From 443d86c864ebcb2bfc6102a15ec76c6c5b34a0f4 Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 7 Oct 2020 10:31:25 -0400 Subject: [PATCH 1/6] moved detections to their respective folders --- .../{ => application}/detect_new_login_attempts_to_routers.yml | 0 detections/{ => application}/detect_phishing_content___ssa.yml | 0 .../{ => application}/email_attachments_with_lots_of_spaces.yml | 0 .../email_files_written_outside_of_the_outlook_directory.yml | 0 .../email_servers_sending_high_volume_traffic_to_hosts.yml | 0 detections/{ => application}/identify_new_user_accounts.yml | 0 detections/{ => application}/monitor_email_for_brand_abuse.yml | 0 ...tiple_okta_users_with_invalid_credentails_from_the_same_ip.yml | 0 .../{ => application}/no_windows_updates_in_a_time_frame.yml | 0 detections/{ => application}/okta_account_lockout_events.yml | 0 detections/{ => application}/okta_failed_sso_attempts.yml | 0 .../{ => application}/okta_user_logins_from_multiple_cities.yml | 0 detections/{ => application}/open_redirect_in_splunk_web.yml | 0 .../{ => application}/spectre_and_meltdown_vulnerable_systems.yml | 0 .../splunk_enterprise_information_disclosure.yml | 0 detections/{ => application}/suspicious_email___uba_anomaly.yml | 0 .../{ => application}/suspicious_email_attachment_extensions.yml | 0 .../abnormally_high_aws_instances_launched_by_user.yml | 0 .../abnormally_high_aws_instances_launched_by_user___mltk.yml | 0 .../abnormally_high_aws_instances_terminated_by_user.yml | 0 .../abnormally_high_aws_instances_terminated_by_user___mltk.yml | 0 .../{ => cloud}/amazon_eks_kubernetes_cluster_scan_detection.yml | 0 .../{ => cloud}/amazon_eks_kubernetes_pod_scan_detection.yml | 0 .../aws_cloud_provisioning_from_previously_unseen_city.yml | 0 .../aws_cloud_provisioning_from_previously_unseen_country.yml | 0 .../aws_cloud_provisioning_from_previously_unseen_ip_address.yml | 0 .../aws_cloud_provisioning_from_previously_unseen_region.yml | 0 .../aws_cross_account_activity_from_previously_unseen_account.yml | 0 detections/{ => cloud}/aws_detect_attach_to_role_policy.yml | 0 detections/{ => cloud}/aws_detect_permanent_key_creation.yml | 0 detections/{ => cloud}/aws_detect_role_creation.yml | 0 detections/{ => cloud}/aws_detect_sts_assume_role_abuse.yml | 0 detections/{ => cloud}/aws_detect_sts_get_session_token_abuse.yml | 0 ...ws_network_access_control_list_created_with_all_open_ports.yml | 0 .../{ => cloud}/aws_network_access_control_list_deleted.yml | 0 .../cloud_compute_instance_created_by_previously_unseen_user.yml | 0 ...loud_compute_instance_created_with_previously_unseen_image.yml | 0 ...pute_instance_created_with_previously_unseen_instance_type.yml | 0 ...cloud_compute_instance_started_in_previously_unused_region.yml | 0 .../{ => cloud}/detect_api_activity_from_users_without_mfa.yml | 0 .../detect_aws_api_activities_from_unapproved_accounts.yml | 0 .../detect_aws_console_login_by_user_from_new_city.yml | 0 .../detect_aws_console_login_by_user_from_new_country.yml | 0 .../detect_aws_console_login_by_user_from_new_region.yml | 0 .../{ => cloud}/detect_gcp_storage_access_from_a_new_ip.yml | 0 detections/{ => cloud}/detect_new_api_calls_from_user_roles.yml | 0 detections/{ => cloud}/detect_new_open_gcp_storage_buckets.yml | 0 detections/{ => cloud}/detect_new_open_s3_buckets.yml | 0 detections/{ => cloud}/detect_new_user_aws_console_login.yml | 0 detections/{ => cloud}/detect_new_user_aws_console_login___dm.yml | 0 detections/{ => cloud}/detect_s3_access_from_a_new_ip.yml | 0 detections/{ => cloud}/detect_spike_in_aws_api_activity.yml | 0 .../detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml | 0 .../detect_spike_in_blocked_outbound_traffic_from_your_aws.yml | 0 detections/{ => cloud}/detect_spike_in_network_acl_activity.yml | 0 detections/{ => cloud}/detect_spike_in_s3_bucket_deletion.yml | 0 .../{ => cloud}/detect_spike_in_security_group_activity.yml | 0 .../{ => cloud}/detect_spike_in_security_hub_alerts_for_user.yml | 0 .../ec2_instance_modified_with_previously_unseen_user.yml | 0 .../ec2_instance_started_in_previously_unseen_region.yml | 0 .../ec2_instance_started_with_previously_unseen_ami.yml | 0 .../ec2_instance_started_with_previously_unseen_instance_type.yml | 0 .../ec2_instance_started_with_previously_unseen_user.yml | 0 detections/{ => cloud}/gcp_detect_oauth_token_abuse.yml | 0 detections/{ => cloud}/gcp_gcr_container_uploaded.yml | 0 .../{ => cloud}/gcp_kubernetes_cluster_pod_scan_detection.yml | 0 detections/{ => cloud}/gcp_kubernetes_cluster_scan_detection.yml | 0 .../kubernetes_aws_detect_most_active_service_accounts_by_pod.yml | 0 .../kubernetes_aws_detect_rbac_authorizations_by_account.yml | 0 .../{ => cloud}/kubernetes_aws_detect_sensitive_object_access.yml | 0 .../{ => cloud}/kubernetes_aws_detect_sensitive_role_access.yml | 0 ...netes_aws_detect_service_accounts_forbidden_failure_access.yml | 0 .../kubernetes_aws_detect_suspicious_kubectl_calls.yml | 0 ...azure_detect_most_active_service_accounts_by_pod_namespace.yml | 0 .../kubernetes_azure_detect_rbac_authorization_by_account.yml | 0 .../kubernetes_azure_detect_sensitive_object_access.yml | 0 .../{ => cloud}/kubernetes_azure_detect_sensitive_role_access.yml | 0 ...tes_azure_detect_service_accounts_forbidden_failure_access.yml | 0 .../kubernetes_azure_detect_suspicious_kubectl_calls.yml | 0 detections/{ => cloud}/kubernetes_azure_pod_scan_fingerprint.yml | 0 detections/{ => cloud}/kubernetes_azure_scan_fingerprint.yml | 0 .../kubernetes_gcp_detect_RBAC_authorizations_by_account.yml | 0 .../kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml | 0 .../{ => cloud}/kubernetes_gcp_detect_sensitive_object_access.yml | 0 .../{ => cloud}/kubernetes_gcp_detect_sensitive_role_access.yml | 0 ...netes_gcp_detect_service_accounts_forbidden_failure_access.yml | 0 .../kubernetes_gcp_detect_suspicious_kubectl_calls.yml | 0 detections/{ => cloud}/new_container_uploaded_to_aws_ecr.yml | 0 .../{ => endpoint}/access_lsass_memory_for_dump_creation.yml | 0 .../attempt_to_add_certificate_to_untrusted_store.yml | 0 ...ault_powershell_execution_policy_to_unrestricted_or_bypass.yml | 0 detections/{ => endpoint}/attempt_to_stop_security_service.yml | 0 .../attempted_credential_dump_from_registry_via_reg_exe.yml | 0 .../attempted_credential_dump_from_registry_via_reg_exe___ssa.yml | 0 detections/{ => endpoint}/batch_file_write_to_system32.yml | 0 detections/{ => endpoint}/child_processes_of_spoolsv_exe.yml | 0 detections/{ => endpoint}/common_ransomware_extensions.yml | 0 detections/{ => endpoint}/common_ransomware_notes.yml | 0 .../{ => endpoint}/create_local_admin_accounts_using_net_exe.yml | 0 .../create_or_delete_windows_shares_using_net_exe.yml | 0 detections/{ => endpoint}/create_remote_thread_into_lsass.yml | 0 detections/{ => endpoint}/creation_of_shadow_copy.yml | 0 .../creation_of_shadow_copy_with_wmic_and_powershell.yml | 0 .../credential_dumping_via_copy_command_from_shadow_copy.yml | 0 .../credential_dumping_via_symlink_to_shadow_copy.yml | 0 detections/{ => endpoint}/deleting_shadow_copies.yml | 0 .../detect_activity_related_to_pass_the_hash_attacks.yml | 0 .../detect_computer_changed_with_anonymous_account.yml | 0 .../detect_credential_dumping_through_lsass_access.yml | 0 .../detect_dump_lsass_memory_using_comsvcs___ssa.yml | 0 .../detect_excessive_account_lockouts_from_endpoint.yml | 0 .../{ => endpoint}/detect_excessive_user_account_lockouts.yml | 0 detections/{ => endpoint}/detect_mimikatz_using_loaded_images.yml | 0 .../detect_mimikatz_via_powershell_and_eventcode_4703.yml | 0 ...detect_mshta_exe_running_scripts_in_command_line_arguments.yml | 0 detections/{ => endpoint}/detect_new_local_admin_account.yml | 0 .../{ => endpoint}/detect_oulook_exe_writing_a__zip_file.yml | 0 .../detect_path_interception_by_creation_of_program_exe.yml | 0 ..._processes_used_for_system_network_configuration_discovery.yml | 0 .../detect_prohibited_applications_spawning_cmd_exe.yml | 0 detections/{ => endpoint}/detect_psexec_with_accepteula_flag.yml | 0 detections/{ => endpoint}/detect_rare_executables.yml | 0 detections/{ => endpoint}/detect_usb_device_insertion.yml | 0 .../detect_use_of_cmd_exe_to_launch_script_interpreters.yml | 0 .../detect_windows_dns_sigred_via_splunk_stream.yml | 0 detections/{ => endpoint}/detect_windows_dns_sigred_via_zeek.yml | 0 detections/{ => endpoint}/detection_of_tools_built_by_nirsoft.yml | 0 .../{ => endpoint}/disabling_remote_user_account_control.yml | 0 detections/{ => endpoint}/dump_lsass_via_comsvcs_dll.yml | 0 .../{ => endpoint}/execution_of_file_with_multiple_extensions.yml | 0 .../execution_of_file_with_spaces_before_extension.yml | 0 .../extended_period_without_successful_netbackup_backups.yml | 0 detections/{ => endpoint}/file_with_samsam_extension.yml | 0 .../{ => endpoint}/first_time_seen_child_process_of_zoom.yml | 0 detections/{ => endpoint}/first_time_seen_cmd_line___ssa.yml | 0 .../{ => endpoint}/first_time_seen_command_line_argument.yml | 0 .../{ => endpoint}/first_time_seen_running_windows_service.yml | 0 .../hiding_files_and_directories_with_attrib_exe.yml | 0 .../kerberoasting_spn_request_with_rc4_encryption.yml | 0 detections/{ => endpoint}/macos___re_opened_applications.yml | 0 ...owershell_process___connect_to_internet_with_hidden_window.yml | 0 .../malicious_powershell_process___encoded_command.yml | 0 .../malicious_powershell_process___execution_policy_bypass.yml | 0 ...shell_process___multiple_suspicious_command_line_arguments.yml | 0 .../malicious_powershell_process_with_obfuscation_techniques.yml | 0 .../{ => endpoint}/monitor_registry_keys_for_print_monitors.yml | 0 detections/{ => endpoint}/osquery_pack___coldroot_detection.yml | 0 detections/{ => endpoint}/overwriting_accessibility_binaries.yml | 0 detections/{ => endpoint}/process_execution_via_wmi.yml | 0 detections/{ => endpoint}/processes_created_by_netsh.yml | 0 detections/{ => endpoint}/processes_launching_netsh.yml | 0 detections/{ => endpoint}/processes_tapping_keyboard_events.yml | 0 .../{ => endpoint}/prohibited_apps_spawning_cmdprompt___ssa.yml | 0 detections/{ => endpoint}/prohibited_software_on_endpoint.yml | 0 .../rare_parent_process_relationship_lolbas___ssa.yaml | 0 .../reg_exe_manipulating_windows_services_registry_keys.yml | 0 .../reg_exe_used_to_hide_files_directories_via_registry_keys.yml | 0 .../{ => endpoint}/registry_keys_for_creating_shim_databases.yml | 0 detections/{ => endpoint}/registry_keys_used_for_persistence.yml | 0 .../registry_keys_used_for_privilege_escalation.yml | 0 .../{ => endpoint}/remote_desktop_process_running_on_system.yml | 0 .../{ => endpoint}/remote_process_instantiation_via_wmi.yml | 0 detections/{ => endpoint}/remote_registry_key_modifications.yml | 0 detections/{ => endpoint}/remote_wmi_command_attempt.yml | 0 detections/{ => endpoint}/rundll_loading_dll_by_ordinal.yml | 0 detections/{ => endpoint}/samsam_test_file_write.yml | 0 .../{ => endpoint}/sc_exe_manipulating_windows_services.yml | 0 .../scheduled_task_name_used_by_dragonfly_threat_actors.yml | 0 .../scheduled_tasks_used_in_badrabbit_ransomware.yml | 0 .../{ => endpoint}/schtasks_scheduling_job_on_remote_system.yml | 0 detections/{ => endpoint}/schtasks_used_for_forcing_a_reboot.yml | 0 detections/{ => endpoint}/script_execution_via_wmi.yml | 0 detections/{ => endpoint}/shim_database_file_creation.yml | 0 .../shim_database_installation_with_suspicious_parameters.yml | 0 detections/{ => endpoint}/short_lived_windows_accounts.yml | 0 detections/{ => endpoint}/single_letter_process_on_endpoint.yml | 0 detections/{ => endpoint}/spike_in_file_writes.yml | 0 .../{ => endpoint}/suspicious_changes_to_file_associations.yml | 0 detections/{ => endpoint}/suspicious_file_write.yml | 0 detections/{ => endpoint}/suspicious_java_classes.yml | 0 .../{ => endpoint}/suspicious_lnk_file_launching_a_process.yml | 0 detections/{ => endpoint}/suspicious_reg_exe_process.yml | 0 detections/{ => endpoint}/suspicious_wevtutil_usage.yml | 0 .../suspicious_writes_to_system_volume_information.yml | 0 .../{ => endpoint}/suspicious_writes_to_windows_recycle_bin.yml | 0 .../system_process_running_unexpected_location___ssa.yml | 0 .../system_processes_run_from_unexpected_locations.yml | 0 detections/{ => endpoint}/uncommon_processes_on_endpoint.yml | 0 detections/{ => endpoint}/unload_sysmon_filter_driver.yml | 0 detections/{ => endpoint}/unsigned_image_loaded_by_lsass.yml | 0 detections/{ => endpoint}/unsuccessful_netbackup_backups.yml | 0 .../unusual_lolbas_in_short_period_of_time___ssa.yml | 0 detections/{ => endpoint}/unusually_long_command_line.yml | 0 detections/{ => endpoint}/unusually_long_command_line___mltk.yml | 0 detections/{ => endpoint}/unusually_long_command_line___ssa.yml | 0 detections/{ => endpoint}/unusually_long_content_type_length.yml | 0 detections/{ => endpoint}/usn_journal_deletion.yml | 0 .../{ => endpoint}/web_servers_executing_suspicious_processes.yml | 0 detections/{ => endpoint}/windows_event_log_cleared.yml | 0 detections/{ => endpoint}/windows_hosts_file_modification.yml | 0 detections/{ => endpoint}/wmi_permanent_event_subscription.yml | 0 .../{ => endpoint}/wmi_permanent_event_subscription___sysmon.yml | 0 detections/{ => endpoint}/wmi_temporary_event_subscription.yml | 0 .../{ => network}/clients_connecting_to_multiple_dns_servers.yml | 0 detections/{ => network}/detect_arp_poisoning.yml | 0 ...detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml | 0 .../detect_hosts_connecting_to_dynamic_domain_providers.yml | 0 detections/{ => network}/detect_large_outbound_icmp_packets.yml | 0 detections/{ => network}/detect_long_dns_txt_record_response.yml | 0 detections/{ => network}/detect_outbound_smb_traffic.yml | 0 detections/{ => network}/detect_rogue_dhcp_server.yml | 0 .../{ => network}/detect_unauthorized_assets_by_mac_address.yml | 0 detections/{ => network}/detect_zerologon_via_zeek.yml | 0 detections/{ => network}/detection_of_dns_tunnels.yml | 0 detections/{ => network}/dns_query_length_outliers___mltk.yml | 0 .../dns_query_length_with_high_standard_deviation.yml | 0 .../dns_query_requests_resolved_by_unauthorized_dns_servers.yml | 0 detections/{ => network}/dns_record_changed.yml | 0 detections/{ => network}/excessive_dns_failures.yml | 0 ...receiving_high_volume_of_network_traffic_from_email_server.yml | 0 detections/{ => network}/large_volume_of_dns_any_queries.yml | 0 detections/{ => network}/monitor_dns_for_brand_abuse.yml | 0 detections/{ => network}/prohibited_network_traffic_allowed.yml | 0 detections/{ => network}/protocol_or_port_mismatch.yml | 0 .../protocols_passing_authentication_in_cleartext.yml | 0 detections/{ => network}/remote_desktop_network_bruteforce.yml | 0 detections/{ => network}/remote_desktop_network_traffic.yml | 0 detections/{ => network}/smb_traffic_spike.yml | 0 detections/{ => network}/smb_traffic_spike___mltk.yml | 0 detections/{ => network}/tor_traffic.yml | 0 .../detect_attackers_scanning_for_vulnerable_jboss_servers.yml | 0 detections/{ => web}/detect_f5_tmui_rct_cve_2020_5902.yml | 0 .../detect_malicious_requests_to_exploit_jboss_servers.yml | 0 .../{ => web}/detect_web_traffic_to_dynamic_domain_providers.yml | 0 detections/{ => web}/monitor_web_traffic_for_brand_abuse.yml | 0 detections/{ => web}/sql_injection_with_long_urls.yml | 0 detections/{ => web}/web_fraud___account_harvesting.yml | 0 detections/{ => web}/web_fraud___anomalous_user_clickspeed.yml | 0 .../{ => web}/web_fraud___password_sharing_across_accounts.yml | 0 239 files changed, 0 insertions(+), 0 deletions(-) rename detections/{ => application}/detect_new_login_attempts_to_routers.yml (100%) rename detections/{ => application}/detect_phishing_content___ssa.yml (100%) rename detections/{ => application}/email_attachments_with_lots_of_spaces.yml (100%) rename detections/{ => application}/email_files_written_outside_of_the_outlook_directory.yml (100%) rename detections/{ => application}/email_servers_sending_high_volume_traffic_to_hosts.yml (100%) rename detections/{ => application}/identify_new_user_accounts.yml (100%) rename detections/{ => application}/monitor_email_for_brand_abuse.yml (100%) rename detections/{ => application}/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml (100%) rename detections/{ => application}/no_windows_updates_in_a_time_frame.yml (100%) rename detections/{ => application}/okta_account_lockout_events.yml (100%) rename detections/{ => application}/okta_failed_sso_attempts.yml (100%) rename detections/{ => application}/okta_user_logins_from_multiple_cities.yml (100%) rename detections/{ => application}/open_redirect_in_splunk_web.yml (100%) rename detections/{ => application}/spectre_and_meltdown_vulnerable_systems.yml (100%) rename detections/{ => application}/splunk_enterprise_information_disclosure.yml (100%) rename detections/{ => application}/suspicious_email___uba_anomaly.yml (100%) rename detections/{ => application}/suspicious_email_attachment_extensions.yml (100%) rename detections/{ => cloud}/abnormally_high_aws_instances_launched_by_user.yml (100%) rename detections/{ => cloud}/abnormally_high_aws_instances_launched_by_user___mltk.yml (100%) rename detections/{ => cloud}/abnormally_high_aws_instances_terminated_by_user.yml (100%) rename detections/{ => cloud}/abnormally_high_aws_instances_terminated_by_user___mltk.yml (100%) rename detections/{ => cloud}/amazon_eks_kubernetes_cluster_scan_detection.yml (100%) rename detections/{ => cloud}/amazon_eks_kubernetes_pod_scan_detection.yml (100%) rename detections/{ => cloud}/aws_cloud_provisioning_from_previously_unseen_city.yml (100%) rename detections/{ => cloud}/aws_cloud_provisioning_from_previously_unseen_country.yml (100%) rename detections/{ => cloud}/aws_cloud_provisioning_from_previously_unseen_ip_address.yml (100%) rename detections/{ => cloud}/aws_cloud_provisioning_from_previously_unseen_region.yml (100%) rename detections/{ => cloud}/aws_cross_account_activity_from_previously_unseen_account.yml (100%) rename detections/{ => cloud}/aws_detect_attach_to_role_policy.yml (100%) rename detections/{ => cloud}/aws_detect_permanent_key_creation.yml (100%) rename detections/{ => cloud}/aws_detect_role_creation.yml (100%) rename detections/{ => cloud}/aws_detect_sts_assume_role_abuse.yml (100%) rename detections/{ => cloud}/aws_detect_sts_get_session_token_abuse.yml (100%) rename detections/{ => cloud}/aws_network_access_control_list_created_with_all_open_ports.yml (100%) rename detections/{ => cloud}/aws_network_access_control_list_deleted.yml (100%) rename detections/{ => cloud}/cloud_compute_instance_created_by_previously_unseen_user.yml (100%) rename detections/{ => cloud}/cloud_compute_instance_created_with_previously_unseen_image.yml (100%) rename detections/{ => cloud}/cloud_compute_instance_created_with_previously_unseen_instance_type.yml (100%) rename detections/{ => cloud}/cloud_compute_instance_started_in_previously_unused_region.yml (100%) rename detections/{ => cloud}/detect_api_activity_from_users_without_mfa.yml (100%) rename detections/{ => cloud}/detect_aws_api_activities_from_unapproved_accounts.yml (100%) rename detections/{ => cloud}/detect_aws_console_login_by_user_from_new_city.yml (100%) rename detections/{ => cloud}/detect_aws_console_login_by_user_from_new_country.yml (100%) rename detections/{ => cloud}/detect_aws_console_login_by_user_from_new_region.yml (100%) rename detections/{ => cloud}/detect_gcp_storage_access_from_a_new_ip.yml (100%) rename detections/{ => cloud}/detect_new_api_calls_from_user_roles.yml (100%) rename detections/{ => cloud}/detect_new_open_gcp_storage_buckets.yml (100%) rename detections/{ => cloud}/detect_new_open_s3_buckets.yml (100%) rename detections/{ => cloud}/detect_new_user_aws_console_login.yml (100%) rename detections/{ => cloud}/detect_new_user_aws_console_login___dm.yml (100%) rename detections/{ => cloud}/detect_s3_access_from_a_new_ip.yml (100%) rename detections/{ => cloud}/detect_spike_in_aws_api_activity.yml (100%) rename detections/{ => cloud}/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml (100%) rename detections/{ => cloud}/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml (100%) rename detections/{ => cloud}/detect_spike_in_network_acl_activity.yml (100%) rename detections/{ => cloud}/detect_spike_in_s3_bucket_deletion.yml (100%) rename detections/{ => cloud}/detect_spike_in_security_group_activity.yml (100%) rename detections/{ => cloud}/detect_spike_in_security_hub_alerts_for_user.yml (100%) rename detections/{ => cloud}/ec2_instance_modified_with_previously_unseen_user.yml (100%) rename detections/{ => cloud}/ec2_instance_started_in_previously_unseen_region.yml (100%) rename detections/{ => cloud}/ec2_instance_started_with_previously_unseen_ami.yml (100%) rename detections/{ => cloud}/ec2_instance_started_with_previously_unseen_instance_type.yml (100%) rename detections/{ => cloud}/ec2_instance_started_with_previously_unseen_user.yml (100%) rename detections/{ => cloud}/gcp_detect_oauth_token_abuse.yml (100%) rename detections/{ => cloud}/gcp_gcr_container_uploaded.yml (100%) rename detections/{ => cloud}/gcp_kubernetes_cluster_pod_scan_detection.yml (100%) rename detections/{ => cloud}/gcp_kubernetes_cluster_scan_detection.yml (100%) rename detections/{ => cloud}/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml (100%) rename detections/{ => cloud}/kubernetes_aws_detect_rbac_authorizations_by_account.yml (100%) rename detections/{ => cloud}/kubernetes_aws_detect_sensitive_object_access.yml (100%) rename detections/{ => cloud}/kubernetes_aws_detect_sensitive_role_access.yml (100%) rename detections/{ => cloud}/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml (100%) rename detections/{ => cloud}/kubernetes_aws_detect_suspicious_kubectl_calls.yml (100%) rename detections/{ => cloud}/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml (100%) rename detections/{ => cloud}/kubernetes_azure_detect_rbac_authorization_by_account.yml (100%) rename detections/{ => cloud}/kubernetes_azure_detect_sensitive_object_access.yml (100%) rename detections/{ => cloud}/kubernetes_azure_detect_sensitive_role_access.yml (100%) rename detections/{ => cloud}/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml (100%) rename detections/{ => cloud}/kubernetes_azure_detect_suspicious_kubectl_calls.yml (100%) rename detections/{ => cloud}/kubernetes_azure_pod_scan_fingerprint.yml (100%) rename detections/{ => cloud}/kubernetes_azure_scan_fingerprint.yml (100%) rename detections/{ => cloud}/kubernetes_gcp_detect_RBAC_authorizations_by_account.yml (100%) rename detections/{ => cloud}/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml (100%) rename detections/{ => cloud}/kubernetes_gcp_detect_sensitive_object_access.yml (100%) rename detections/{ => cloud}/kubernetes_gcp_detect_sensitive_role_access.yml (100%) rename detections/{ => cloud}/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml (100%) rename detections/{ => cloud}/kubernetes_gcp_detect_suspicious_kubectl_calls.yml (100%) rename detections/{ => cloud}/new_container_uploaded_to_aws_ecr.yml (100%) rename detections/{ => endpoint}/access_lsass_memory_for_dump_creation.yml (100%) rename detections/{ => endpoint}/attempt_to_add_certificate_to_untrusted_store.yml (100%) rename detections/{ => endpoint}/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml (100%) rename detections/{ => endpoint}/attempt_to_stop_security_service.yml (100%) rename detections/{ => endpoint}/attempted_credential_dump_from_registry_via_reg_exe.yml (100%) rename detections/{ => endpoint}/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml (100%) rename detections/{ => endpoint}/batch_file_write_to_system32.yml (100%) rename detections/{ => endpoint}/child_processes_of_spoolsv_exe.yml (100%) rename detections/{ => endpoint}/common_ransomware_extensions.yml (100%) rename detections/{ => endpoint}/common_ransomware_notes.yml (100%) rename detections/{ => endpoint}/create_local_admin_accounts_using_net_exe.yml (100%) rename detections/{ => endpoint}/create_or_delete_windows_shares_using_net_exe.yml (100%) rename detections/{ => endpoint}/create_remote_thread_into_lsass.yml (100%) rename detections/{ => endpoint}/creation_of_shadow_copy.yml (100%) rename detections/{ => endpoint}/creation_of_shadow_copy_with_wmic_and_powershell.yml (100%) rename detections/{ => endpoint}/credential_dumping_via_copy_command_from_shadow_copy.yml (100%) rename detections/{ => endpoint}/credential_dumping_via_symlink_to_shadow_copy.yml (100%) rename detections/{ => endpoint}/deleting_shadow_copies.yml (100%) rename detections/{ => endpoint}/detect_activity_related_to_pass_the_hash_attacks.yml (100%) rename detections/{ => endpoint}/detect_computer_changed_with_anonymous_account.yml (100%) rename detections/{ => endpoint}/detect_credential_dumping_through_lsass_access.yml (100%) rename detections/{ => endpoint}/detect_dump_lsass_memory_using_comsvcs___ssa.yml (100%) rename detections/{ => endpoint}/detect_excessive_account_lockouts_from_endpoint.yml (100%) rename detections/{ => endpoint}/detect_excessive_user_account_lockouts.yml (100%) rename detections/{ => endpoint}/detect_mimikatz_using_loaded_images.yml (100%) rename detections/{ => endpoint}/detect_mimikatz_via_powershell_and_eventcode_4703.yml (100%) rename detections/{ => endpoint}/detect_mshta_exe_running_scripts_in_command_line_arguments.yml (100%) rename detections/{ => endpoint}/detect_new_local_admin_account.yml (100%) rename detections/{ => endpoint}/detect_oulook_exe_writing_a__zip_file.yml (100%) rename detections/{ => endpoint}/detect_path_interception_by_creation_of_program_exe.yml (100%) rename detections/{ => endpoint}/detect_processes_used_for_system_network_configuration_discovery.yml (100%) rename detections/{ => endpoint}/detect_prohibited_applications_spawning_cmd_exe.yml (100%) rename detections/{ => endpoint}/detect_psexec_with_accepteula_flag.yml (100%) rename detections/{ => endpoint}/detect_rare_executables.yml (100%) rename detections/{ => endpoint}/detect_usb_device_insertion.yml (100%) rename detections/{ => endpoint}/detect_use_of_cmd_exe_to_launch_script_interpreters.yml (100%) rename detections/{ => endpoint}/detect_windows_dns_sigred_via_splunk_stream.yml (100%) rename detections/{ => endpoint}/detect_windows_dns_sigred_via_zeek.yml (100%) rename detections/{ => endpoint}/detection_of_tools_built_by_nirsoft.yml (100%) rename detections/{ => endpoint}/disabling_remote_user_account_control.yml (100%) rename detections/{ => endpoint}/dump_lsass_via_comsvcs_dll.yml (100%) rename detections/{ => endpoint}/execution_of_file_with_multiple_extensions.yml (100%) rename detections/{ => endpoint}/execution_of_file_with_spaces_before_extension.yml (100%) rename detections/{ => endpoint}/extended_period_without_successful_netbackup_backups.yml (100%) rename detections/{ => endpoint}/file_with_samsam_extension.yml (100%) rename detections/{ => endpoint}/first_time_seen_child_process_of_zoom.yml (100%) rename detections/{ => endpoint}/first_time_seen_cmd_line___ssa.yml (100%) rename detections/{ => endpoint}/first_time_seen_command_line_argument.yml (100%) rename detections/{ => endpoint}/first_time_seen_running_windows_service.yml (100%) rename detections/{ => endpoint}/hiding_files_and_directories_with_attrib_exe.yml (100%) rename detections/{ => endpoint}/kerberoasting_spn_request_with_rc4_encryption.yml (100%) rename detections/{ => endpoint}/macos___re_opened_applications.yml (100%) rename detections/{ => endpoint}/malicious_powershell_process___connect_to_internet_with_hidden_window.yml (100%) rename detections/{ => endpoint}/malicious_powershell_process___encoded_command.yml (100%) rename detections/{ => endpoint}/malicious_powershell_process___execution_policy_bypass.yml (100%) rename detections/{ => endpoint}/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml (100%) rename detections/{ => endpoint}/malicious_powershell_process_with_obfuscation_techniques.yml (100%) rename detections/{ => endpoint}/monitor_registry_keys_for_print_monitors.yml (100%) rename detections/{ => endpoint}/osquery_pack___coldroot_detection.yml (100%) rename detections/{ => endpoint}/overwriting_accessibility_binaries.yml (100%) rename detections/{ => endpoint}/process_execution_via_wmi.yml (100%) rename detections/{ => endpoint}/processes_created_by_netsh.yml (100%) rename detections/{ => endpoint}/processes_launching_netsh.yml (100%) rename detections/{ => endpoint}/processes_tapping_keyboard_events.yml (100%) rename detections/{ => endpoint}/prohibited_apps_spawning_cmdprompt___ssa.yml (100%) rename detections/{ => endpoint}/prohibited_software_on_endpoint.yml (100%) rename detections/{ => endpoint}/rare_parent_process_relationship_lolbas___ssa.yaml (100%) rename detections/{ => endpoint}/reg_exe_manipulating_windows_services_registry_keys.yml (100%) rename detections/{ => endpoint}/reg_exe_used_to_hide_files_directories_via_registry_keys.yml (100%) rename detections/{ => endpoint}/registry_keys_for_creating_shim_databases.yml (100%) rename detections/{ => endpoint}/registry_keys_used_for_persistence.yml (100%) rename detections/{ => endpoint}/registry_keys_used_for_privilege_escalation.yml (100%) rename detections/{ => endpoint}/remote_desktop_process_running_on_system.yml (100%) rename detections/{ => endpoint}/remote_process_instantiation_via_wmi.yml (100%) rename detections/{ => endpoint}/remote_registry_key_modifications.yml (100%) rename detections/{ => endpoint}/remote_wmi_command_attempt.yml (100%) rename detections/{ => endpoint}/rundll_loading_dll_by_ordinal.yml (100%) rename detections/{ => endpoint}/samsam_test_file_write.yml (100%) rename detections/{ => endpoint}/sc_exe_manipulating_windows_services.yml (100%) rename detections/{ => endpoint}/scheduled_task_name_used_by_dragonfly_threat_actors.yml (100%) rename detections/{ => endpoint}/scheduled_tasks_used_in_badrabbit_ransomware.yml (100%) rename detections/{ => endpoint}/schtasks_scheduling_job_on_remote_system.yml (100%) rename detections/{ => endpoint}/schtasks_used_for_forcing_a_reboot.yml (100%) rename detections/{ => endpoint}/script_execution_via_wmi.yml (100%) rename detections/{ => endpoint}/shim_database_file_creation.yml (100%) rename detections/{ => endpoint}/shim_database_installation_with_suspicious_parameters.yml (100%) rename detections/{ => endpoint}/short_lived_windows_accounts.yml (100%) rename detections/{ => endpoint}/single_letter_process_on_endpoint.yml (100%) rename detections/{ => endpoint}/spike_in_file_writes.yml (100%) rename detections/{ => endpoint}/suspicious_changes_to_file_associations.yml (100%) rename detections/{ => endpoint}/suspicious_file_write.yml (100%) rename detections/{ => endpoint}/suspicious_java_classes.yml (100%) rename detections/{ => endpoint}/suspicious_lnk_file_launching_a_process.yml (100%) rename detections/{ => endpoint}/suspicious_reg_exe_process.yml (100%) rename detections/{ => endpoint}/suspicious_wevtutil_usage.yml (100%) rename detections/{ => endpoint}/suspicious_writes_to_system_volume_information.yml (100%) rename detections/{ => endpoint}/suspicious_writes_to_windows_recycle_bin.yml (100%) rename detections/{ => endpoint}/system_process_running_unexpected_location___ssa.yml (100%) rename detections/{ => endpoint}/system_processes_run_from_unexpected_locations.yml (100%) rename detections/{ => endpoint}/uncommon_processes_on_endpoint.yml (100%) rename detections/{ => endpoint}/unload_sysmon_filter_driver.yml (100%) rename detections/{ => endpoint}/unsigned_image_loaded_by_lsass.yml (100%) rename detections/{ => endpoint}/unsuccessful_netbackup_backups.yml (100%) rename detections/{ => endpoint}/unusual_lolbas_in_short_period_of_time___ssa.yml (100%) rename detections/{ => endpoint}/unusually_long_command_line.yml (100%) rename detections/{ => endpoint}/unusually_long_command_line___mltk.yml (100%) rename detections/{ => endpoint}/unusually_long_command_line___ssa.yml (100%) rename detections/{ => endpoint}/unusually_long_content_type_length.yml (100%) rename detections/{ => endpoint}/usn_journal_deletion.yml (100%) rename detections/{ => endpoint}/web_servers_executing_suspicious_processes.yml (100%) rename detections/{ => endpoint}/windows_event_log_cleared.yml (100%) rename detections/{ => endpoint}/windows_hosts_file_modification.yml (100%) rename detections/{ => endpoint}/wmi_permanent_event_subscription.yml (100%) rename detections/{ => endpoint}/wmi_permanent_event_subscription___sysmon.yml (100%) rename detections/{ => endpoint}/wmi_temporary_event_subscription.yml (100%) rename detections/{ => network}/clients_connecting_to_multiple_dns_servers.yml (100%) rename detections/{ => network}/detect_arp_poisoning.yml (100%) rename detections/{ => network}/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml (100%) rename detections/{ => network}/detect_hosts_connecting_to_dynamic_domain_providers.yml (100%) rename detections/{ => network}/detect_large_outbound_icmp_packets.yml (100%) rename detections/{ => network}/detect_long_dns_txt_record_response.yml (100%) rename detections/{ => network}/detect_outbound_smb_traffic.yml (100%) rename detections/{ => network}/detect_rogue_dhcp_server.yml (100%) rename detections/{ => network}/detect_unauthorized_assets_by_mac_address.yml (100%) rename detections/{ => network}/detect_zerologon_via_zeek.yml (100%) rename detections/{ => network}/detection_of_dns_tunnels.yml (100%) rename detections/{ => network}/dns_query_length_outliers___mltk.yml (100%) rename detections/{ => network}/dns_query_length_with_high_standard_deviation.yml (100%) rename detections/{ => network}/dns_query_requests_resolved_by_unauthorized_dns_servers.yml (100%) rename detections/{ => network}/dns_record_changed.yml (100%) rename detections/{ => network}/excessive_dns_failures.yml (100%) rename detections/{ => network}/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml (100%) rename detections/{ => network}/large_volume_of_dns_any_queries.yml (100%) rename detections/{ => network}/monitor_dns_for_brand_abuse.yml (100%) rename detections/{ => network}/prohibited_network_traffic_allowed.yml (100%) rename detections/{ => network}/protocol_or_port_mismatch.yml (100%) rename detections/{ => network}/protocols_passing_authentication_in_cleartext.yml (100%) rename detections/{ => network}/remote_desktop_network_bruteforce.yml (100%) rename detections/{ => network}/remote_desktop_network_traffic.yml (100%) rename detections/{ => network}/smb_traffic_spike.yml (100%) rename detections/{ => network}/smb_traffic_spike___mltk.yml (100%) rename detections/{ => network}/tor_traffic.yml (100%) rename detections/{ => web}/detect_attackers_scanning_for_vulnerable_jboss_servers.yml (100%) rename detections/{ => web}/detect_f5_tmui_rct_cve_2020_5902.yml (100%) rename detections/{ => web}/detect_malicious_requests_to_exploit_jboss_servers.yml (100%) rename detections/{ => web}/detect_web_traffic_to_dynamic_domain_providers.yml (100%) rename detections/{ => web}/monitor_web_traffic_for_brand_abuse.yml (100%) rename detections/{ => web}/sql_injection_with_long_urls.yml (100%) rename detections/{ => web}/web_fraud___account_harvesting.yml (100%) rename detections/{ => web}/web_fraud___anomalous_user_clickspeed.yml (100%) rename detections/{ => web}/web_fraud___password_sharing_across_accounts.yml (100%) diff --git a/detections/detect_new_login_attempts_to_routers.yml b/detections/application/detect_new_login_attempts_to_routers.yml similarity index 100% rename from detections/detect_new_login_attempts_to_routers.yml rename to detections/application/detect_new_login_attempts_to_routers.yml diff --git a/detections/detect_phishing_content___ssa.yml b/detections/application/detect_phishing_content___ssa.yml similarity index 100% rename from detections/detect_phishing_content___ssa.yml rename to detections/application/detect_phishing_content___ssa.yml diff --git a/detections/email_attachments_with_lots_of_spaces.yml b/detections/application/email_attachments_with_lots_of_spaces.yml similarity index 100% rename from detections/email_attachments_with_lots_of_spaces.yml rename to detections/application/email_attachments_with_lots_of_spaces.yml diff --git a/detections/email_files_written_outside_of_the_outlook_directory.yml b/detections/application/email_files_written_outside_of_the_outlook_directory.yml similarity index 100% rename from detections/email_files_written_outside_of_the_outlook_directory.yml rename to detections/application/email_files_written_outside_of_the_outlook_directory.yml diff --git a/detections/email_servers_sending_high_volume_traffic_to_hosts.yml b/detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml similarity index 100% rename from detections/email_servers_sending_high_volume_traffic_to_hosts.yml rename to detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml diff --git a/detections/identify_new_user_accounts.yml b/detections/application/identify_new_user_accounts.yml similarity index 100% rename from detections/identify_new_user_accounts.yml rename to detections/application/identify_new_user_accounts.yml diff --git a/detections/monitor_email_for_brand_abuse.yml b/detections/application/monitor_email_for_brand_abuse.yml similarity index 100% rename from detections/monitor_email_for_brand_abuse.yml rename to detections/application/monitor_email_for_brand_abuse.yml diff --git a/detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml b/detections/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml similarity index 100% rename from detections/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml rename to detections/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml diff --git a/detections/no_windows_updates_in_a_time_frame.yml b/detections/application/no_windows_updates_in_a_time_frame.yml similarity index 100% rename from detections/no_windows_updates_in_a_time_frame.yml rename to detections/application/no_windows_updates_in_a_time_frame.yml diff --git a/detections/okta_account_lockout_events.yml b/detections/application/okta_account_lockout_events.yml similarity index 100% rename from detections/okta_account_lockout_events.yml rename to detections/application/okta_account_lockout_events.yml diff --git a/detections/okta_failed_sso_attempts.yml b/detections/application/okta_failed_sso_attempts.yml similarity index 100% rename from detections/okta_failed_sso_attempts.yml rename to detections/application/okta_failed_sso_attempts.yml diff --git a/detections/okta_user_logins_from_multiple_cities.yml b/detections/application/okta_user_logins_from_multiple_cities.yml similarity index 100% rename from detections/okta_user_logins_from_multiple_cities.yml rename to detections/application/okta_user_logins_from_multiple_cities.yml diff --git a/detections/open_redirect_in_splunk_web.yml b/detections/application/open_redirect_in_splunk_web.yml similarity index 100% rename from detections/open_redirect_in_splunk_web.yml rename to detections/application/open_redirect_in_splunk_web.yml diff --git a/detections/spectre_and_meltdown_vulnerable_systems.yml b/detections/application/spectre_and_meltdown_vulnerable_systems.yml similarity index 100% rename from detections/spectre_and_meltdown_vulnerable_systems.yml rename to detections/application/spectre_and_meltdown_vulnerable_systems.yml diff --git a/detections/splunk_enterprise_information_disclosure.yml b/detections/application/splunk_enterprise_information_disclosure.yml similarity index 100% rename from detections/splunk_enterprise_information_disclosure.yml rename to detections/application/splunk_enterprise_information_disclosure.yml diff --git a/detections/suspicious_email___uba_anomaly.yml b/detections/application/suspicious_email___uba_anomaly.yml similarity index 100% rename from detections/suspicious_email___uba_anomaly.yml rename to detections/application/suspicious_email___uba_anomaly.yml diff --git a/detections/suspicious_email_attachment_extensions.yml b/detections/application/suspicious_email_attachment_extensions.yml similarity index 100% rename from detections/suspicious_email_attachment_extensions.yml rename to detections/application/suspicious_email_attachment_extensions.yml diff --git a/detections/abnormally_high_aws_instances_launched_by_user.yml b/detections/cloud/abnormally_high_aws_instances_launched_by_user.yml similarity index 100% rename from detections/abnormally_high_aws_instances_launched_by_user.yml rename to detections/cloud/abnormally_high_aws_instances_launched_by_user.yml diff --git a/detections/abnormally_high_aws_instances_launched_by_user___mltk.yml b/detections/cloud/abnormally_high_aws_instances_launched_by_user___mltk.yml similarity index 100% rename from detections/abnormally_high_aws_instances_launched_by_user___mltk.yml rename to detections/cloud/abnormally_high_aws_instances_launched_by_user___mltk.yml diff --git a/detections/abnormally_high_aws_instances_terminated_by_user.yml b/detections/cloud/abnormally_high_aws_instances_terminated_by_user.yml similarity index 100% rename from detections/abnormally_high_aws_instances_terminated_by_user.yml rename to detections/cloud/abnormally_high_aws_instances_terminated_by_user.yml diff --git a/detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml b/detections/cloud/abnormally_high_aws_instances_terminated_by_user___mltk.yml similarity index 100% rename from detections/abnormally_high_aws_instances_terminated_by_user___mltk.yml rename to detections/cloud/abnormally_high_aws_instances_terminated_by_user___mltk.yml diff --git a/detections/amazon_eks_kubernetes_cluster_scan_detection.yml b/detections/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml similarity index 100% rename from detections/amazon_eks_kubernetes_cluster_scan_detection.yml rename to detections/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml diff --git a/detections/amazon_eks_kubernetes_pod_scan_detection.yml b/detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml similarity index 100% rename from detections/amazon_eks_kubernetes_pod_scan_detection.yml rename to detections/cloud/amazon_eks_kubernetes_pod_scan_detection.yml diff --git a/detections/aws_cloud_provisioning_from_previously_unseen_city.yml b/detections/cloud/aws_cloud_provisioning_from_previously_unseen_city.yml similarity index 100% rename from detections/aws_cloud_provisioning_from_previously_unseen_city.yml rename to detections/cloud/aws_cloud_provisioning_from_previously_unseen_city.yml diff --git a/detections/aws_cloud_provisioning_from_previously_unseen_country.yml b/detections/cloud/aws_cloud_provisioning_from_previously_unseen_country.yml similarity index 100% rename from detections/aws_cloud_provisioning_from_previously_unseen_country.yml rename to detections/cloud/aws_cloud_provisioning_from_previously_unseen_country.yml diff --git a/detections/aws_cloud_provisioning_from_previously_unseen_ip_address.yml b/detections/cloud/aws_cloud_provisioning_from_previously_unseen_ip_address.yml similarity index 