From f6bc3566f30de5cb17898a2ee89fc43fb25328ff Mon Sep 17 00:00:00 2001 From: divious1 Date: Tue, 26 Mar 2019 13:36:04 -0400 Subject: [PATCH] updated dirs and README --- README.md | 9 ++++++++- .../support_add_prohibited_processes_to_es.json | 0 .../support_approved_aws_service_accounts.json | 0 .../support_assets_sorted_by_category.json | 0 .../support_baseline_api_calls_per_user_arn.json | 0 .../support_baseline_aws_regions.json | 0 .../support_baseline_blocked_vpc_traffic.json | 0 .../support_baseline_network_acl_modifications.json | 0 .../support_baseline_s3_deletion_by_arn.json | 0 .../support_baseline_security_group_activity_by_arn.json | 0 .../support_brand_abuse_dnstwist_domains.json | 0 .../support_discover_dns_records.json | 0 .../support_identify_ports_on_network.json | 0 .../support_identify_systems_creating_rdp_traffic.json | 0 .../support_identify_systems_receiving_rdp_traffic.json | 0 .../support_identify_systems_using_remote_desktop.json | 0 .../support_monitor_successful_backups.json | 0 .../support_monitor_successful_windows_updates.json | 0 .../support_monitor_unsuccessful_backups.json | 0 .../support_monitor_unsuccessful_windows_updates.json | 0 ...pport_previously_seen_aws_cross_account_activity.json | 0 .../support_previously_seen_cmd_arguments.json | 0 .../support_previously_seen_ec2_amis.json | 0 .../support_previously_seen_ec2_instance_types.json | 0 .../support_previously_seen_ec2_launches_by_user.json | 0 .../support_previously_seen_ec2_modifications.json | 0 ...upport_previously_seen_provisioning_activity_src.json | 0 .../support_previously_seen_s3_remote_ip.json | 0 .../support_previously_seen_user_roles.json | 0 .../support_previously_seen_users.json | 0 .../support_previously_seen_windows_service_starts.json | 0 ...support_systems_ready_for_spectre_meltdown_patch.json | 0 bin/config.ini | 2 -- .../detection_abnormally_high_instance_termination.json | 0 .../detection_abnormally_high_instances_launched.json | 0 .../detection_account_harvesting.json | 0 .../detection_acl_with_open_ports.json | 0 .../detection_activity_related_to_pass_the_hash.json | 0 .../detection_add_to_untrust_cert_store.json | 0 .../detection_anomalous_webclick.json | 0 ...n_api_acitivity_from_previously_unseen_user_role.json | 0 ..._attackers_scanning_for_vulnerable_jboss_servers.json | 0 .../detection_attrib_to_hide_files.json | 0 ...etection_aws_activity_from_non_approved_accounts.json | 0 .../detection_aws_activity_in_new_region.json | 0 ...s_cloud_provisioning_from_previously_unseen_city.json | 0 ...loud_provisioning_from_previously_unseen_country.json | 0 ...aws_cloud_provisioning_from_previously_unseen_ip.json | 0 ...cloud_provisioning_from_previously_unseen_region.json | 0 ...tion_aws_cross_account_activity_from_new_account.json | 0 .../detection_aws_spike_acl_activity.json | 0 .../detection_badrabbit_schtasks.json | 0 .../detection_batch_file_write_system32.json | 0 {searches => detections}/detection_brand_abuse_dns.json | 0 .../detection_brand_abuse_email.json | 0 {searches => detections}/detection_brand_abuse_web.json | 0 .../detection_change_file_association.json | 0 .../detection_children_of_spoolsv.json | 0 ...ction_clients_connecting_to_multiple_dns_servers.json | 0 .../detection_common_ransomware_extensions.json | 0 .../detection_common_ransomware_notes.json | 0 .../detection_create_hidden_shares.json | 0 .../detection_create_local_admin_via_net.json | 0 .../detection_cred_dump_via_reg.json | 0 {searches => detections}/detection_cscript_via_cmd.json | 0 .../detection_delete_shadow_copies.json | 0 .../detection_deletion_network_acl.json | 0 .../detection_disable_remote_uac.json | 0 .../detection_dns_amplification_any_query.json | 0 ...on_dns_query_length_with_high_standard_deviation.json | 0 .../detection_dns_record_changed.json | 0 {searches => detections}/detection_dns_tunnelling.json | 0 .../detection_dragonfly_schtasks.json | 0 {searches => detections}/detection_dyn_dns_queries.json | 0 .../detection_dyn_dns_web_traffic.json | 0 ...n_ec2_instance_created_by_previously_unseen_user.json | 0 ..._ec2_instance_modified_by_previously_unseen_user.json | 0 ..._ec2_instance_started_with_previously_unseen_ami.json | 0 ...nce_started_with_previously_unseen_instance_type.json | 0 .../detection_email_attachments_with_spaces.json | 0 .../detection_email_files_not_in_outlook_directory.json | 0 ...mailserver_high_volume_outbound_traffic_to_hosts.json | 0 .../detection_excessive_dns_failures.json | 0 .../detection_excessive_lockouts_from_endpoint.json | 0 .../detection_excessive_user_account_lockouts.json | 0 .../detection_execution_of_nirsoft_tools.json | 0 .../detection_file_write_spikes.json | 0 .../detection_first_time_seen_cmd_line.json | 0 ...etection_first_time_seen_running_windows_service.json | 0 .../detection_fsutil_deleting_journals.json | 0 .../detection_hosts_file_modification.json | 0 ...g_high_volume_network_traffic_from_email_servers.json | 0 .../detection_large_icmp_outbound.json | 0 .../detection_local_admin_account_creation.json | 0 .../detection_long_dns_text_response.json | 0 ...tion_malicious_application_shimming_via_registry.json | 0 ...l_process_connect_to_internet_with_hidden_window.json | 0 ...ion_malicious_powershell_process_encoded_command.json | 0 ...etection_malicious_powershell_process_execpolicy.json | 0 ...powershell_process_multiple_suspicious_arguments.json | 0 ...icious_powershell_process_obfuscation_techniques.json | 0 ...tion_malicious_requests_to_exploit_jboss_servers.json | 0 .../detection_mshta_launching_scripts.json | 0 .../detection_netbackup_failed_backup.json | 0 .../detection_netbackup_no_backups_in_time_period.json | 0 .../detection_netsh_launching_process.json | 0 .../detection_new_aws_console_login_by_user.json | 0 .../detection_new_connections_to_routers.json | 0 .../detection_new_open_s3_buckets.json | 0 .../detection_new_user_accounts.json | 0 .../detection_no_win_updates_in_timeframe.json | 0 .../detection_open_redirect_in_splunk_web.json | 0 .../detection_osx_coldroot_pack.json | 0 .../detection_osx_keyboard_taps.json | 0 .../detection_outbound_smb_connections.json | 0 .../detection_overwrite_accessibility_binaries.json | 0 {searches => detections}/detection_password_sharing.json | 0 .../detection_path_interception_program.exe.json | 0 .../detection_port_monitor_via_registry.json | 0 .../detection_powershell_get_sedebug.json | 0 .../detection_powershell_read_from_lsass.json | 0 .../detection_powershell_reg_key_mod.json | 0 .../detection_process_launching_netsh.json | 0 .../detection_process_with_double_extension.json | 0 .../detection_process_with_spaces_before_extension.json | 0 .../detection_prohibited_allowed_through_fw.json | 0 .../detection_prohibited_apps_spawning_cmdprompt.json | 0 .../detection_prohibited_software_on_endpoint.json | 0 .../detection_protocol_mismatch.json | 0 .../detection_protocols_authenticating_in_cleartext.json | 0 .../detection_psexec_accepteula.json | 0 .../detection_rare_executables_on_endpoint.json | 0 .../detection_reg_manipulating_services.json | 0 .../detection_reg_used_to_hide_files.json | 0 .../detection_registry_persistence.json | 0 .../detection_registry_privilege_escalation.json | 0 .../detection_remote_desktop_bruteforce.json | 0 .../detection_remote_desktop_network_traffic.json | 0 ...tection_remote_desktop_process_running_on_system.json | 0 .../detection_remote_registry_modifications.json | 0 .../detection_remote_wmi_command_attempt.json | 0 .../detection_remote_wmi_process_instantiation.json | 0 .../detection_rundll_loading_dll_by_ordinal.json | 0 .../detection_s3_access_from_new_ip.json | 0 .../detection_samsam_payload_extensions.json | 0 .../detection_samsam_test_file_write.json | 0 .../detection_sc_manipulating_services.json | 0 .../detection_schtasks_forced_reboot.json | 0 ...tection_schtasks_scheduling_job_on_remote_system.json | 0 .../detection_shim_database_file_creation.json | 0 .../detection_shim_database_installation.json | 0 .../detection_short_lived_accounts.json | 0 .../detection_single_letter_executables.json | 0 .../detection_smb_traffic_spike.json | 0 {searches => detections}/detection_sncd_processes.json | 0 .../detection_spectre_meltdown_vulnerabilities.json | 0 .../detection_spike_aws_api_call_per_account.json | 0 .../detection_spike_aws_security_group_activity.json | 0 .../detection_spike_s3_deletion.json | 0 .../detection_spike_vpc_blocked_traffic.json | 0 .../detection_splunk_information_disclosure.json | 0 .../detection_sql_injection_with_long_urls.json | 0 .../detection_stop_security_services.json | 0 .../detection_suspicious_email_attachments.json | 0 .../detection_suspicious_file_writes.json | 0 .../detection_suspicious_java_classes.json | 0 .../detection_suspicious_reg_process.json | 0 .../detection_suspicious_wevtutil_usage.json | 0 .../detection_suspicious_write_to_recycler.json | 0 .../detection_suspicious_write_to_sysvol.json | 0 ...n_system_processes_run_from_unexpected_locations.json | 0 {searches => detections}/detection_tor_traffic.json | 0 .../detection_unauthorized_assets_via_mac_address.json | 0 .../detection_unauthorized_dns_servers.json | 0 .../detection_uncommon_processes.json | 0 .../detection_unusually_long_commandlines.json | 0 .../detection_unusually_long_content-type_length.json | 0 {searches => detections}/detection_usb_insertion.json | 0 .../detection_users_without_mfa.json | 0 ...ction_web_servers_executing_suspicious_processes.json | 0 .../detection_windows_event_log_cleared.json | 0 .../detection_wmi_perm_event_subscription.json | 0 .../detection_wmi_perm_event_subscription_sysmon.json | 0 .../detection_wmi_process_launch.json | 0 .../detection_wmi_script_execution.json | 0 .../detection_wmi_temp_event_subscription.json | 0 .../contextual_aws_network_interface_details.json | 0 .../contextual_aws_s3_bucket_details.json | 0 .../contextual_first_occurrence_mac_address.json | 0 .../contextual_get_acl_details.json | 0 .../contextual_get_authentication_logs_for_endpoint.json | 0 .../contextual_get_backup_logs_for_endpoint.json | 0 .../contextual_get_ec2_details_by_instance_id.json | 0 .../contextual_get_ec2_launch_details.json | 0 .../contextual_get_notable_history_for_endpoint.json | 0 .../contextual_get_notable_info.json | 0 .../contextual_get_risk_for_endpoint.json | 0 .../contextual_get_risk_for_user.json | 0 .../contextual_get_update_logs_for_endpoint.json | 0 .../contextual_get_user_info_from_identity_table.json | 0 .../contextual_get_vulnerability_logs_for_endpoint.json | 0 .../investigative_aws_activity_via_region.json | 0 .../investigative_aws_user_activities_by_user_field.json | 0 .../investigative_aws_user_activity_by_accesskeyid.json | 0 .../investigative_aws_user_activity_by_src_user.json | 0 .../investigative_dns_server_history.json | 0 .../investigative_dns_traffic_stats.json | 0 .../investigative_email_sent_to_hidden_cobra_actors.json | 0 .../investigative_get_all_aws_activitiy_from_city.json | 0 ...investigative_get_all_aws_activitiy_from_country.json | 0 .../investigative_get_all_aws_activitiy_from_region.json | 0 .../investigative_get_all_aws_activitiy_from_src_ip.json | 0 .../investigative_get_all_backup_data_for_host.json | 0 .../investigative_get_email_info.json | 0 .../investigative_get_emails_from_sender.json | 0 .../investigative_get_emails_from_source.json | 0 ...tive_get_logon_rights_modifications_for_endpoint.json | 0 ...tigative_get_logon_rights_modifications_for_user.json | 0 .../investigative_get_network_traffic_from_src_ip.json | 0 .../investigative_get_parent_process_info.json | 0 .../investigative_get_process_creating_dns_traffic.json | 0 .../investigative_get_process_info.json | 0 .../investigative_get_process_info_for_port.json | 0 .../investigative_get_rdp_authentications.json | 0 .../investigative_get_registry_activities.json | 0 .../investigative_get_web_activity.json | 0 .../investigative_get_web_activity_by_src_ip.json | 0 .../investigative_get_web_posts_by_src.json | 0 .../investigative_get_web_session_info.json | 0 .../investigative_get_wmi_sysmon_events.json | 0 .../investigative_suspicious_strings_in_HTTP_header.json | 0 .../investigative_user_activity_via_cloudtrail.json | 0 232 files changed, 8 insertions(+), 3 deletions(-) rename {searches => baselines}/support_add_prohibited_processes_to_es.json (100%) rename {searches => baselines}/support_approved_aws_service_accounts.json (100%) rename {searches => baselines}/support_assets_sorted_by_category.json (100%) rename {searches => baselines}/support_baseline_api_calls_per_user_arn.json (100%) rename {searches => baselines}/support_baseline_aws_regions.json (100%) rename {searches => baselines}/support_baseline_blocked_vpc_traffic.json (100%) rename {searches => baselines}/support_baseline_network_acl_modifications.json (100%) rename {searches => baselines}/support_baseline_s3_deletion_by_arn.json (100%) rename {searches => baselines}/support_baseline_security_group_activity_by_arn.json (100%) rename {searches => baselines}/support_brand_abuse_dnstwist_domains.json (100%) rename {searches => baselines}/support_discover_dns_records.json (100%) rename {searches => baselines}/support_identify_ports_on_network.json (100%) rename {searches => baselines}/support_identify_systems_creating_rdp_traffic.json (100%) rename {searches => baselines}/support_identify_systems_receiving_rdp_traffic.json (100%) rename {searches => baselines}/support_identify_systems_using_remote_desktop.json (100%) rename {searches => baselines}/support_monitor_successful_backups.json (100%) rename {searches => baselines}/support_monitor_successful_windows_updates.json (100%) rename {searches => baselines}/support_monitor_unsuccessful_backups.json (100%) rename {searches => baselines}/support_monitor_unsuccessful_windows_updates.json (100%) rename {searches => baselines}/support_previously_seen_aws_cross_account_activity.json (100%) rename {searches => baselines}/support_previously_seen_cmd_arguments.json (100%) rename {searches => baselines}/support_previously_seen_ec2_amis.json (100%) rename {searches => baselines}/support_previously_seen_ec2_instance_types.json (100%) rename {searches => baselines}/support_previously_seen_ec2_launches_by_user.json (100%) rename {searches => baselines}/support_previously_seen_ec2_modifications.json (100%) rename {searches => baselines}/support_previously_seen_provisioning_activity_src.json (100%) rename {searches => baselines}/support_previously_seen_s3_remote_ip.json (100%) rename {searches => baselines}/support_previously_seen_user_roles.json (100%) rename {searches => baselines}/support_previously_seen_users.json (100%) rename {searches => baselines}/support_previously_seen_windows_service_starts.json (100%) rename {searches => baselines}/support_systems_ready_for_spectre_meltdown_patch.json (100%) delete mode 100644 bin/config.ini rename {searches => detections}/detection_abnormally_high_instance_termination.json (100%) rename {searches => detections}/detection_abnormally_high_instances_launched.json (100%) rename {searches => detections}/detection_account_harvesting.json (100%) rename {searches => detections}/detection_acl_with_open_ports.json (100%) rename {searches => detections}/detection_activity_related_to_pass_the_hash.json (100%) rename {searches => detections}/detection_add_to_untrust_cert_store.json (100%) rename {searches => detections}/detection_anomalous_webclick.json (100%) rename {searches => detections}/detection_api_acitivity_from_previously_unseen_user_role.json (100%) rename {searches => detections}/detection_attackers_scanning_for_vulnerable_jboss_servers.json (100%) rename {searches => detections}/detection_attrib_to_hide_files.json (100%) rename {searches => detections}/detection_aws_activity_from_non_approved_accounts.json (100%) rename {searches => detections}/detection_aws_activity_in_new_region.json (100%) rename {searches => detections}/detection_aws_cloud_provisioning_from_previously_unseen_city.json (100%) rename {searches => detections}/detection_aws_cloud_provisioning_from_previously_unseen_country.json (100%) rename {searches => detections}/detection_aws_cloud_provisioning_from_previously_unseen_ip.json (100%) rename {searches => detections}/detection_aws_cloud_provisioning_from_previously_unseen_region.json (100%) rename {searches => detections}/detection_aws_cross_account_activity_from_new_account.json (100%) rename {searches => detections}/detection_aws_spike_acl_activity.json (100%) rename {searches => detections}/detection_badrabbit_schtasks.json (100%) rename {searches => detections}/detection_batch_file_write_system32.json (100%) rename {searches => detections}/detection_brand_abuse_dns.json (100%) rename {searches => detections}/detection_brand_abuse_email.json (100%) rename {searches => detections}/detection_brand_abuse_web.json (100%) rename {searches => detections}/detection_change_file_association.json (100%) rename {searches => detections}/detection_children_of_spoolsv.json (100%) rename {searches => detections}/detection_clients_connecting_to_multiple_dns_servers.json (100%) rename {searches => detections}/detection_common_ransomware_extensions.json (100%) rename {searches => detections}/detection_common_ransomware_notes.json (100%) rename {searches => detections}/detection_create_hidden_shares.json (100%) rename {searches => detections}/detection_create_local_admin_via_net.json (100%) rename {searches => detections}/detection_cred_dump_via_reg.json (100%) rename {searches => detections}/detection_cscript_via_cmd.json (100%) rename {searches => detections}/detection_delete_shadow_copies.json (100%) rename {searches => detections}/detection_deletion_network_acl.json (100%) rename {searches => detections}/detection_disable_remote_uac.json (100%) rename {searches => detections}/detection_dns_amplification_any_query.json (100%) rename {searches => detections}/detection_dns_query_length_with_high_standard_deviation.json (100%) rename {searches => detections}/detection_dns_record_changed.json (100%) rename {searches => detections}/detection_dns_tunnelling.json (100%) rename {searches => detections}/detection_dragonfly_schtasks.json (100%) rename {searches => detections}/detection_dyn_dns_queries.json (100%) rename {searches => detections}/detection_dyn_dns_web_traffic.json (100%) rename {searches => detections}/detection_ec2_instance_created_by_previously_unseen_user.json (100%) rename {searches => detections}/detection_ec2_instance_modified_by_previously_unseen_user.json (100%) rename {searches => detections}/detection_ec2_instance_started_with_previously_unseen_ami.json (100%) rename {searches => detections}/detection_ec2_instance_started_with_previously_unseen_instance_type.json (100%) rename {searches => detections}/detection_email_attachments_with_spaces.json (100%) rename {searches => detections}/detection_email_files_not_in_outlook_directory.json (100%) rename {searches => detections}/detection_emailserver_high_volume_outbound_traffic_to_hosts.json (100%) rename {searches => detections}/detection_excessive_dns_failures.json (100%) rename {searches => detections}/detection_excessive_lockouts_from_endpoint.json (100%) rename {searches => detections}/detection_excessive_user_account_lockouts.json (100%) rename {searches => detections}/detection_execution_of_nirsoft_tools.json (100%) rename {searches => detections}/detection_file_write_spikes.json (100%) rename {searches => detections}/detection_first_time_seen_cmd_line.json (100%) rename {searches => detections}/detection_first_time_seen_running_windows_service.json (100%) rename {searches => detections}/detection_fsutil_deleting_journals.json (100%) rename {searches => detections}/detection_hosts_file_modification.json (100%) rename {searches => detections}/detection_hosts_receiving_high_volume_network_traffic_from_email_servers.json (100%) rename {searches => detections}/detection_large_icmp_outbound.json (100%) rename {searches => detections}/detection_local_admin_account_creation.json (100%) rename {searches => detections}/detection_long_dns_text_response.json (100%) rename {searches => detections}/detection_malicious_application_shimming_via_registry.json (100%) rename {searches => detections}/detection_malicious_powershell_process_connect_to_internet_with_hidden_window.json (100%) rename {searches => detections}/detection_malicious_powershell_process_encoded_command.json (100%) rename {searches => detections}/detection_malicious_powershell_process_execpolicy.json (100%) rename {searches => detections}/detection_malicious_powershell_process_multiple_suspicious_arguments.json (100%) rename {searches => detections}/detection_malicious_powershell_process_obfuscation_techniques.json (100%) rename {searches => detections}/detection_malicious_requests_to_exploit_jboss_servers.json (100%) rename {searches => detections}/detection_mshta_launching_scripts.json (100%) rename {searches => detections}/detection_netbackup_failed_backup.json (100%) rename {searches => detections}/detection_netbackup_no_backups_in_time_period.json (100%) rename {searches => detections}/detection_netsh_launching_process.json (100%) rename {searches => detections}/detection_new_aws_console_login_by_user.json (100%) rename {searches => detections}/detection_new_connections_to_routers.json (100%) rename {searches => detections}/detection_new_open_s3_buckets.json (100%) rename {searches => detections}/detection_new_user_accounts.json (100%) rename {searches => detections}/detection_no_win_updates_in_timeframe.json (100%) rename {searches => detections}/detection_open_redirect_in_splunk_web.json (100%) rename {searches => detections}/detection_osx_coldroot_pack.json (100%) rename {searches => detections}/detection_osx_keyboard_taps.json (100%) rename {searches => detections}/detection_outbound_smb_connections.json (100%) rename {searches => detections}/detection_overwrite_accessibility_binaries.json (100%) rename {searches => detections}/detection_password_sharing.json (100%) rename {searches => detections}/detection_path_interception_program.exe.json (100%) rename {searches => detections}/detection_port_monitor_via_registry.json (100%) rename {searches => detections}/detection_powershell_get_sedebug.json (100%) rename {searches => detections}/detection_powershell_read_from_lsass.json (100%) rename {searches => detections}/detection_powershell_reg_key_mod.json (100%) rename {searches => detections}/detection_process_launching_netsh.json (100%) rename {searches => detections}/detection_process_with_double_extension.json (100%) rename {searches => detections}/detection_process_with_spaces_before_extension.json (100%) rename {searches => detections}/detection_prohibited_allowed_through_fw.json (100%) rename {searches => detections}/detection_prohibited_apps_spawning_cmdprompt.json (100%) rename {searches => detections}/detection_prohibited_software_on_endpoint.json (100%) rename {searches => detections}/detection_protocol_mismatch.json (100%) rename {searches => detections}/detection_protocols_authenticating_in_cleartext.json (100%) rename {searches => detections}/detection_psexec_accepteula.json (100%) rename {searches => detections}/detection_rare_executables_on_endpoint.json (100%) rename {searches => detections}/detection_reg_manipulating_services.json (100%) rename {searches => detections}/detection_reg_used_to_hide_files.json (100%) rename {searches => detections}/detection_registry_persistence.json (100%) rename {searches => detections}/detection_registry_privilege_escalation.json (100%) rename {searches => detections}/detection_remote_desktop_bruteforce.json (100%) rename {searches => detections}/detection_remote_desktop_network_traffic.json (100%) rename {searches => detections}/detection_remote_desktop_process_running_on_system.json (100%) rename {searches => detections}/detection_remote_registry_modifications.json (100%) rename {searches => detections}/detection_remote_wmi_command_attempt.json (100%) rename {searches => detections}/detection_remote_wmi_process_instantiation.json (100%) rename {searches => detections}/detection_rundll_loading_dll_by_ordinal.json (100%) rename {searches => detections}/detection_s3_access_from_new_ip.json (100%) rename {searches => detections}/detection_samsam_payload_extensions.json (100%) rename {searches => detections}/detection_samsam_test_file_write.json (100%) rename {searches => detections}/detection_sc_manipulating_services.json (100%) rename {searches => detections}/detection_schtasks_forced_reboot.json (100%) rename {searches => detections}/detection_schtasks_scheduling_job_on_remote_system.json (100%) rename {searches => detections}/detection_shim_database_file_creation.json (100%) rename {searches => detections}/detection_shim_database_installation.json (100%) rename {searches => detections}/detection_short_lived_accounts.json (100%) rename {searches => detections}/detection_single_letter_executables.json (100%) rename {searches => detections}/detection_smb_traffic_spike.json (100%) rename {searches => detections}/detection_sncd_processes.json (100%) rename {searches => detections}/detection_spectre_meltdown_vulnerabilities.json (100%) rename {searches => detections}/detection_spike_aws_api_call_per_account.json (100%) rename {searches => detections}/detection_spike_aws_security_group_activity.json (100%) rename {searches => detections}/detection_spike_s3_deletion.json (100%) rename {searches => detections}/detection_spike_vpc_blocked_traffic.json (100%) rename {searches => detections}/detection_splunk_information_disclosure.json (100%) rename {searches => detections}/detection_sql_injection_with_long_urls.json (100%) rename {searches => detections}/detection_stop_security_services.json (100%) rename {searches => detections}/detection_suspicious_email_attachments.json (100%) rename {searches => detections}/detection_suspicious_file_writes.json (100%) rename {searches => detections}/detection_suspicious_java_classes.json (100%) rename {searches => detections}/detection_suspicious_reg_process.json (100%) rename {searches => detections}/detection_suspicious_wevtutil_usage.json (100%) rename {searches => detections}/detection_suspicious_write_to_recycler.json (100%) rename {searches => detections}/detection_suspicious_write_to_sysvol.json (100%) rename {searches => detections}/detection_system_processes_run_from_unexpected_locations.json (100%) rename {searches => detections}/detection_tor_traffic.json (100%) rename {searches => detections}/detection_unauthorized_assets_via_mac_address.json (100%) rename {searches => detections}/detection_unauthorized_dns_servers.json (100%) rename {searches => detections}/detection_uncommon_processes.json (100%) rename {searches => detections}/detection_unusually_long_commandlines.json (100%) rename {searches => detections}/detection_unusually_long_content-type_length.json (100%) rename {searches => detections}/detection_usb_insertion.json (100%) rename {searches => detections}/detection_users_without_mfa.json (100%) rename {searches => detections}/detection_web_servers_executing_suspicious_processes.json (100%) rename {searches => detections}/detection_windows_event_log_cleared.json (100%) rename {searches => detections}/detection_wmi_perm_event_subscription.json (100%) rename {searches => detections}/detection_wmi_perm_event_subscription_sysmon.json (100%) rename {searches => detections}/detection_wmi_process_launch.json (100%) rename {searches => detections}/detection_wmi_script_execution.json (100%) rename {searches => detections}/detection_wmi_temp_event_subscription.json (100%) rename {searches => investigations}/contextual_aws_network_interface_details.json (100%) rename {searches => investigations}/contextual_aws_s3_bucket_details.json (100%) rename {searches => investigations}/contextual_first_occurrence_mac_address.json (100%) rename {searches => investigations}/contextual_get_acl_details.json (100%) rename {searches => investigations}/contextual_get_authentication_logs_for_endpoint.json (100%) rename {searches => investigations}/contextual_get_backup_logs_for_endpoint.json (100%) rename {searches => investigations}/contextual_get_ec2_details_by_instance_id.json (100%) rename {searches => investigations}/contextual_get_ec2_launch_details.json (100%) rename {searches => investigations}/contextual_get_notable_history_for_endpoint.json (100%) rename {searches => investigations}/contextual_get_notable_info.json (100%) rename {searches => investigations}/contextual_get_risk_for_endpoint.json (100%) rename {searches => investigations}/contextual_get_risk_for_user.json (100%) rename {searches => investigations}/contextual_get_update_logs_for_endpoint.json (100%) rename {searches => investigations}/contextual_get_user_info_from_identity_table.json (100%) rename {searches => investigations}/contextual_get_vulnerability_logs_for_endpoint.json (100%) rename {searches => investigations}/investigative_aws_activity_via_region.json (100%) rename {searches => investigations}/investigative_aws_user_activities_by_user_field.json (100%) rename {searches => investigations}/investigative_aws_user_activity_by_accesskeyid.json (100%) rename {searches => investigations}/investigative_aws_user_activity_by_src_user.json (100%) rename {searches => investigations}/investigative_dns_server_history.json (100%) rename {searches => investigations}/investigative_dns_traffic_stats.json (100%) rename {searches => investigations}/investigative_email_sent_to_hidden_cobra_actors.json (100%) rename {searches => investigations}/investigative_get_all_aws_activitiy_from_city.json (100%) rename {searches => investigations}/investigative_get_all_aws_activitiy_from_country.json (100%) rename {searches => investigations}/investigative_get_all_aws_activitiy_from_region.json (100%) rename {searches => investigations}/investigative_get_all_aws_activitiy_from_src_ip.json (100%) rename {searches => investigations}/investigative_get_all_backup_data_for_host.json (100%) rename {searches => investigations}/investigative_get_email_info.json (100%) rename {searches => investigations}/investigative_get_emails_from_sender.json (100%) rename {searches => investigations}/investigative_get_emails_from_source.json (100%) rename {searches => investigations}/investigative_get_logon_rights_modifications_for_endpoint.json (100%) rename {searches => investigations}/investigative_get_logon_rights_modifications_for_user.json (100%) rename {searches => investigations}/investigative_get_network_traffic_from_src_ip.json (100%) rename {searches => investigations}/investigative_get_parent_process_info.json (100%) rename {searches => investigations}/investigative_get_process_creating_dns_traffic.json (100%) rename {searches => investigations}/investigative_get_process_info.json (100%) rename {searches => investigations}/investigative_get_process_info_for_port.json (100%) rename {searches => investigations}/investigative_get_rdp_authentications.json (100%) rename {searches => investigations}/investigative_get_registry_activities.json (100%) rename {searches => investigations}/investigative_get_web_activity.json (100%) rename {searches => investigations}/investigative_get_web_activity_by_src_ip.json (100%) rename {searches => investigations}/investigative_get_web_posts_by_src.json (100%) rename {searches => investigations}/investigative_get_web_session_info.json (100%) rename {searches => investigations}/investigative_get_wmi_sysmon_events.json (100%) rename {searches => investigations}/investigative_suspicious_strings_in_HTTP_header.json (100%) rename {searches => investigations}/investigative_user_activity_via_cloudtrail.json (100%) diff --git a/README.md b/README.md index d72b2d933e..fc768b5e23 100644 --- a/README.md +++ b/README.md @@ -13,7 +13,14 @@ Can be consumed using: * CLI # Structure -`src/` - splunk content app source files, includes lookups, binaries, and defaul config files +[stories/](stories/) - contains all analytics stories/use cases for ESCU +[detections/](detections/) - splunk, uba and phantom detections that power stories +[investigations/](investigations/) - splunk, and phantom investigation content that are used in stories +[responses/](responses/) - automated splunk and phantom responses that are used in stories +[baselines/](baselines/) - phantom and Splunk baseline needed to support detections in stories +[src/](src/) - splunk content app source files, includes lookups, binaries, and defaul config files +[bin/](bin/) - where all binaries to produce, and test content lives +[spec/](spec/) - location of all spec files that describe ESCU content # Developing diff --git a/searches/support_add_prohibited_processes_to_es.json b/baselines/support_add_prohibited_processes_to_es.json similarity index 100% rename from searches/support_add_prohibited_processes_to_es.json rename to baselines/support_add_prohibited_processes_to_es.json diff --git a/searches/support_approved_aws_service_accounts.json b/baselines/support_approved_aws_service_accounts.json similarity index 100% rename from searches/support_approved_aws_service_accounts.json rename to baselines/support_approved_aws_service_accounts.json diff --git a/searches/support_assets_sorted_by_category.json b/baselines/support_assets_sorted_by_category.json similarity index 100% rename from searches/support_assets_sorted_by_category.json rename to baselines/support_assets_sorted_by_category.json diff --git a/searches/support_baseline_api_calls_per_user_arn.json b/baselines/support_baseline_api_calls_per_user_arn.json similarity index 100% rename from searches/support_baseline_api_calls_per_user_arn.json rename to baselines/support_baseline_api_calls_per_user_arn.json diff --git a/searches/support_baseline_aws_regions.json b/baselines/support_baseline_aws_regions.json similarity index 100% rename from searches/support_baseline_aws_regions.json rename to baselines/support_baseline_aws_regions.json diff --git a/searches/support_baseline_blocked_vpc_traffic.json b/baselines/support_baseline_blocked_vpc_traffic.json similarity index 100% rename from searches/support_baseline_blocked_vpc_traffic.json rename to baselines/support_baseline_blocked_vpc_traffic.json diff --git a/searches/support_baseline_network_acl_modifications.json b/baselines/support_baseline_network_acl_modifications.json similarity index 100% rename from searches/support_baseline_network_acl_modifications.json rename to baselines/support_baseline_network_acl_modifications.json diff --git a/searches/support_baseline_s3_deletion_by_arn.json b/baselines/support_baseline_s3_deletion_by_arn.json similarity index 100% rename from searches/support_baseline_s3_deletion_by_arn.json rename to baselines/support_baseline_s3_deletion_by_arn.json diff --git a/searches/support_baseline_security_group_activity_by_arn.json b/baselines/support_baseline_security_group_activity_by_arn.json similarity index 100% rename from searches/support_baseline_security_group_activity_by_arn.json rename to baselines/support_baseline_security_group_activity_by_arn.json diff --git a/searches/support_brand_abuse_dnstwist_domains.json b/baselines/support_brand_abuse_dnstwist_domains.json similarity index 100% rename from searches/support_brand_abuse_dnstwist_domains.json rename to baselines/support_brand_abuse_dnstwist_domains.json diff --git a/searches/support_discover_dns_records.json b/baselines/support_discover_dns_records.json similarity index 100% rename from searches/support_discover_dns_records.json rename to baselines/support_discover_dns_records.json diff --git a/searches/support_identify_ports_on_network.json b/baselines/support_identify_ports_on_network.json similarity index 100% rename from searches/support_identify_ports_on_network.json rename to baselines/support_identify_ports_on_network.json diff --git a/searches/support_identify_systems_creating_rdp_traffic.json b/baselines/support_identify_systems_creating_rdp_traffic.json similarity index 100% rename from searches/support_identify_systems_creating_rdp_traffic.json rename to baselines/support_identify_systems_creating_rdp_traffic.json diff --git a/searches/support_identify_systems_receiving_rdp_traffic.json b/baselines/support_identify_systems_receiving_rdp_traffic.json similarity index 100% rename from searches/support_identify_systems_receiving_rdp_traffic.json rename to baselines/support_identify_systems_receiving_rdp_traffic.json diff --git a/searches/support_identify_systems_using_remote_desktop.json b/baselines/support_identify_systems_using_remote_desktop.json similarity index 100% rename from searches/support_identify_systems_using_remote_desktop.json rename to baselines/support_identify_systems_using_remote_desktop.json diff --git a/searches/support_monitor_successful_backups.json b/baselines/support_monitor_successful_backups.json similarity index 100% rename from searches/support_monitor_successful_backups.json rename to baselines/support_monitor_successful_backups.json diff --git a/searches/support_monitor_successful_windows_updates.json b/baselines/support_monitor_successful_windows_updates.json similarity index 100% rename from searches/support_monitor_successful_windows_updates.json rename to baselines/support_monitor_successful_windows_updates.json diff --git a/searches/support_monitor_unsuccessful_backups.json b/baselines/support_monitor_unsuccessful_backups.json similarity index 100% rename from searches/support_monitor_unsuccessful_backups.json rename to baselines/support_monitor_unsuccessful_backups.json diff --git a/searches/support_monitor_unsuccessful_windows_updates.json b/baselines/support_monitor_unsuccessful_windows_updates.json similarity index 100% rename from searches/support_monitor_unsuccessful_windows_updates.json rename to baselines/support_monitor_unsuccessful_windows_updates.json diff --git a/searches/support_previously_seen_aws_cross_account_activity.json b/baselines/support_previously_seen_aws_cross_account_activity.json similarity index 100% rename from searches/support_previously_seen_aws_cross_account_activity.json rename to baselines/support_previously_seen_aws_cross_account_activity.json diff --git a/searches/support_previously_seen_cmd_arguments.json b/baselines/support_previously_seen_cmd_arguments.json similarity index 100% rename from searches/support_previously_seen_cmd_arguments.json rename to baselines/support_previously_seen_cmd_arguments.json diff --git a/searches/support_previously_seen_ec2_amis.json b/baselines/support_previously_seen_ec2_amis.json similarity index 100% rename from searches/support_previously_seen_ec2_amis.json rename to baselines/support_previously_seen_ec2_amis.json diff --git a/searches/support_previously_seen_ec2_instance_types.json b/baselines/support_previously_seen_ec2_instance_types.json similarity index 100% rename from searches/support_previously_seen_ec2_instance_types.json rename to baselines/support_previously_seen_ec2_instance_types.json diff --git a/searches/support_previously_seen_ec2_launches_by_user.json b/baselines/support_previously_seen_ec2_launches_by_user.json similarity index 100% rename from searches/support_previously_seen_ec2_launches_by_user.json rename to baselines/support_previously_seen_ec2_launches_by_user.json diff --git a/searches/support_previously_seen_ec2_modifications.json b/baselines/support_previously_seen_ec2_modifications.json similarity index 100% rename from