimental/cloud/abnormally_high_cloud_instances_destroyed.yml similarity index 100% rename from detections/cloud/abnormally_high_cloud_instances_destroyed.yml rename to detections/experimental/cloud/abnormally_high_cloud_instances_destroyed.yml diff --git a/detections/cloud/abnormally_high_cloud_instances_launched.yml b/detections/experimental/cloud/abnormally_high_cloud_instances_launched.yml similarity index 100% rename from detections/cloud/abnormally_high_cloud_instances_launched.yml rename to detections/experimental/cloud/abnormally_high_cloud_instances_launched.yml diff --git a/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml b/detections/experimental/cloud/detect_gcp_storage_access_from_a_new_ip.yml similarity index 100% rename from detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml rename to detections/experimental/cloud/detect_gcp_storage_access_from_a_new_ip.yml diff --git a/detections/cloud/detect_new_open_gcp_storage_buckets.yml b/detections/experimental/cloud/detect_new_open_gcp_storage_buckets.yml similarity index 100% rename from detections/cloud/detect_new_open_gcp_storage_buckets.yml rename to detections/experimental/cloud/detect_new_open_gcp_storage_buckets.yml diff --git a/detections/cloud/detect_s3_access_from_a_new_ip.yml b/detections/experimental/cloud/detect_s3_access_from_a_new_ip.yml similarity index 100% rename from detections/cloud/detect_s3_access_from_a_new_ip.yml rename to detections/experimental/cloud/detect_s3_access_from_a_new_ip.yml diff --git a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml b/detections/experimental/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml similarity index 100% rename from detections/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml rename to detections/experimental/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml diff --git a/detections/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml b/detections/experimental/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml similarity index 100% rename from detections/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml rename to detections/experimental/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml diff --git a/detections/cloud/detect_spike_in_s3_bucket_deletion.yml b/detections/experimental/cloud/detect_spike_in_s3_bucket_deletion.yml similarity index 100% rename from detections/cloud/detect_spike_in_s3_bucket_deletion.yml rename to detections/experimental/cloud/detect_spike_in_s3_bucket_deletion.yml diff --git a/detections/cloud/high_number_of_login_failures_from_a_single_source.yml b/detections/experimental/cloud/high_number_of_login_failures_from_a_single_source.yml similarity index 100% rename from detections/cloud/high_number_of_login_failures_from_a_single_source.yml rename to detections/experimental/cloud/high_number_of_login_failures_from_a_single_source.yml diff --git a/detections/cloud/new_container_uploaded_to_aws_ecr.yml b/detections/experimental/cloud/new_container_uploaded_to_aws_ecr.yml similarity index 100% rename from detections/cloud/new_container_uploaded_to_aws_ecr.yml rename to detections/experimental/cloud/new_container_uploaded_to_aws_ecr.yml diff --git a/detections/endpoint/detect_rare_executables.yml b/detections/experimental/endpoint/detect_rare_executables.yml similarity index 100% rename from detections/endpoint/detect_rare_executables.yml rename to detections/experimental/endpoint/detect_rare_executables.yml diff --git a/detections/endpoint/unusually_long_command_line___mltk.yml b/detections/experimental/endpoint/unusually_long_command_line___mltk.yml similarity index 100% rename from detections/endpoint/unusually_long_command_line___mltk.yml rename to detections/experimental/endpoint/unusually_long_command_line___mltk.yml diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/experimental/endpoint/windows_adfind_exe.yml similarity index 100% rename from detections/endpoint/windows_adfind_exe.yml rename to detections/experimental/endpoint/windows_adfind_exe.yml diff --git a/detections/network/detect_ipv6_network_infrastructure_threats.yml b/detections/experimental/network/detect_ipv6_network_infrastructure_threats.yml similarity index 100% rename from detections/network/detect_ipv6_network_infrastructure_threats.yml rename to detections/experimental/network/detect_ipv6_network_infrastructure_threats.yml diff --git a/detections/network/detect_large_outbound_icmp_packets.yml b/detections/experimental/network/detect_large_outbound_icmp_packets.yml similarity index 100% rename from detections/network/detect_large_outbound_icmp_packets.yml rename to detections/experimental/network/detect_large_outbound_icmp_packets.yml diff --git a/detections/network/detect_outbound_smb_traffic.yml