100% rename from detections/aws_cloud_provisioning_from_previously_unseen_ip_address.yml rename to detections/cloud/aws_cloud_provisioning_from_previously_unseen_ip_address.yml diff --git a/detections/aws_cloud_provisioning_from_previously_unseen_region.yml b/detections/cloud/aws_cloud_provisioning_from_previously_unseen_region.yml similarity index 100% rename from detections/aws_cloud_provisioning_from_previously_unseen_region.yml rename to detections/cloud/aws_cloud_provisioning_from_previously_unseen_region.yml diff --git a/detections/aws_cross_account_activity_from_previously_unseen_account.yml b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml similarity index 100% rename from detections/aws_cross_account_activity_from_previously_unseen_account.yml rename to detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml diff --git a/detections/aws_detect_attach_to_role_policy.yml b/detections/cloud/aws_detect_attach_to_role_policy.yml similarity index 100% rename from detections/aws_detect_attach_to_role_policy.yml rename to detections/cloud/aws_detect_attach_to_role_policy.yml diff --git a/detections/aws_detect_permanent_key_creation.yml b/detections/cloud/aws_detect_permanent_key_creation.yml similarity index 100% rename from detections/aws_detect_permanent_key_creation.yml rename to detections/cloud/aws_detect_permanent_key_creation.yml diff --git a/detections/aws_detect_role_creation.yml b/detections/cloud/aws_detect_role_creation.yml similarity index 100% rename from detections/aws_detect_role_creation.yml rename to detections/cloud/aws_detect_role_creation.yml diff --git a/detections/aws_detect_sts_assume_role_abuse.yml b/detections/cloud/aws_detect_sts_assume_role_abuse.yml similarity index 100% rename from detections/aws_detect_sts_assume_role_abuse.yml rename to detections/cloud/aws_detect_sts_assume_role_abuse.yml diff --git a/detections/aws_detect_sts_get_session_token_abuse.yml b/detections/cloud/aws_detect_sts_get_session_token_abuse.yml similarity index 100% rename from detections/aws_detect_sts_get_session_token_abuse.yml rename to detections/cloud/aws_detect_sts_get_session_token_abuse.yml diff --git a/detections/aws_network_access_control_list_created_with_all_open_ports.yml b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml similarity index 100% rename from detections/aws_network_access_control_list_created_with_all_open_ports.yml rename to detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml diff --git a/detections/aws_network_access_control_list_deleted.yml b/detections/cloud/aws_network_access_control_list_deleted.yml similarity index 100% rename from detections/aws_network_access_control_list_deleted.yml rename to detections/cloud/aws_network_access_control_list_deleted.yml diff --git a/detections/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml similarity index 100% rename from detections/cloud_compute_instance_created_by_previously_unseen_user.yml rename to detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml diff --git a/detections/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml similarity index 100% rename from detections/cloud_compute_instance_created_with_previously_unseen_image.yml rename to detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml diff --git a/detections/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml similarity index 100% rename from detections/cloud_compute_instance_created_with_previously_unseen_instance_type.yml rename to detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml diff --git a/detections/cloud_compute_instance_started_in_previously_unused_region.yml b/detections/cloud/cloud_compute_instance_started_in_previously_unused_region.yml similarity index 100% rename from detections/cloud_compute_instance_started_in_previously_unused_region.yml rename to detections/cloud/cloud_compute_instance_started_in_previously_unused_region.yml diff --git a/detections/detect_api_activity_from_users_without_mfa.yml b/detections/cloud/detect_api_activity_from_users_without_mfa.yml similarity index 100% rename from detections/detect_api_activity_from_users_without_mfa.yml rename to detections/cloud/detect_api_activity_from_users_without_mfa.yml diff --git a/detections/detect_aws_api_activities_from_unapproved_accounts.yml b/detections/cloud/detect_aws_api_activities_from_unapproved_accounts.yml similarity index 100% rename from detections/detect_aws_api_activities_from_unapproved_accounts.yml rename to detections/cloud/detect_aws_api_activities_from_unapproved_accounts.yml diff --git a/detections/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml similarity index 100% rename from detections/detect_aws_console_login_by_user_from_new_city.yml rename to detections/cloud/detect_aws_console_login_by_user_from_new_city.yml diff --git a/detections/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml similarity index 100% rename from detections/detect_aws_console_login_by_user_from_new_country.yml rename to detections/cloud/detect_aws_console_login_by_user_from_new_country.yml diff --git a/detections/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml similarity index 100% rename from detections/detect_aws_console_login_by_user_from_new_region.yml rename to detections/cloud/detect_aws_console_login_by_user_from_new_region.yml diff --git a/detections/detect_gcp_storage_access_from_a_new_ip.yml b/detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml similarity index 100% rename from detections/detect_gcp_storage_access_from_a_new_ip.yml rename to detections/cloud/detect_gcp_storage_access_from_a_new_ip.yml diff --git a/detections/detect_new_api_calls_from_user_roles.yml b/detections/cloud/detect_new_api_calls_from_user_roles.yml similarity index 100% rename from detections/detect_new_api_calls_from_user_roles.yml rename to detections/cloud/detect_new_api_calls_from_user_roles.yml diff --git a/detections/detect_new_open_gcp_storage_buckets.yml b/detections/cloud/detect_new_open_gcp_storage_buckets.yml similarity index 100% rename from detections/detect_new_open_gcp_storage_buckets.yml rename to detections/cloud/detect_new_open_gcp_storage_buckets.yml diff --git a/detections/detect_new_open_s3_buckets.yml b/detections/cloud/detect_new_open_s3_buckets.yml similarity index 100% rename from detections/detect_new_open_s3_buckets.yml rename to detections/cloud/detect_new_open_s3_buckets.yml diff --git a/detections/detect_new_user_aws_console_login.yml b/detections/cloud/detect_new_user_aws_console_login.yml similarity index 100% rename from detections/detect_new_user_aws_console_login.yml rename to detections/cloud/detect_new_user_aws_console_login.yml diff --git a/detections/detect_new_user_aws_console_login___dm.yml b/detections/cloud/detect_new_user_aws_console_login___dm.yml similarity index 100% rename from detections/detect_new_user_aws_console_login___dm.yml rename to detections/cloud/detect_new_user_aws_console_login___dm.yml diff --git a/detections/detect_s3_access_from_a_new_ip.yml b/detections/cloud/detect_s3_access_from_a_new_ip.yml similarity index 100% rename from detections/detect_s3_access_from_a_new_ip.yml rename to detections/cloud/detect_s3_access_from_a_new_ip.yml diff --git a/detections/detect_spike_in_aws_api_activity.yml b/detections/cloud/detect_spike_in_aws_api_activity.yml similarity index 100% rename from detections/detect_spike_in_aws_api_activity.yml rename to detections/cloud/detect_spike_in_aws_api_activity.yml diff --git a/detections/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml similarity index 100% rename from detections/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml rename to detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml diff --git a/detections/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml b/detections/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml similarity index 100% rename from detections/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml rename to detections/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml diff --git a/detections/detect_spike_in_network_acl_activity.yml b/detections/cloud/detect_spike_in_network_acl_activity.yml similarity index 100% rename from detections/detect_spike_in_network_acl_activity.yml rename to detections/cloud/detect_spike_in_network_acl_activity.yml diff --git a/detections/detect_spike_in_s3_bucket_deletion.yml b/detections/cloud/detect_spike_in_s3_bucket_deletion.yml similarity index 100% rename from detections/detect_spike_in_s3_bucket_deletion.yml rename to detections/cloud/detect_spike_in_s3_bucket_deletion.yml diff --git a/detections/detect_spike_in_security_group_activity.yml b/detections/cloud/detect_spike_in_security_group_activity.yml similarity index 100% rename from detections/detect_spike_in_security_group_activity.yml rename to detections/cloud/detect_spike_in_security_group_activity.yml diff --git a/detections/detect_spike_in_security_hub_alerts_for_user.yml b/detections/cloud/detect_spike_in_security_hub_alerts_for_user.yml similarity index 100% rename from detections/detect_spike_in_security_hub_alerts_for_user.yml rename to detections/cloud/detect_spike_in_security_hub_alerts_for_user.yml diff --git a/detections/ec2_instance_modified_with_previously_unseen_user.yml b/detections/cloud/ec2_instance_modified_with_previously_unseen_user.yml similarity index 100% rename from detections/ec2_instance_modified_with_previously_unseen_user.yml rename to detections/cloud/ec2_instance_modified_with_previously_unseen_user.yml diff --git a/detections/ec2_instance_started_in_previously_unseen_region.yml b/detections/cloud/ec2_instance_started_in_previously_unseen_region.yml similarity index 100% rename from detections/ec2_instance_started_in_previously_unseen_region.yml rename to detections/cloud/ec2_instance_started_in_previously_unseen_region.yml diff --git a/detections/ec2_instance_started_with_previously_unseen_ami.yml b/detections/cloud/ec2_instance_started_with_previously_unseen_ami.yml similarity index 100% rename from detections/ec2_instance_started_with_previously_unseen_ami.yml rename to detections/cloud/ec2_instance_started_with_previously_unseen_ami.yml diff --git a/detections/ec2_instance_started_with_previously_unseen_instance_type.yml b/detections/cloud/ec2_instance_started_with_previously_unseen_instance_type.yml similarity index 100% rename from detections/ec2_instance_started_with_previously_unseen_instance_type.yml rename to detections/cloud/ec2_instance_started_with_previously_unseen_instance_type.yml diff --git a/detections/ec2_instance_started_with_previously_unseen_user.yml b/detections/cloud/ec2_instance_started_with_previously_unseen_user.yml similarity index 100% rename from detections/ec2_instance_started_with_previously_unseen_user.yml rename to detections/cloud/ec2_instance_started_with_previously_unseen_user.yml diff --git a/detections/gcp_detect_oauth_token_abuse.yml b/detections/cloud/gcp_detect_oauth_token_abuse.yml similarity index 100% rename from detections/gcp_detect_oauth_token_abuse.yml rename to detections/cloud/gcp_detect_oauth_token_abuse.yml diff --git a/detections/gcp_gcr_container_uploaded.yml b/detections/cloud/gcp_gcr_container_uploaded.yml similarity index 100% rename from detections/gcp_gcr_container_uploaded.yml rename to detections/cloud/gcp_gcr_container_uploaded.yml diff --git a/detections/gcp_kubernetes_cluster_pod_scan_detection.yml b/detections/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml similarity index 100% rename from detections/gcp_kubernetes_cluster_pod_scan_detection.yml rename to detections/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml diff --git a/detections/gcp_kubernetes_cluster_scan_detection.yml b/detections/cloud/gcp_kubernetes_cluster_scan_detection.yml similarity index 100% rename from detections/gcp_kubernetes_cluster_scan_detection.yml rename to detections/cloud/gcp_kubernetes_cluster_scan_detection.yml diff --git a/detections/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml b/detections/cloud/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml similarity index 100% rename from detections/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml rename to detections/cloud/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml diff --git a/detections/kubernetes_aws_detect_rbac_authorizations_by_account.yml b/detections/cloud/kubernetes_aws_detect_rbac_authorizations_by_account.yml similarity index 100% rename from detections/kubernetes_aws_detect_rbac_authorizations_by_account.yml rename to detections/cloud/kubernetes_aws_detect_rbac_authorizations_by_account.yml diff --git a/detections/kubernetes_aws_detect_sensitive_object_access.yml b/detections/cloud/kubernetes_aws_detect_sensitive_object_access.yml similarity index 100% rename from detections/kubernetes_aws_detect_sensitive_object_access.yml rename to detections/cloud/kubernetes_aws_detect_sensitive_object_access.yml diff --git a/detections/kubernetes_aws_detect_sensitive_role_access.yml b/detections/cloud/kubernetes_aws_detect_sensitive_role_access.yml similarity index 100% rename from detections/kubernetes_aws_detect_sensitive_role_access.yml rename to detections/cloud/kubernetes_aws_detect_sensitive_role_access.yml diff --git a/detections/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml b/detections/cloud/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml similarity index 100% rename from detections/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml rename to detections/cloud/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml diff --git a/detections/kubernetes_aws_detect_suspicious_kubectl_calls.yml b/detections/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml similarity index 100% rename from detections/kubernetes_aws_detect_suspicious_kubectl_calls.yml rename to detections/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml diff --git a/detections/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml b/detections/cloud/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml similarity index 100% rename from detections/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml rename to detections/cloud/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml diff --git a/detections/kubernetes_azure_detect_rbac_authorization_by_account.yml