searches/support_previously_seen_ec2_modifications.json rename to baselines/support_previously_seen_ec2_modifications.json diff --git a/searches/support_previously_seen_provisioning_activity_src.json b/baselines/support_previously_seen_provisioning_activity_src.json similarity index 100% rename from searches/support_previously_seen_provisioning_activity_src.json rename to baselines/support_previously_seen_provisioning_activity_src.json diff --git a/searches/support_previously_seen_s3_remote_ip.json b/baselines/support_previously_seen_s3_remote_ip.json similarity index 100% rename from searches/support_previously_seen_s3_remote_ip.json rename to baselines/support_previously_seen_s3_remote_ip.json diff --git a/searches/support_previously_seen_user_roles.json b/baselines/support_previously_seen_user_roles.json similarity index 100% rename from searches/support_previously_seen_user_roles.json rename to baselines/support_previously_seen_user_roles.json diff --git a/searches/support_previously_seen_users.json b/baselines/support_previously_seen_users.json similarity index 100% rename from searches/support_previously_seen_users.json rename to baselines/support_previously_seen_users.json diff --git a/searches/support_previously_seen_windows_service_starts.json b/baselines/support_previously_seen_windows_service_starts.json similarity index 100% rename from searches/support_previously_seen_windows_service_starts.json rename to baselines/support_previously_seen_windows_service_starts.json diff --git a/searches/support_systems_ready_for_spectre_meltdown_patch.json b/baselines/support_systems_ready_for_spectre_meltdown_patch.json similarity index 100% rename from searches/support_systems_ready_for_spectre_meltdown_patch.json rename to baselines/support_systems_ready_for_spectre_meltdown_patch.json diff --git a/bin/config.ini b/bin/config.ini deleted file mode 100644 index 894a621d2f..0000000000 --- a/bin/config.ini +++ /dev/null @@ -1,2 +0,0 @@ -[confluence] -url=https://confluence.splunk.com diff --git a/searches/detection_abnormally_high_instance_termination.json b/detections/detection_abnormally_high_instance_termination.json similarity index 100% rename from searches/detection_abnormally_high_instance_termination.json rename to detections/detection_abnormally_high_instance_termination.json diff --git a/searches/detection_abnormally_high_instances_launched.json b/detections/detection_abnormally_high_instances_launched.json similarity index 100% rename from searches/detection_abnormally_high_instances_launched.json rename to detections/detection_abnormally_high_instances_launched.json diff --git a/searches/detection_account_harvesting.json b/detections/detection_account_harvesting.json similarity index 100% rename from searches/detection_account_harvesting.json rename to detections/detection_account_harvesting.json diff --git a/searches/detection_acl_with_open_ports.json b/detections/detection_acl_with_open_ports.json similarity index 100% rename from searches/detection_acl_with_open_ports.json rename to detections/detection_acl_with_open_ports.json diff --git a/searches/detection_activity_related_to_pass_the_hash.json b/detections/detection_activity_related_to_pass_the_hash.json similarity index 100% rename from searches/detection_activity_related_to_pass_the_hash.json rename to detections/detection_activity_related_to_pass_the_hash.json diff --git a/searches/detection_add_to_untrust_cert_store.json b/detections/detection_add_to_untrust_cert_store.json similarity index 100% rename from searches/detection_add_to_untrust_cert_store.json rename to detections/detection_add_to_untrust_cert_store.json diff --git a/searches/detection_anomalous_webclick.json b/detections/detection_anomalous_webclick.json similarity index 100% rename from searches/detection_anomalous_webclick.json rename to detections/detection_anomalous_webclick.json diff --git a/searches/detection_api_acitivity_from_previously_unseen_user_role.json b/detections/detection_api_acitivity_from_previously_unseen_user_role.json similarity index 100% rename from searches/detection_api_acitivity_from_previously_unseen_user_role.json rename to detections/detection_api_acitivity_from_previously_unseen_user_role.json diff --git a/searches/detection_attackers_scanning_for_vulnerable_jboss_servers.json b/detections/detection_attackers_scanning_for_vulnerable_jboss_servers.json similarity index 100% rename from searches/detection_attackers_scanning_for_vulnerable_jboss_servers.json rename to detections/detection_attackers_scanning_for_vulnerable_jboss_servers.json diff --git a/searches/detection_attrib_to_hide_files.json b/detections/detection_attrib_to_hide_files.json similarity index 100% rename from searches/detection_attrib_to_hide_files.json rename to detections/detection_attrib_to_hide_files.json diff --git a/searches/detection_aws_activity_from_non_approved_accounts.json b/detections/detection_aws_activity_from_non_approved_accounts.json similarity index 100% rename from searches/detection_aws_activity_from_non_approved_accounts.json rename to detections/detection_aws_activity_from_non_approved_accounts.json diff --git a/searches/detection_aws_activity_in_new_region.json b/detections/detection_aws_activity_in_new_region.json similarity index 100% rename from searches/detection_aws_activity_in_new_region.json rename to detections/detection_aws_activity_in_new_region.json diff --git a/searches/detection_aws_cloud_provisioning_from_previously_unseen_city.json b/detections/detection_aws_cloud_provisioning_from_previously_unseen_city.json similarity index 100% rename from searches/detection_aws_cloud_provisioning_from_previously_unseen_city.json rename to detections/detection_aws_cloud_provisioning_from_previously_unseen_city.json diff --git a/searches/detection_aws_cloud_provisioning_from_previously_unseen_country.json b/detections/detection_aws_cloud_provisioning_from_previously_unseen_country.json similarity index 100% rename from searches/detection_aws_cloud_provisioning_from_previously_unseen_country.json rename to detections/detection_aws_cloud_provisioning_from_previously_unseen_country.json diff --git a/searches/detection_aws_cloud_provisioning_from_previously_unseen_ip.json b/detections/detection_aws_cloud_provisioning_from_previously_unseen_ip.json similarity index 100% rename from searches/detection_aws_cloud_provisioning_from_previously_unseen_ip.json rename to detections/detection_aws_cloud_provisioning_from_previously_unseen_ip.json diff --git a/searches/detection_aws_cloud_provisioning_from_previously_unseen_region.json b/detections/detection_aws_cloud_provisioning_from_previously_unseen_region.json similarity index 100% rename from searches/detection_aws_cloud_provisioning_from_previously_unseen_region.json rename to detections/detection_aws_cloud_provisioning_from_previously_unseen_region.json diff --git a/searches/detection_aws_cross_account_activity_from_new_account.json b/detections/detection_aws_cross_account_activity_from_new_account.json similarity index 100% rename from searches/detection_aws_cross_account_activity_from_new_account.json rename to detections/detection_aws_cross_account_activity_from_new_account.json diff --git a/searches/detection_aws_spike_acl_activity.json b/detections/detection_aws_spike_acl_activity.json similarity index 100% rename from searches/detection_aws_spike_acl_activity.json rename to detections/detection_aws_spike_acl_activity.json diff --git a/searches/detection_badrabbit_schtasks.json b/detections/detection_badrabbit_schtasks.json similarity index 100% rename from searches/detection_badrabbit_schtasks.json rename to detections/detection_badrabbit_schtasks.json diff --git a/searches/detection_batch_file_write_system32.json b/detections/detection_batch_file_write_system32.json similarity index 100% rename from searches/detection_batch_file_write_system32.json