b/detections/experimental/network/detect_outbound_smb_traffic.yml similarity index 100% rename from detections/network/detect_outbound_smb_traffic.yml rename to detections/experimental/network/detect_outbound_smb_traffic.yml diff --git a/detections/network/detect_port_security_violation.yml b/detections/experimental/network/detect_port_security_violation.yml similarity index 100% rename from detections/network/detect_port_security_violation.yml rename to detections/experimental/network/detect_port_security_violation.yml diff --git a/detections/network/detect_rogue_dhcp_server.yml b/detections/experimental/network/detect_rogue_dhcp_server.yml similarity index 100% rename from detections/network/detect_rogue_dhcp_server.yml rename to detections/experimental/network/detect_rogue_dhcp_server.yml diff --git a/detections/network/detect_snicat_sni_exfiltration.yml b/detections/experimental/network/detect_snicat_sni_exfiltration.yml similarity index 100% rename from detections/network/detect_snicat_sni_exfiltration.yml rename to detections/experimental/network/detect_snicat_sni_exfiltration.yml diff --git a/detections/network/detect_software_download_to_network_device.yml b/detections/experimental/network/detect_software_download_to_network_device.yml similarity index 100% rename from detections/network/detect_software_download_to_network_device.yml rename to detections/experimental/network/detect_software_download_to_network_device.yml diff --git a/detections/network/detect_traffic_mirroring.yml b/detections/experimental/network/detect_traffic_mirroring.yml similarity index 100% rename from detections/network/detect_traffic_mirroring.yml rename to detections/experimental/network/detect_traffic_mirroring.yml diff --git a/detections/network/detect_unauthorized_assets_by_mac_address.yml b/detections/experimental/network/detect_unauthorized_assets_by_mac_address.yml similarity index 100% rename from detections/network/detect_unauthorized_assets_by_mac_address.yml rename to detections/experimental/network/detect_unauthorized_assets_by_mac_address.yml diff --git a/detections/network/detect_windows_dns_sigred_via_splunk_stream.yml b/detections/experimental/network/detect_windows_dns_sigred_via_splunk_stream.yml similarity index 100% rename from detections/network/detect_windows_dns_sigred_via_splunk_stream.yml rename to detections/experimental/network/detect_windows_dns_sigred_via_splunk_stream.yml diff --git a/detections/network/detect_windows_dns_sigred_via_zeek.yml b/detections/experimental/network/detect_windows_dns_sigred_via_zeek.yml similarity index 100% rename from detections/network/detect_windows_dns_sigred_via_zeek.yml rename to detections/experimental/network/detect_windows_dns_sigred_via_zeek.yml diff --git a/detections/network/detect_zerologon_via_zeek.yml b/detections/experimental/network/detect_zerologon_via_zeek.yml similarity index 100% rename from detections/network/detect_zerologon_via_zeek.yml rename to detections/experimental/network/detect_zerologon_via_zeek.yml diff --git a/detections/network/dns_query_length_outliers___mltk.yml b/detections/experimental/network/dns_query_length_outliers___mltk.yml similarity index 100% rename from detections/network/dns_query_length_outliers___mltk.yml rename to detections/experimental/network/dns_query_length_outliers___mltk.yml diff --git a/detections/network/remote_desktop_network_bruteforce.yml b/detections/experimental/network/remote_desktop_network_bruteforce.yml similarity index 100% rename from detections/network/remote_desktop_network_bruteforce.yml rename to detections/experimental/network/remote_desktop_network_bruteforce.yml diff --git a/detections/network/remote_desktop_network_traffic.yml b/detections/experimental/network/remote_desktop_network_traffic.yml similarity index 100% rename from detections/network/remote_desktop_network_traffic.yml rename to detections/experimental/network/remote_desktop_network_traffic.yml diff --git a/detections/network/smb_traffic_spike.yml b/detections/experimental/network/smb_traffic_spike.yml similarity index 100% rename from detections/network/smb_traffic_spike.yml rename to detections/experimental/network/smb_traffic_spike.yml diff --git a/detections/network/smb_traffic_spike___mltk.yml b/detections/experimental/network/smb_traffic_spike___mltk.yml similarity index 100% rename from detections/network/smb_traffic_spike___mltk.yml rename to detections/experimental/network/smb_traffic_spike___mltk.yml diff --git a/detections/network/unusually_long_content_type_length.yml b/detections/experimental/network/unusually_long_content_type_length.yml similarity index 100% rename from detections/network/unusually_long_content_type_length.yml rename to detections/experimental/network/unusually_long_content_type_length.yml