b/detections/cloud/kubernetes_azure_detect_rbac_authorization_by_account.yml similarity index 100% rename from detections/kubernetes_azure_detect_rbac_authorization_by_account.yml rename to detections/cloud/kubernetes_azure_detect_rbac_authorization_by_account.yml diff --git a/detections/kubernetes_azure_detect_sensitive_object_access.yml b/detections/cloud/kubernetes_azure_detect_sensitive_object_access.yml similarity index 100% rename from detections/kubernetes_azure_detect_sensitive_object_access.yml rename to detections/cloud/kubernetes_azure_detect_sensitive_object_access.yml diff --git a/detections/kubernetes_azure_detect_sensitive_role_access.yml b/detections/cloud/kubernetes_azure_detect_sensitive_role_access.yml similarity index 100% rename from detections/kubernetes_azure_detect_sensitive_role_access.yml rename to detections/cloud/kubernetes_azure_detect_sensitive_role_access.yml diff --git a/detections/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml b/detections/cloud/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml similarity index 100% rename from detections/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml rename to detections/cloud/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml diff --git a/detections/kubernetes_azure_detect_suspicious_kubectl_calls.yml b/detections/cloud/kubernetes_azure_detect_suspicious_kubectl_calls.yml similarity index 100% rename from detections/kubernetes_azure_detect_suspicious_kubectl_calls.yml rename to detections/cloud/kubernetes_azure_detect_suspicious_kubectl_calls.yml diff --git a/detections/kubernetes_azure_pod_scan_fingerprint.yml b/detections/cloud/kubernetes_azure_pod_scan_fingerprint.yml similarity index 100% rename from detections/kubernetes_azure_pod_scan_fingerprint.yml rename to detections/cloud/kubernetes_azure_pod_scan_fingerprint.yml diff --git a/detections/kubernetes_azure_scan_fingerprint.yml b/detections/cloud/kubernetes_azure_scan_fingerprint.yml similarity index 100% rename from detections/kubernetes_azure_scan_fingerprint.yml rename to detections/cloud/kubernetes_azure_scan_fingerprint.yml diff --git a/detections/kubernetes_gcp_detect_RBAC_authorizations_by_account.yml b/detections/cloud/kubernetes_gcp_detect_RBAC_authorizations_by_account.yml similarity index 100% rename from detections/kubernetes_gcp_detect_RBAC_authorizations_by_account.yml rename to detections/cloud/kubernetes_gcp_detect_RBAC_authorizations_by_account.yml diff --git a/detections/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml b/detections/cloud/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml similarity index 100% rename from detections/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml rename to detections/cloud/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml diff --git a/detections/kubernetes_gcp_detect_sensitive_object_access.yml b/detections/cloud/kubernetes_gcp_detect_sensitive_object_access.yml similarity index 100% rename from detections/kubernetes_gcp_detect_sensitive_object_access.yml rename to detections/cloud/kubernetes_gcp_detect_sensitive_object_access.yml diff --git a/detections/kubernetes_gcp_detect_sensitive_role_access.yml b/detections/cloud/kubernetes_gcp_detect_sensitive_role_access.yml similarity index 100% rename from detections/kubernetes_gcp_detect_sensitive_role_access.yml rename to detections/cloud/kubernetes_gcp_detect_sensitive_role_access.yml diff --git a/detections/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml b/detections/cloud/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml similarity index 100% rename from detections/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml rename to detections/cloud/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml diff --git a/detections/kubernetes_gcp_detect_suspicious_kubectl_calls.yml b/detections/cloud/kubernetes_gcp_detect_suspicious_kubectl_calls.yml similarity index 100% rename from detections/kubernetes_gcp_detect_suspicious_kubectl_calls.yml rename to detections/cloud/kubernetes_gcp_detect_suspicious_kubectl_calls.yml diff --git a/detections/new_container_uploaded_to_aws_ecr.yml b/detections/cloud/new_container_uploaded_to_aws_ecr.yml similarity index 100% rename from detections/new_container_uploaded_to_aws_ecr.yml rename to detections/cloud/new_container_uploaded_to_aws_ecr.yml diff --git a/detections/access_lsass_memory_for_dump_creation.yml b/detections/endpoint/access_lsass_memory_for_dump_creation.yml similarity index 100% rename from detections/access_lsass_memory_for_dump_creation.yml rename to detections/endpoint/access_lsass_memory_for_dump_creation.yml diff --git a/detections/attempt_to_add_certificate_to_untrusted_store.yml b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml similarity index 100% rename from detections/attempt_to_add_certificate_to_untrusted_store.yml rename to detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml diff --git a/detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml similarity index 100% rename from detections/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml rename to detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml diff --git a/detections/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml similarity index 100% rename from detections/attempt_to_stop_security_service.yml rename to detections/endpoint/attempt_to_stop_security_service.yml diff --git a/detections/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml similarity index 100% rename from detections/attempted_credential_dump_from_registry_via_reg_exe.yml rename to detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml diff --git a/detections/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml similarity index 100% rename from detections/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml rename to detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml diff --git a/detections/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml similarity index 100% rename from detections/batch_file_write_to_system32.yml rename to detections/endpoint/batch_file_write_to_system32.yml diff --git a/detections/child_processes_of_spoolsv_exe.yml b/detections/endpoint/child_processes_of_spoolsv_exe.yml similarity index 100% rename from detections/child_processes_of_spoolsv_exe.yml rename to detections/endpoint/child_processes_of_spoolsv_exe.yml diff --git a/detections/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml similarity index 100% rename from detections/common_ransomware_extensions.yml rename to detections/endpoint/common_ransomware_extensions.yml diff --git a/detections/common_ransomware_notes.yml b/detections/endpoint/common_ransomware_notes.yml similarity index 100% rename from detections/common_ransomware_notes.yml rename to detections/endpoint/common_ransomware_notes.yml diff --git a/detections/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml similarity index 100% rename from detections/create_local_admin_accounts_using_net_exe.yml rename to detections/endpoint/create_local_admin_accounts_using_net_exe.yml diff --git a/detections/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml similarity index 100% rename from detections/create_or_delete_windows_shares_using_net_exe.yml rename to detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml diff --git a/detections/create_remote_thread_into_lsass.yml b/detections/endpoint/create_remote_thread_into_lsass.yml similarity index 100% rename from detections/create_remote_thread_into_lsass.yml rename to detections/endpoint/create_remote_thread_into_lsass.yml diff --git a/detections/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml similarity index 100% rename from detections/creation_of_shadow_copy.yml rename to detections/endpoint/creation_of_shadow_copy.yml diff --git a/detections/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml similarity index 100% rename from detections/creation_of_shadow_copy_with_wmic_and_powershell.yml rename to detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml diff --git a/detections/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml similarity index 100% rename from detections/credential_dumping_via_copy_command_from_shadow_copy.yml rename to detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml diff --git a/detections/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml similarity index 100% rename from detections/credential_dumping_via_symlink_to_shadow_copy.yml rename to detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml diff --git a/detections/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml similarity index 100% rename from detections/deleting_shadow_copies.yml rename to detections/endpoint/deleting_shadow_copies.yml diff --git a/detections/detect_activity_related_to_pass_the_hash_attacks.yml b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml similarity index 100% rename from detections/detect_activity_related_to_pass_the_hash_attacks.yml rename to detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml diff --git a/detections/detect_computer_changed_with_anonymous_account.yml b/detections/endpoint/detect_computer_changed_with_anonymous_account.yml similarity index 100% rename from detections/detect_computer_changed_with_anonymous_account.yml rename to detections/endpoint/detect_computer_changed_with_anonymous_account.yml diff --git a/detections/detect_credential_dumping_through_lsass_access.yml b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml similarity index 100% rename from detections/detect_credential_dumping_through_lsass_access.yml rename to detections/endpoint/detect_credential_dumping_through_lsass_access.yml diff --git a/detections/detect_dump_lsass_memory_using_comsvcs___ssa.yml b/detections/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.yml similarity index 100% rename from detections/detect_dump_lsass_memory_using_comsvcs___ssa.yml rename to detections/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.yml diff --git a/detections/detect_excessive_account_lockouts_from_endpoint.yml b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml similarity index 100% rename from detections/detect_excessive_account_lockouts_from_endpoint.yml rename to detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml diff --git a/detections/detect_excessive_user_account_lockouts.yml b/detections/endpoint/detect_excessive_user_account_lockouts.yml similarity index 100% rename from detections/detect_excessive_user_account_lockouts.yml rename to detections/endpoint/detect_excessive_user_account_lockouts.yml diff --git a/detections/detect_mimikatz_using_loaded_images.yml b/detections/endpoint/detect_mimikatz_using_loaded_images.yml similarity index 100% rename from detections/detect_mimikatz_using_loaded_images.yml rename to detections/endpoint/detect_mimikatz_using_loaded_images.yml diff --git a/detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml b/detections/endpoint/detect_mimikatz_via_powershell_and_eventcode_4703.yml similarity index 100% rename from detections/detect_mimikatz_via_powershell_and_eventcode_4703.yml rename to detections/endpoint/detect_mimikatz_via_powershell_and_eventcode_4703.yml diff --git a/detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml b/detections/endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.yml similarity index 100% rename from detections/detect_mshta_exe_running_scripts_in_command_line_arguments.yml rename to detections/endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.yml diff --git a/detections/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml similarity index 100% rename from detections/detect_new_local_admin_account.yml rename to detections/endpoint/detect_new_local_admin_account.yml diff --git a/detections/detect_oulook_exe_writing_a__zip_file.yml b/detections/endpoint/detect_oulook_exe_writing_a__zip_file.yml similarity index 100% rename from detections/detect_oulook_exe_writing_a__zip_file.yml rename to detections/endpoint/detect_oulook_exe_writing_a__zip_file.yml diff --git a/detections/detect_path_interception_by_creation_of_program_exe.yml b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml similarity index 100% rename from detections/detect_path_interception_by_creation_of_program_exe.yml rename to detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml diff --git a/detections/detect_processes_used_for_system_network_configuration_discovery.yml b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml similarity index 100% rename from detections/detect_processes_used_for_system_network_configuration_discovery.yml rename to detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml diff --git a/detections/detect_prohibited_applications_spawning_cmd_exe.yml b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml similarity index 100% rename from detections/detect_prohibited_applications_spawning_cmd_exe.yml rename to detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml diff --git a/detections/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml similarity index 100% rename from detections/detect_psexec_with_accepteula_flag.yml rename to detections/endpoint/detect_psexec_with_accepteula_flag.yml diff --git a/detections/detect_rare_executables.yml b/detections/endpoint/detect_rare_executables.yml similarity index 100% rename from detections/detect_rare_executables.yml rename to detections/endpoint/detect_rare_executables.yml diff --git a/detections/detect_usb_device_insertion.yml b/detections/endpoint/detect_usb_device_insertion.yml similarity index 100% rename from detections/detect_usb_device_insertion.yml rename to detections/endpoint/detect_usb_device_insertion.yml diff --git a/detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml similarity index 100% rename from detections/detect_use_of_cmd_exe_to_launch_script_interpreters.yml rename to detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml diff --git a/detections/detect_windows_dns_sigred_via_splunk_stream.yml b/detections/endpoint/detect_windows_dns_sigred_via_splunk_stream.yml similarity index 100% rename from detections/detect_windows_dns_sigred_via_splunk_stream.yml rename to detections/endpoint/detect_windows_dns_sigred_via_splunk_stream.yml diff --git a/detections/detect_windows_dns_sigred_via_zeek.yml b/detections/endpoint/detect_windows_dns_sigred_via_zeek.yml