rename to detections/detection_batch_file_write_system32.json diff --git a/searches/detection_brand_abuse_dns.json b/detections/detection_brand_abuse_dns.json similarity index 100% rename from searches/detection_brand_abuse_dns.json rename to detections/detection_brand_abuse_dns.json diff --git a/searches/detection_brand_abuse_email.json b/detections/detection_brand_abuse_email.json similarity index 100% rename from searches/detection_brand_abuse_email.json rename to detections/detection_brand_abuse_email.json diff --git a/searches/detection_brand_abuse_web.json b/detections/detection_brand_abuse_web.json similarity index 100% rename from searches/detection_brand_abuse_web.json rename to detections/detection_brand_abuse_web.json diff --git a/searches/detection_change_file_association.json b/detections/detection_change_file_association.json similarity index 100% rename from searches/detection_change_file_association.json rename to detections/detection_change_file_association.json diff --git a/searches/detection_children_of_spoolsv.json b/detections/detection_children_of_spoolsv.json similarity index 100% rename from searches/detection_children_of_spoolsv.json rename to detections/detection_children_of_spoolsv.json diff --git a/searches/detection_clients_connecting_to_multiple_dns_servers.json b/detections/detection_clients_connecting_to_multiple_dns_servers.json similarity index 100% rename from searches/detection_clients_connecting_to_multiple_dns_servers.json rename to detections/detection_clients_connecting_to_multiple_dns_servers.json diff --git a/searches/detection_common_ransomware_extensions.json b/detections/detection_common_ransomware_extensions.json similarity index 100% rename from searches/detection_common_ransomware_extensions.json rename to detections/detection_common_ransomware_extensions.json diff --git a/searches/detection_common_ransomware_notes.json b/detections/detection_common_ransomware_notes.json similarity index 100% rename from searches/detection_common_ransomware_notes.json rename to detections/detection_common_ransomware_notes.json diff --git a/searches/detection_create_hidden_shares.json b/detections/detection_create_hidden_shares.json similarity index 100% rename from searches/detection_create_hidden_shares.json rename to detections/detection_create_hidden_shares.json diff --git a/searches/detection_create_local_admin_via_net.json b/detections/detection_create_local_admin_via_net.json similarity index 100% rename from searches/detection_create_local_admin_via_net.json rename to detections/detection_create_local_admin_via_net.json diff --git a/searches/detection_cred_dump_via_reg.json b/detections/detection_cred_dump_via_reg.json similarity index 100% rename from searches/detection_cred_dump_via_reg.json rename to detections/detection_cred_dump_via_reg.json diff --git a/searches/detection_cscript_via_cmd.json b/detections/detection_cscript_via_cmd.json similarity index 100% rename from searches/detection_cscript_via_cmd.json rename to detections/detection_cscript_via_cmd.json diff --git a/searches/detection_delete_shadow_copies.json b/detections/detection_delete_shadow_copies.json similarity index 100% rename from searches/detection_delete_shadow_copies.json rename to detections/detection_delete_shadow_copies.json diff --git a/searches/detection_deletion_network_acl.json b/detections/detection_deletion_network_acl.json similarity index 100% rename from searches/detection_deletion_network_acl.json rename to detections/detection_deletion_network_acl.json diff --git a/searches/detection_disable_remote_uac.json b/detections/detection_disable_remote_uac.json similarity index 100% rename from searches/detection_disable_remote_uac.json rename to detections/detection_disable_remote_uac.json diff --git a/searches/detection_dns_amplification_any_query.json b/detections/detection_dns_amplification_any_query.json similarity index 100% rename from searches/detection_dns_amplification_any_query.json rename to detections/detection_dns_amplification_any_query.json diff --git a/searches/detection_dns_query_length_with_high_standard_deviation.json b/detections/detection_dns_query_length_with_high_standard_deviation.json similarity index 100% rename from searches/detection_dns_query_length_with_high_standard_deviation.json rename to detections/detection_dns_query_length_with_high_standard_deviation.json diff --git a/searches/detection_dns_record_changed.json b/detections/detection_dns_record_changed.json similarity index 100% rename from searches/detection_dns_record_changed.json rename to detections/detection_dns_record_changed.json diff --git a/searches/detection_dns_tunnelling.json b/detections/detection_dns_tunnelling.json similarity index 100% rename from searches/detection_dns_tunnelling.json rename to detections/detection_dns_tunnelling.json diff --git a/searches/detection_dragonfly_schtasks.json b/detections/detection_dragonfly_schtasks.json similarity index 100% rename from searches/detection_dragonfly_schtasks.json rename to detections/detection_dragonfly_schtasks.json diff --git a/searches/detection_dyn_dns_queries.json b/detections/detection_dyn_dns_queries.json similarity index 100% rename from searches/detection_dyn_dns_queries.json rename to detections/detection_dyn_dns_queries.json diff --git a/searches/detection_dyn_dns_web_traffic.json b/detections/detection_dyn_dns_web_traffic.json similarity index 100% rename from searches/detection_dyn_dns_web_traffic.json rename to detections/detection_dyn_dns_web_traffic.json diff --git a/searches/detection_ec2_instance_created_by_previously_unseen_user.json b/detections/detection_ec2_instance_created_by_previously_unseen_user.json similarity index 100% rename from searches/detection_ec2_instance_created_by_previously_unseen_user.json rename to detections/detection_ec2_instance_created_by_previously_unseen_user.json diff --git a/searches/detection_ec2_instance_modified_by_previously_unseen_user.json b/detections/detection_ec2_instance_modified_by_previously_unseen_user.json similarity index 100% rename from searches/detection_ec2_instance_modified_by_previously_unseen_user.json rename to detections/detection_ec2_instance_modified_by_previously_unseen_user.json diff --git a/searches/detection_ec2_instance_started_with_previously_unseen_ami.json b/detections/detection_ec2_instance_started_with_previously_unseen_ami.json similarity index 100% rename from searches/detection_ec2_instance_started_with_previously_unseen_ami.json rename to detections/detection_ec2_instance_started_with_previously_unseen_ami.json diff --git a/searches/detection_ec2_instance_started_with_previously_unseen_instance_type.json b/detections/detection_ec2_instance_started_with_previously_unseen_instance_type.json similarity index 100% rename from searches/detection_ec2_instance_started_with_previously_unseen_instance_type.json rename to detections/detection_ec2_instance_started_with_previously_unseen_instance_type.json diff --git a/searches/detection_email_attachments_with_spaces.json b/detections/detection_email_attachments_with_spaces.json similarity index 100% rename from searches/detection_email_attachments_with_spaces.json rename to detections/detection_email_attachments_with_spaces.json diff --git a/searches/detection_email_files_not_in_outlook_directory.json b/detections/detection_email_files_not_in_outlook_directory.json similarity index 100% rename from searches/detection_email_files_not_in_outlook_directory.json rename to detections/detection_email_files_not_in_outlook_directory.json diff --git a/searches/detection_emailserver_high_volume_outbound_traffic_to_hosts.json b/detections/detection_emailserver_high_volume_outbound_traffic_to_hosts.json similarity index 100% rename from searches/detection_emailserver_high_volume_outbound_traffic_to_hosts.json rename to