similarity index 100% rename from detections/detect_windows_dns_sigred_via_zeek.yml rename to detections/endpoint/detect_windows_dns_sigred_via_zeek.yml diff --git a/detections/detection_of_tools_built_by_nirsoft.yml b/detections/endpoint/detection_of_tools_built_by_nirsoft.yml similarity index 100% rename from detections/detection_of_tools_built_by_nirsoft.yml rename to detections/endpoint/detection_of_tools_built_by_nirsoft.yml diff --git a/detections/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml similarity index 100% rename from detections/disabling_remote_user_account_control.yml rename to detections/endpoint/disabling_remote_user_account_control.yml diff --git a/detections/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml similarity index 100% rename from detections/dump_lsass_via_comsvcs_dll.yml rename to detections/endpoint/dump_lsass_via_comsvcs_dll.yml diff --git a/detections/execution_of_file_with_multiple_extensions.yml b/detections/endpoint/execution_of_file_with_multiple_extensions.yml similarity index 100% rename from detections/execution_of_file_with_multiple_extensions.yml rename to detections/endpoint/execution_of_file_with_multiple_extensions.yml diff --git a/detections/execution_of_file_with_spaces_before_extension.yml b/detections/endpoint/execution_of_file_with_spaces_before_extension.yml similarity index 100% rename from detections/execution_of_file_with_spaces_before_extension.yml rename to detections/endpoint/execution_of_file_with_spaces_before_extension.yml diff --git a/detections/extended_period_without_successful_netbackup_backups.yml b/detections/endpoint/extended_period_without_successful_netbackup_backups.yml similarity index 100% rename from detections/extended_period_without_successful_netbackup_backups.yml rename to detections/endpoint/extended_period_without_successful_netbackup_backups.yml diff --git a/detections/file_with_samsam_extension.yml b/detections/endpoint/file_with_samsam_extension.yml similarity index 100% rename from detections/file_with_samsam_extension.yml rename to detections/endpoint/file_with_samsam_extension.yml diff --git a/detections/first_time_seen_child_process_of_zoom.yml b/detections/endpoint/first_time_seen_child_process_of_zoom.yml similarity index 100% rename from detections/first_time_seen_child_process_of_zoom.yml rename to detections/endpoint/first_time_seen_child_process_of_zoom.yml diff --git a/detections/first_time_seen_cmd_line___ssa.yml b/detections/endpoint/first_time_seen_cmd_line___ssa.yml similarity index 100% rename from detections/first_time_seen_cmd_line___ssa.yml rename to detections/endpoint/first_time_seen_cmd_line___ssa.yml diff --git a/detections/first_time_seen_command_line_argument.yml b/detections/endpoint/first_time_seen_command_line_argument.yml similarity index 100% rename from detections/first_time_seen_command_line_argument.yml rename to detections/endpoint/first_time_seen_command_line_argument.yml diff --git a/detections/first_time_seen_running_windows_service.yml b/detections/endpoint/first_time_seen_running_windows_service.yml similarity index 100% rename from detections/first_time_seen_running_windows_service.yml rename to detections/endpoint/first_time_seen_running_windows_service.yml diff --git a/detections/hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml similarity index 100% rename from detections/hiding_files_and_directories_with_attrib_exe.yml rename to detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml diff --git a/detections/kerberoasting_spn_request_with_rc4_encryption.yml b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml similarity index 100% rename from detections/kerberoasting_spn_request_with_rc4_encryption.yml rename to detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml diff --git a/detections/macos___re_opened_applications.yml b/detections/endpoint/macos___re_opened_applications.yml similarity index 100% rename from detections/macos___re_opened_applications.yml rename to detections/endpoint/macos___re_opened_applications.yml diff --git a/detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml similarity index 100% rename from detections/malicious_powershell_process___connect_to_internet_with_hidden_window.yml rename to detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml diff --git a/detections/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml similarity index 100% rename from detections/malicious_powershell_process___encoded_command.yml rename to detections/endpoint/malicious_powershell_process___encoded_command.yml diff --git a/detections/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml similarity index 100% rename from detections/malicious_powershell_process___execution_policy_bypass.yml rename to detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml diff --git a/detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml b/detections/endpoint/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml similarity index 100% rename from detections/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml rename to detections/endpoint/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml diff --git a/detections/malicious_powershell_process_with_obfuscation_techniques.yml b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml similarity index 100% rename from detections/malicious_powershell_process_with_obfuscation_techniques.yml rename to detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml diff --git a/detections/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml similarity index 100% rename from detections/monitor_registry_keys_for_print_monitors.yml rename to detections/endpoint/monitor_registry_keys_for_print_monitors.yml diff --git a/detections/osquery_pack___coldroot_detection.yml b/detections/endpoint/osquery_pack___coldroot_detection.yml similarity index 100% rename from detections/osquery_pack___coldroot_detection.yml rename to detections/endpoint/osquery_pack___coldroot_detection.yml diff --git a/detections/overwriting_accessibility_binaries.yml b/detections/endpoint/overwriting_accessibility_binaries.yml similarity index 100% rename from detections/overwriting_accessibility_binaries.yml rename to detections/endpoint/overwriting_accessibility_binaries.yml diff --git a/detections/process_execution_via_wmi.yml b/detections/endpoint/process_execution_via_wmi.yml similarity index 100% rename from detections/process_execution_via_wmi.yml rename to detections/endpoint/process_execution_via_wmi.yml diff --git a/detections/processes_created_by_netsh.yml b/detections/endpoint/processes_created_by_netsh.yml similarity index 100% rename from detections/processes_created_by_netsh.yml rename to detections/endpoint/processes_created_by_netsh.yml diff --git a/detections/processes_launching_netsh.yml b/detections/endpoint/processes_launching_netsh.yml similarity index 100% rename from detections/processes_launching_netsh.yml rename to detections/endpoint/processes_launching_netsh.yml diff --git a/detections/processes_tapping_keyboard_events.yml b/detections/endpoint/processes_tapping_keyboard_events.yml similarity index 100% rename from detections/processes_tapping_keyboard_events.yml rename to detections/endpoint/processes_tapping_keyboard_events.yml diff --git a/detections/prohibited_apps_spawning_cmdprompt___ssa.yml b/detections/endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml similarity index 100% rename from detections/prohibited_apps_spawning_cmdprompt___ssa.yml rename to detections/endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml diff --git a/detections/prohibited_software_on_endpoint.yml b/detections/endpoint/prohibited_software_on_endpoint.yml similarity index 100% rename from detections/prohibited_software_on_endpoint.yml rename to detections/endpoint/prohibited_software_on_endpoint.yml diff --git a/detections/rare_parent_process_relationship_lolbas___ssa.yaml b/detections/endpoint/rare_parent_process_relationship_lolbas___ssa.yaml similarity index 100% rename from detections/rare_parent_process_relationship_lolbas___ssa.yaml rename to detections/endpoint/rare_parent_process_relationship_lolbas___ssa.yaml diff --git a/detections/reg_exe_manipulating_windows_services_registry_keys.yml b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml similarity index 100% rename from detections/reg_exe_manipulating_windows_services_registry_keys.yml rename to detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml diff --git a/detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml b/detections/endpoint/reg_exe_used_to_hide_files_directories_via_registry_keys.yml similarity index 100% rename from detections/reg_exe_used_to_hide_files_directories_via_registry_keys.yml rename to detections/endpoint/reg_exe_used_to_hide_files_directories_via_registry_keys.yml diff --git a/detections/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml similarity index 100% rename from detections/registry_keys_for_creating_shim_databases.yml rename to detections/endpoint/registry_keys_for_creating_shim_databases.yml diff --git a/detections/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml similarity index 100% rename from detections/registry_keys_used_for_persistence.yml rename to detections/endpoint/registry_keys_used_for_persistence.yml diff --git a/detections/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml similarity index 100% rename from detections/registry_keys_used_for_privilege_escalation.yml rename to detections/endpoint/registry_keys_used_for_privilege_escalation.yml diff --git a/detections/remote_desktop_process_running_on_system.yml b/detections/endpoint/remote_desktop_process_running_on_system.yml similarity index 100% rename from detections/remote_desktop_process_running_on_system.yml rename to detections/endpoint/remote_desktop_process_running_on_system.yml diff --git a/detections/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml similarity index 100% rename from detections/remote_process_instantiation_via_wmi.yml rename to detections/endpoint/remote_process_instantiation_via_wmi.yml diff --git a/detections/remote_registry_key_modifications.yml b/detections/endpoint/remote_registry_key_modifications.yml similarity index 100% rename from detections/remote_registry_key_modifications.yml rename to detections/endpoint/remote_registry_key_modifications.yml diff --git a/detections/remote_wmi_command_attempt.yml b/detections/endpoint/remote_wmi_command_attempt.yml similarity index 100% rename from detections/remote_wmi_command_attempt.yml rename to detections/endpoint/remote_wmi_command_attempt.yml diff --git a/detections/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml similarity index 100% rename from detections/rundll_loading_dll_by_ordinal.yml rename to detections/endpoint/rundll_loading_dll_by_ordinal.yml diff --git a/detections/samsam_test_file_write.yml b/detections/endpoint/samsam_test_file_write.yml similarity index 100% rename from detections/samsam_test_file_write.yml rename to detections/endpoint/samsam_test_file_write.yml diff --git a/detections/sc_exe_manipulating_windows_services.yml b/detections/endpoint/sc_exe_manipulating_windows_services.yml similarity index 100% rename from detections/sc_exe_manipulating_windows_services.yml rename to detections/endpoint/sc_exe_manipulating_windows_services.yml diff --git a/detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml b/detections/endpoint/scheduled_task_name_used_by_dragonfly_threat_actors.yml similarity index 100% rename from detections/scheduled_task_name_used_by_dragonfly_threat_actors.yml rename to detections/endpoint/scheduled_task_name_used_by_dragonfly_threat_actors.yml diff --git a/detections/scheduled_tasks_used_in_badrabbit_ransomware.yml b/detections/endpoint/scheduled_tasks_used_in_badrabbit_ransomware.yml similarity index 100% rename from detections/scheduled_tasks_used_in_badrabbit_ransomware.yml rename to detections/endpoint/scheduled_tasks_used_in_badrabbit_ransomware.yml diff --git a/detections/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml similarity index 100% rename from detections/schtasks_scheduling_job_on_remote_system.yml rename to detections/endpoint/schtasks_scheduling_job_on_remote_system.yml diff --git a/detections/schtasks_used_for_forcing_a_reboot.yml b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml similarity index 100% rename from detections/schtasks_used_for_forcing_a_reboot.yml rename to detections/endpoint/schtasks_used_for_forcing_a_reboot.yml diff --git a/detections/script_execution_via_wmi.yml b/detections/endpoint/script_execution_via_wmi.yml similarity index 100% rename from detections/script_execution_via_wmi.yml rename to detections/endpoint/script_execution_via_wmi.yml diff --git a/detections/shim_database_file_creation.yml b/detections/endpoint/shim_database_file_creation.yml similarity index 100% rename from detections/shim_database_file_creation.yml rename to detections/endpoint/shim_database_file_creation.yml diff --git a/detections/shim_database_installation_with_suspicious_parameters.yml b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml similarity index 100% rename from detections/shim_database_installation_with_suspicious_parameters.yml rename to detections/endpoint/shim_database_installation_with_suspicious_parameters.yml diff --git a/detections/short_lived_windows_accounts.yml b/detections/endpoint/short_lived_windows_accounts.yml similarity index 100% rename from detections/short_lived_windows_accounts.yml rename to detections/endpoint/short_lived_windows_accounts.yml diff --git a/detections/single_letter_process_on_endpoint.yml b/detections/endpoint/single_letter_process_on_endpoint.yml similarity index 100% rename from detections/single_letter_process_on_endpoint.yml rename to detections/endpoint/single_letter_process_on_endpoint.yml diff --git a/detections/spike_in_file_writes.yml b/detections/endpoint/spike_in_file_writes.yml similarity index 100% rename from detections/spike_in_file_writes.yml rename to detections/endpoint/spike_in_file_writes.yml diff --git a/detections/suspicious_changes_to_file_associations.yml b/detections/endpoint/suspicious_changes_to_file_associations.yml similarity index 100% rename from detections/suspicious_changes_to_file_associations.yml rename to detections/endpoint/suspicious_changes_to_file_associations.yml diff --git a/detections/suspicious_file_write.yml b/detections/endpoint/suspicious_file_write.yml similarity index 100% rename from detections/suspicious_file_write.yml rename to detections/endpoint/suspicious_file_write.yml diff --git a/detections/suspicious_java_classes.yml b/detections/endpoint/suspicious_java_classes.yml similarity index 100% rename from detections/suspicious_java_classes.yml rename to detections/endpoint/suspicious_java_classes.yml diff --git a/detections/suspicious_lnk_file_launching_a_process.yml b/detections/endpoint/suspicious_lnk_file_launching_a_process.yml similarity index 100% rename from detections/suspicious_lnk_file_launching_a_process.yml rename to detections/endpoint/suspicious_lnk_file_launching_a_process.yml diff --git a/detections/suspicious_reg_exe_process.yml b/detections/endpoint/suspicious_reg_exe_process.yml similarity index 100% rename from detections/suspicious_reg_exe_process.yml rename to detections/endpoint/suspicious_reg_exe_process.yml diff --git a/detections/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml similarity index 100% rename from detections/suspicious_wevtutil_usage.yml rename to detections/endpoint/suspicious_wevtutil_usage.yml diff --git a/detections/suspicious_writes_to_system_volume_information.yml b/detections/endpoint/suspicious_writes_to_system_volume_information.yml similarity index 100% rename from detections/suspicious_writes_to_system_volume_information.yml rename to detections/endpoint/suspicious_writes_to_system_volume_information.yml diff --git a/detections/suspicious_writes_to_windows_recycle_bin.yml b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml similarity index 100% rename from detections/suspicious_writes_to_windows_recycle_bin.yml rename to detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml diff --git a/detections/system_process_running_unexpected_location___ssa.yml b/detections/endpoint/system_process_running_unexpected_location___ssa.yml similarity index 100% rename from detections/system_process_running_unexpected_location___ssa.yml rename to detections/endpoint/system_process_running_unexpected_location___ssa.yml diff --git a/detections/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml similarity index 100% rename from detections/system_processes_run_from_unexpected_locations.yml rename to detections/endpoint/system_processes_run_from_unexpected_locations.yml diff --git a/detections/uncommon_processes_on_endpoint.yml b/detections/endpoint/uncommon_processes_on_endpoint.yml similarity index 100% rename from detections/uncommon_processes_on_endpoint.yml rename to detections/endpoint/uncommon_processes_on_endpoint.yml diff --git a/detections/unload_sysmon_filter_driver.yml b/detections/endpoint/unload_sysmon_filter_driver.yml similarity index 100% rename from detections/unload_sysmon_filter_driver.yml rename to detections/endpoint/unload_sysmon_filter_driver.yml diff --git a/detections/unsigned_image_loaded_by_lsass.yml b/detections/endpoint/unsigned_image_loaded_by_lsass.yml similarity index 100% rename from detections/unsigned_image_loaded_by_lsass.yml rename to detections/endpoint/unsigned_image_loaded_by_lsass.yml diff --git a/detections/unsuccessful_netbackup_backups.yml b/detections/endpoint/unsuccessful_netbackup_backups.yml similarity index 100% rename from detections/unsuccessful_netbackup_backups.yml rename to detections/endpoint/unsuccessful_netbackup_backups.yml diff --git a/detections/unusual_lolbas_in_short_period_of_time___ssa.yml b/detections/endpoint/unusual_lolbas_in_short_period_of_time___ssa.yml similarity index 100% rename from detections/unusual_lolbas_in_short_period_of_time___ssa.yml rename to detections/endpoint/unusual_lolbas_in_short_period_of_time___ssa.yml diff --git a/detections/unusually_long_command_line.yml b/detections/endpoint/unusually_long_command_line.yml similarity index 100% rename from detections/unusually_long_command_line.yml rename to detections/endpoint/unusually_long_command_line.yml diff --git a/detections/unusually_long_command_line___mltk.yml b/detections/endpoint/unusually_long_command_line___mltk.yml similarity index 100% rename from detections/unusually_long_command_line___mltk.yml rename to detections/endpoint/unusually_long_command_line___mltk.yml diff --git a/detections/unusually_long_command_line___ssa.yml b/detections/endpoint/unusually_long_command_line___ssa.yml similarity index 100% rename from detections/unusually_long_command_line___ssa.yml rename to detections/endpoint/unusually_long_command_line___ssa.yml diff --git a/detections/unusually_long_content_type_length.yml b/detections/endpoint/unusually_long_content_type_length.yml similarity index 100% rename from detections/unusually_long_content_type_length.yml rename to detections/endpoint/unusually_long_content_type_length.yml diff --git a/detections/usn_journal_deletion.yml b/detections/endpoint/usn_journal_deletion.yml similarity index 100% rename from detections/usn_journal_deletion.yml rename to detections/endpoint/usn_journal_deletion.yml diff --git a/detections/web_servers_executing_suspicious_processes.yml b/detections/endpoint/web_servers_executing_suspicious_processes.yml similarity index 100% rename from detections/web_servers_executing_suspicious_processes.yml rename to detections/endpoint/web_servers_executing_suspicious_processes.yml diff --git a/detections/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml similarity index 100% rename from detections/windows_event_log_cleared.yml rename to detections/endpoint/windows_event_log_cleared.yml diff --git a/detections/windows_hosts_file_modification.yml b/detections/endpoint/windows_hosts_file_modification.yml similarity index 100% rename from detections/windows_hosts_file_modification.yml rename to detections/endpoint/windows_hosts_file_modification.yml diff --git a/detections/wmi_permanent_event_subscription.yml b/detections/endpoint/wmi_permanent_event_subscription.yml similarity index 100% rename from detections/wmi_permanent_event_subscription.yml rename to detections/endpoint/wmi_permanent_event_subscription.yml diff --git a/detections/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml similarity index 100% rename from detections/wmi_permanent_event_subscription___sysmon.yml rename to detections/endpoint/wmi_permanent_event_subscription___sysmon.yml diff --git a/detections/wmi_temporary_event_subscription.yml b/detections/endpoint/wmi_temporary_event_subscription.yml similarity index 100% rename from detections/wmi_temporary_event_subscription.yml rename to detections/endpoint/wmi_temporary_event_subscription.yml diff --git a/detections/clients_connecting_to_multiple_dns_servers.yml b/detections/network/clients_connecting_to_multiple_dns_servers.yml similarity index 100% rename from detections/clients_connecting_to_multiple_dns_servers.yml rename to detections/network/clients_connecting_to_multiple_dns_servers.yml diff --git a/detections/detect_arp_poisoning.yml b/detections/network/detect_arp_poisoning.yml similarity index 100% rename from detections/detect_arp_poisoning.yml rename to detections/network/detect_arp_poisoning.yml diff --git a/detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml b/detections/network/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml similarity index 100% rename from detections/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml rename to detections/network/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml diff --git a/detections/detect_hosts_connecting_to_dynamic_domain_providers.yml b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml similarity index 100% rename from detections/detect_hosts_connecting_to_dynamic_domain_providers.yml rename to detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml diff --git a/detections/detect_large_outbound_icmp_packets.yml b/detections/network/detect_large_outbound_icmp_packets.yml similarity index 100% rename from detections/detect_large_outbound_icmp_packets.yml rename to detections/network/detect_large_outbound_icmp_packets.yml diff --git a/detections/detect_long_dns_txt_record_response.yml b/detections/network/detect_long_dns_txt_record_response.yml similarity index 100% rename from detections/detect_long_dns_txt_record_response.yml rename to detections/network/detect_long_dns_txt_record_response.yml diff --git a/detections/detect_outbound_smb_traffic.yml b/detections/network/detect_outbound_smb_traffic.yml similarity index 100% rename from detections/detect_outbound_smb_traffic.yml rename to detections/network/detect_outbound_smb_traffic.yml diff --git a/detections/detect_rogue_dhcp_server.yml b/detections/network/detect_rogue_dhcp_server.yml similarity index 100% rename from detections/detect_rogue_dhcp_server.yml rename to detections/network/detect_rogue_dhcp_server.yml diff --git a/detections/detect_unauthorized_assets_by_mac_address.yml b/detections/network/detect_unauthorized_assets_by_mac_address.yml similarity index 100% rename from detections/detect_unauthorized_assets_by_mac_address.yml rename to detections/network/detect_unauthorized_assets_by_mac_address.yml diff --git a/detections/detect_zerologon_via_zeek.yml b/detections/network/detect_zerologon_via_zeek.yml similarity index 100% rename from detections/detect_zerologon_via_zeek.yml rename to detections/network/detect_zerologon_via_zeek.yml diff --git a/detections/detection_of_dns_tunnels.yml b/detections/network/detection_of_dns_tunnels.yml similarity index 100% rename from detections/detection_of_dns_tunnels.yml rename to detections/network/detection_of_dns_tunnels.yml diff --git a/detections/dns_query_length_outliers___mltk.yml b/detections/network/dns_query_length_outliers___mltk.yml similarity index 100% rename from detections/dns_query_length_outliers___mltk.yml rename to detections/network/dns_query_length_outliers___mltk.yml diff --git a/detections/dns_query_length_with_high_standard_deviation.yml b/detections/network/dns_query_length_with_high_standard_deviation.yml similarity index 100% rename from detections/dns_query_length_with_high_standard_deviation.yml rename to detections/network/dns_query_length_with_high_standard_deviation.yml diff --git a/detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml b/detections/network/dns_query_requests_resolved_by_unauthorized_dns_servers.yml similarity index 100% rename from detections/dns_query_requests_resolved_by_unauthorized_dns_servers.yml rename to detections/network/dns_query_requests_resolved_by_unauthorized_dns_servers.yml diff --git a/detections/dns_record_changed.yml b/detections/network/dns_record_changed.yml similarity index 100% rename from detections/dns_record_changed.yml rename to detections/network/dns_record_changed.yml diff --git a/detections/excessive_dns_failures.yml b/detections/network/excessive_dns_failures.yml similarity index 100% rename from detections/excessive_dns_failures.yml rename to detections/network/excessive_dns_failures.yml diff --git a/detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml b/detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml similarity index 100% rename from detections/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml rename to detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml diff --git a/detections/large_volume_of_dns_any_queries.yml b/detections/network/large_volume_of_dns_any_queries.yml similarity index 100% rename from detections/large_volume_of_dns_any_queries.yml rename to detections/network/large_volume_of_dns_any_queries.yml diff --git a/detections/monitor_dns_for_brand_abuse.yml b/detections/network/monitor_dns_for_brand_abuse.yml similarity index 100% rename from detections/monitor_dns_for_brand_abuse.yml rename to detections/network/monitor_dns_for_brand_abuse.yml diff --git a/detections/prohibited_network_traffic_allowed.yml b/detections/network/prohibited_network_traffic_allowed.yml similarity index 100% rename from detections/prohibited_network_traffic_allowed.yml rename to detections/network/prohibited_network_traffic_allowed.yml diff --git a/detections/protocol_or_port_mismatch.yml b/detections/network/protocol_or_port_mismatch.yml similarity index 100% rename from detections/protocol_or_port_mismatch.yml rename to detections/network/protocol_or_port_mismatch.yml diff --git a/detections/protocols_passing_authentication_in_cleartext.yml b/detections/network/protocols_passing_authentication_in_cleartext.yml similarity index 100% rename from detections/protocols_passing_authentication_in_cleartext.yml rename to detections/network/protocols_passing_authentication_in_cleartext.yml diff --git a/detections/remote_desktop_network_bruteforce.yml b/detections/network/remote_desktop_network_bruteforce.yml similarity index 100% rename from detections/remote_desktop_network_bruteforce.yml rename to detections/network/remote_desktop_network_bruteforce.yml diff --git a/detections/remote_desktop_network_traffic.yml b/detections/network/remote_desktop_network_traffic.yml similarity index 100% rename from detections/remote_desktop_network_traffic.yml rename to detections/network/remote_desktop_network_traffic.yml diff --git a/detections/smb_traffic_spike.yml b/detections/network/smb_traffic_spike.yml similarity index 100% rename from detections/smb_traffic_spike.yml rename to detections/network/smb_traffic_spike.yml diff --git a/detections/smb_traffic_spike___mltk.yml b/detections/network/smb_traffic_spike___mltk.yml similarity index 100% rename from detections/smb_traffic_spike___mltk.yml rename to detections/network/smb_traffic_spike___mltk.yml diff --git a/detections/tor_traffic.yml b/detections/network/tor_traffic.yml similarity index 100% rename from detections/tor_traffic.yml rename to detections/network/tor_traffic.yml diff --git a/detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml b/detections/web/detect_attackers_scanning_for_vulnerable_jboss_servers.yml similarity index 100% rename from detections/detect_attackers_scanning_for_vulnerable_jboss_servers.yml rename to detections/web/detect_attackers_scanning_for_vulnerable_jboss_servers.yml diff --git a/detections/detect_f5_tmui_rct_cve_2020_5902.yml b/detections/web/detect_f5_tmui_rct_cve_2020_5902.yml similarity index 100% rename from detections/detect_f5_tmui_rct_cve_2020_5902.yml rename to detections/web/detect_f5_tmui_rct_cve_2020_5902.yml diff --git a/detections/detect_malicious_requests_to_exploit_jboss_servers.yml b/detections/web/detect_malicious_requests_to_exploit_jboss_servers.yml similarity index 100% rename from detections/detect_malicious_requests_to_exploit_jboss_servers.yml rename to detections/web/detect_malicious_requests_to_exploit_jboss_servers.yml diff --git a/detections/detect_web_traffic_to_dynamic_domain_providers.yml b/detections/web/detect_web_traffic_to_dynamic_domain_providers.yml similarity index 100% rename from detections/detect_web_traffic_to_dynamic_domain_providers.yml rename to detections/web/detect_web_traffic_to_dynamic_domain_providers.yml diff --git a/detections/monitor_web_traffic_for_brand_abuse.yml b/detections/web/monitor_web_traffic_for_brand_abuse.yml similarity index 100% rename from detections/monitor_web_traffic_for_brand_abuse.yml rename to detections/web/monitor_web_traffic_for_brand_abuse.yml diff --git a/detections/sql_injection_with_long_urls.yml b/detections/web/sql_injection_with_long_urls.yml similarity index 100% rename from detections/sql_injection_with_long_urls.yml rename to detections/web/sql_injection_with_long_urls.yml diff --git a/detections/web_fraud___account_harvesting.yml b/detections/web/web_fraud___account_harvesting.yml similarity index 100% rename from detections/web_fraud___account_harvesting.yml rename to detections/web/web_fraud___account_harvesting.yml diff --git a/detections/web_fraud___anomalous_user_clickspeed.yml b/detections/web/web_fraud___anomalous_user_clickspeed.yml similarity index 100% rename from detections/web_fraud___anomalous_user_clickspeed.yml rename to detections/web/web_fraud___anomalous_user_clickspeed.yml diff --git a/detections/web_fraud___password_sharing_across_accounts.yml b/detections/web/web_fraud___password_sharing_across_accounts.yml similarity index 100% rename from detections/web_fraud___password_sharing_across_accounts.yml rename to detections/web/web_fraud___password_sharing_across_accounts.yml From 4a818660450f1d46c057ccff17f46f8b499a6180 Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 7 Oct 2020 23:11:11 -0400 Subject: [PATCH 2/6] adjusted validate to use sub folders --- bin/validate.py | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/bin/validate.py b/bin/validate.py index 39fad27ce2..0246833c06 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -13,7 +13,7 @@ import argparse import datetime import string import re -from os import path +from os import path, walk def validate_schema(REPO_PATH, type, objects): @@ -28,9 +28,13 @@ def validate_schema(REPO_PATH, type, objects): except IOError: print("ERROR: reading schema file {0}".format(schema_file)) - manifest_files = path.join(path.expanduser(REPO_PATH), type + '/*.yml') + manifest_files = [] + for root, dirs, files in walk(REPO_PATH + "/" + type): + for file in files: + if file.endswith(".yml"): + manifest_files.append((path.join(root, file))) - for manifest_file in glob.glob(manifest_files): + for manifest_file in manifest_files: if verbose: print("processing manifest {0}".format(manifest_file)) @@ -42,7 +46,6 @@ def validate_schema(REPO_PATH, type, objects): print("Error reading {0}".format(manifest_file)) error = True continue - try: jsonschema.validate(instance=object, schema=schema) except jsonschema.exceptions.ValidationError as json_ve: From eca687e7fb2183561c82b23fd421eb8b7751f95d Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 7 Oct 2020 23:11:27 -0400 Subject: [PATCH 3/6] WIP of generate to support subfolders --- bin/generate.py | 20 ++++++++++++++++++-- 1 file changed, 18 insertions(+), 2 deletions(-) diff --git a/bin/generate.py b/bin/generate.py index d8d25d4de0..defee079a9 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -14,6 +14,7 @@ from jinja2 import Environment, FileSystemLoader import re from attackcti import attack_client import csv +import json # global variables @@ -569,15 +570,23 @@ if __name__ == "__main__": macros = load_objects("macros/*.yml", VERBOSE) lookups = load_objects("lookups/*.yml", VERBOSE) baselines = load_objects("baselines/*.yml", VERBOSE) - detections = load_objects("detections/*.yml", VERBOSE) responses = load_objects("responses/*.yml", VERBOSE) response_tasks = load_objects("response_tasks/*.yml", VERBOSE) deployments = load_objects("deployments/*.yml", VERBOSE) + # process all detections + detections = [] + application = load_objects("detections/applicaton/*.yml", VERBOSE) + web = load_objects("detections/web/*.yml", VERBOSE) + network = load_objects("detections/network/*.yml", VERBOSE) + endpoint = load_objects("detections/endpoint/*.yml", VERBOSE) + cloud = load_objects("detections/cloud/*.yml", VERBOSE) + detections = application + web + network + endpoint + cloud + try: if VERBOSE: print("generating Mitre lookups") - generate_mitre_lookup() + #generate_mitre_lookup() except: print("WARNING: Generation of Mitre lookup failed.") @@ -585,6 +594,13 @@ if __name__ == "__main__": lookups_path = generate_collections_conf(lookups) detections = sorted(detections, key=lambda d: d['name']) + + # only use ESCU detections to the configurations + detections = [object for object in detections if object["type"].lower() == "escu"] + + for i in detections: + print(json.dumps(i,indent=2)) + #print(detections) response_tasks = sorted(response_tasks, key=lambda i: i['name']) baselines = sorted(baselines, key=lambda b: b['name']) detection_path = generate_savedsearches_conf(detections, response_tasks, baselines, deployments) From 41c0ddeda3646fb241dc86a58a94c9a3ab56d7ea Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 7 Oct 2020 23:27:42 -0400 Subject: [PATCH 4/6] adjusted generate --- bin/generate.py | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/bin/generate.py b/bin/generate.py index defee079a9..b5f457b70e 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -14,7 +14,6 @@ from jinja2 import Environment, FileSystemLoader import re from attackcti import attack_client import csv -import json # global variables @@ -576,7 +575,7 @@ if __name__ == "__main__": # process all detections detections = [] - application = load_objects("detections/applicaton/*.yml", VERBOSE) + application = load_objects("detections/application/*.yml", VERBOSE) web = load_objects("detections/web/*.yml", VERBOSE) network = load_objects("detections/network/*.yml", VERBOSE) endpoint = load_objects("detections/endpoint/*.yml", VERBOSE) @@ -598,9 +597,6 @@ if __name__ == "__main__": # only use ESCU detections to the configurations detections = [object for object in detections if object["type"].lower() == "escu"] - for i in detections: - print(json.dumps(i,indent=2)) - #print(detections) response_tasks = sorted(response_tasks, key=lambda i: i['name']) baselines = sorted(baselines, key=lambda b: b['name']) detection_path = generate_savedsearches_conf(detections, response_tasks, baselines, deployments) From 8f28d1d2229dfe6907fb05c2d782964fef7605e0 Mon Sep 17 00:00:00 2001 From: divious1 Date: Wed, 7 Oct 2020 23:39:55 -0400 Subject: [PATCH 5/6] adjusted common generate scripts --- bin/doc-gen.py | 10 ++++++++-- bin/generate-actors-map.py | 8 +++++++- bin/generate-coverage-map.py | 10 +++++++++- 3 files changed, 24 insertions(+), 4 deletions(-) diff --git a/bin/doc-gen.py b/bin/doc-gen.py index 8e1cdf0a12..7d288988bb 100644 --- a/bin/doc-gen.py +++ b/bin/doc-gen.py @@ -684,7 +684,13 @@ if __name__ == "__main__": gmd = args.gen_markdown_docs stories = load_objects("stories/*.yml") - detections = load_objects("detections/*.yml") + detections = [] + application = load_objects("detections/application/*.yml") + web = load_objects("detections/web/*.yml") + network = load_objects("detections/network/*.yml") + endpoint = load_objects("detections/endpoint/*.yml") + cloud = load_objects("detections/cloud/*.yml") + detections = application + web + network + endpoint + cloud # complete_stories = generate_stories(REPO_PATH, verbose) # complete_detections = generate_detections(REPO_PATH, complete_stories) @@ -697,7 +703,7 @@ if __name__ == "__main__": if gmd: story_count, path = write_markdown_docs(stories, detections, OUTPUT_DIR) - print("{0} story documents have been successfully written to {1}".format(story_count, path)) + print("{0} story documents have been successfully written to {1}".format(story_count, path)) else: print("--gen_splunk_docs was set to false, not generating splunk documentation") diff --git a/bin/generate-actors-map.py b/bin/generate-actors-map.py index 936b7c0bbb..ca097f69d2 100644 --- a/bin/generate-actors-map.py +++ b/bin/generate-actors-map.py @@ -31,7 +31,13 @@ def main(argv): counted_techniques, max_count = count_techniques(techniques, all_techniques) print("load detections techniques") - detections = load_objects(path.join(cmdargs.projects_path),'detections/*.yml') + detections = [] + application = load_objects(path.join(cmdargs.projects_path),'detections/application/*.yml') + web = load_objects(path.join(cmdargs.projects_path),'detections/web/*.yml') + network = load_objects(path.join(cmdargs.projects_path),'detections/network/*.yml') + endpoint = load_objects(path.join(cmdargs.projects_path),'detections/endpoint/*.yml') + cloud = load_objects(path.join(cmdargs.projects_path),'detections/cloud/*.yml') + detections = application + web + network + endpoint + cloud print("get matched techniques") matched_techniques = get_matched_techniques(counted_techniques, detections) diff --git a/bin/generate-coverage-map.py b/bin/generate-coverage-map.py index 1229816b4a..bf31e96564 100644 --- a/bin/generate-coverage-map.py +++ b/bin/generate-coverage-map.py @@ -28,7 +28,15 @@ def main(argv): techniques = get_all_techniques(cmdargs.projects_path) print("load detections") - detections = load_objects(path.join(cmdargs.projects_path),'detections/*.yml') + detections = [] + application = load_objects(path.join(cmdargs.projects_path),'detections/application/*.yml') + web = load_objects(path.join(cmdargs.projects_path),'detections/web/*.yml') + network = load_objects(path.join(cmdargs.projects_path),'detections/network/*.yml') + endpoint = load_objects(path.join(cmdargs.projects_path),'detections/endpoint/*.yml') + cloud = load_objects(path.join(cmdargs.projects_path),'detections/cloud/*.yml') + detections = application + web + network + endpoint + cloud + + #detections = load_objects(path.join(cmdargs.projects_path),'detections/*.yml') print("get matched techniques") matched_techniques = get_matched_techniques(techniques, detections) From 556fbd12a34655addbf34706b7e93d1145a31d70 Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 13 Oct 2020 20:25:11 -0400 Subject: [PATCH 6/6] udpating to use glob --- bin/doc-gen.py | 7 +------ bin/generate-actors-map.py | 7 +------ bin/generate-coverage-map.py | 9 +-------- bin/generate.py | 9 ++------- 4 files changed, 5 insertions(+), 27 deletions(-) diff --git a/bin/doc-gen.py b/bin/doc-gen.py index 7d288988bb..2f19ab4a00 100644 --- a/bin/doc-gen.py +++ b/bin/doc-gen.py @@ -685,12 +685,7 @@ if __name__ == "__main__": stories = load_objects("stories/*.yml") detections = [] - application = load_objects("detections/application/*.yml") - web = load_objects("detections/web/*.yml") - network = load_objects("detections/network/*.yml") - endpoint = load_objects("detections/endpoint/*.yml") - cloud = load_objects("detections/cloud/*.yml") - detections = application + web + network + endpoint + cloud + detections = load_objects("detections/*/*.yml") # complete_stories = generate_stories(REPO_PATH, verbose) # complete_detections = generate_detections(REPO_PATH, complete_stories) diff --git a/bin/generate-actors-map.py b/bin/generate-actors-map.py index ca097f69d2..5c12dafe55 100644 --- a/bin/generate-actors-map.py +++ b/bin/generate-actors-map.py @@ -32,12 +32,7 @@ def main(argv): print("load detections techniques") detections = [] - application = load_objects(path.join(cmdargs.projects_path),'detections/application/*.yml') - web = load_objects(path.join(cmdargs.projects_path),'detections/web/*.yml') - network = load_objects(path.join(cmdargs.projects_path),'detections/network/*.yml') - endpoint = load_objects(path.join(cmdargs.projects_path),'detections/endpoint/*.yml') - cloud = load_objects(path.join(cmdargs.projects_path),'detections/cloud/*.yml') - detections = application + web + network + endpoint + cloud + detections = load_objects(path.join(cmdargs.projects_path),'detections/*/*.yml') print("get matched techniques") matched_techniques = get_matched_techniques(counted_techniques, detections) diff --git a/bin/generate-coverage-map.py b/bin/generate-coverage-map.py index bf31e96564..8866809359 100644 --- a/bin/generate-coverage-map.py +++ b/bin/generate-coverage-map.py @@ -29,14 +29,7 @@ def main(argv): print("load detections") detections = [] - application = load_objects(path.join(cmdargs.projects_path),'detections/application/*.yml') - web = load_objects(path.join(cmdargs.projects_path),'detections/web/*.yml') - network = load_objects(path.join(cmdargs.projects_path),'detections/network/*.yml') - endpoint = load_objects(path.join(cmdargs.projects_path),'detections/endpoint/*.yml') - cloud = load_objects(path.join(cmdargs.projects_path),'detections/cloud/*.yml') - detections = application + web + network + endpoint + cloud - - #detections = load_objects(path.join(cmdargs.projects_path),'detections/*.yml') + detections = load_objects(path.join(cmdargs.projects_path),'detections/*/*.yml') print("get matched techniques") matched_techniques = get_matched_techniques(techniques, detections) diff --git a/bin/generate.py b/bin/generate.py index b5f457b70e..6866036659 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -575,17 +575,12 @@ if __name__ == "__main__": # process all detections detections = [] - application = load_objects("detections/application/*.yml", VERBOSE) - web = load_objects("detections/web/*.yml", VERBOSE) - network = load_objects("detections/network/*.yml", VERBOSE) - endpoint = load_objects("detections/endpoint/*.yml", VERBOSE) - cloud = load_objects("detections/cloud/*.yml", VERBOSE) - detections = application + web + network + endpoint + cloud + detections = load_objects("detections/*/*.yml", VERBOSE) try: if VERBOSE: print("generating Mitre lookups") - #generate_mitre_lookup() + generate_mitre_lookup() except: print("WARNING: Generation of Mitre lookup failed.")