detections/detection_emailserver_high_volume_outbound_traffic_to_hosts.json diff --git a/searches/detection_excessive_dns_failures.json b/detections/detection_excessive_dns_failures.json similarity index 100% rename from searches/detection_excessive_dns_failures.json rename to detections/detection_excessive_dns_failures.json diff --git a/searches/detection_excessive_lockouts_from_endpoint.json b/detections/detection_excessive_lockouts_from_endpoint.json similarity index 100% rename from searches/detection_excessive_lockouts_from_endpoint.json rename to detections/detection_excessive_lockouts_from_endpoint.json diff --git a/searches/detection_excessive_user_account_lockouts.json b/detections/detection_excessive_user_account_lockouts.json similarity index 100% rename from searches/detection_excessive_user_account_lockouts.json rename to detections/detection_excessive_user_account_lockouts.json diff --git a/searches/detection_execution_of_nirsoft_tools.json b/detections/detection_execution_of_nirsoft_tools.json similarity index 100% rename from searches/detection_execution_of_nirsoft_tools.json rename to detections/detection_execution_of_nirsoft_tools.json diff --git a/searches/detection_file_write_spikes.json b/detections/detection_file_write_spikes.json similarity index 100% rename from searches/detection_file_write_spikes.json rename to detections/detection_file_write_spikes.json diff --git a/searches/detection_first_time_seen_cmd_line.json b/detections/detection_first_time_seen_cmd_line.json similarity index 100% rename from searches/detection_first_time_seen_cmd_line.json rename to detections/detection_first_time_seen_cmd_line.json diff --git a/searches/detection_first_time_seen_running_windows_service.json b/detections/detection_first_time_seen_running_windows_service.json similarity index 100% rename from searches/detection_first_time_seen_running_windows_service.json rename to detections/detection_first_time_seen_running_windows_service.json diff --git a/searches/detection_fsutil_deleting_journals.json b/detections/detection_fsutil_deleting_journals.json similarity index 100% rename from searches/detection_fsutil_deleting_journals.json rename to detections/detection_fsutil_deleting_journals.json diff --git a/searches/detection_hosts_file_modification.json b/detections/detection_hosts_file_modification.json similarity index 100% rename from searches/detection_hosts_file_modification.json rename to detections/detection_hosts_file_modification.json diff --git a/searches/detection_hosts_receiving_high_volume_network_traffic_from_email_servers.json b/detections/detection_hosts_receiving_high_volume_network_traffic_from_email_servers.json similarity index 100% rename from searches/detection_hosts_receiving_high_volume_network_traffic_from_email_servers.json rename to detections/detection_hosts_receiving_high_volume_network_traffic_from_email_servers.json diff --git a/searches/detection_large_icmp_outbound.json b/detections/detection_large_icmp_outbound.json similarity index 100% rename from searches/detection_large_icmp_outbound.json rename to detections/detection_large_icmp_outbound.json diff --git a/searches/detection_local_admin_account_creation.json b/detections/detection_local_admin_account_creation.json similarity index 100% rename from searches/detection_local_admin_account_creation.json rename to detections/detection_local_admin_account_creation.json diff --git a/searches/detection_long_dns_text_response.json b/detections/detection_long_dns_text_response.json similarity index 100% rename from searches/detection_long_dns_text_response.json rename to detections/detection_long_dns_text_response.json diff --git a/searches/detection_malicious_application_shimming_via_registry.json b/detections/detection_malicious_application_shimming_via_registry.json similarity index 100% rename from searches/detection_malicious_application_shimming_via_registry.json rename to detections/detection_malicious_application_shimming_via_registry.json diff --git a/searches/detection_malicious_powershell_process_connect_to_internet_with_hidden_window.json b/detections/detection_malicious_powershell_process_connect_to_internet_with_hidden_window.json similarity index 100% rename from searches/detection_malicious_powershell_process_connect_to_internet_with_hidden_window.json rename to detections/detection_malicious_powershell_process_connect_to_internet_with_hidden_window.json diff --git a/searches/detection_malicious_powershell_process_encoded_command.json b/detections/detection_malicious_powershell_process_encoded_command.json similarity index 100% rename from searches/detection_malicious_powershell_process_encoded_command.json rename to detections/detection_malicious_powershell_process_encoded_command.json diff --git a/searches/detection_malicious_powershell_process_execpolicy.json b/detections/detection_malicious_powershell_process_execpolicy.json similarity index 100% rename from searches/detection_malicious_powershell_process_execpolicy.json rename to detections/detection_malicious_powershell_process_execpolicy.json diff --git a/searches/detection_malicious_powershell_process_multiple_suspicious_arguments.json b/detections/detection_malicious_powershell_process_multiple_suspicious_arguments.json similarity index 100% rename from searches/detection_malicious_powershell_process_multiple_suspicious_arguments.json rename to detections/detection_malicious_powershell_process_multiple_suspicious_arguments.json diff --git a/searches/detection_malicious_powershell_process_obfuscation_techniques.json b/detections/detection_malicious_powershell_process_obfuscation_techniques.json similarity index 100% rename from searches/detection_malicious_powershell_process_obfuscation_techniques.json rename to detections/detection_malicious_powershell_process_obfuscation_techniques.json diff --git a/searches/detection_malicious_requests_to_exploit_jboss_servers.json b/detections/detection_malicious_requests_to_exploit_jboss_servers.json similarity index 100% rename from searches/detection_malicious_requests_to_exploit_jboss_servers.json rename to detections/detection_malicious_requests_to_exploit_jboss_servers.json diff --git a/searches/detection_mshta_launching_scripts.json b/detections/detection_mshta_launching_scripts.json similarity index 100% rename from searches/detection_mshta_launching_scripts.json rename to detections/detection_mshta_launching_scripts.json diff --git a/searches/detection_netbackup_failed_backup.json b/detections/detection_netbackup_failed_backup.json similarity index 100% rename from searches/detection_netbackup_failed_backup.json rename to detections/detection_netbackup_failed_backup.json diff --git a/searches/detection_netbackup_no_backups_in_time_period.json b/detections/detection_netbackup_no_backups_in_time_period.json similarity index 100% rename from searches/detection_netbackup_no_backups_in_time_period.json rename to detections/detection_netbackup_no_backups_in_time_period.json diff --git a/searches/detection_netsh_launching_process.json b/detections/detection_netsh_launching_process.json similarity index 100% rename from searches/detection_netsh_launching_process.json rename to detections/detection_netsh_launching_process.json diff --git a/searches/detection_new_aws_console_login_by_user.json b/detections/detection_new_aws_console_login_by_user.json similarity index 100% rename from searches/detection_new_aws_console_login_by_user.json rename to detections/detection_new_aws_console_login_by_user.json diff --git a/searches/detection_new_connections_to_routers.json b/detections/detection_new_connections_to_routers.json similarity index 100% rename from searches/detection_new_connections_to_routers.json rename to detections/detection_new_connections_to_routers.json diff --git a/searches/detection_new_open_s3_buckets.json b/detections/detection_new_open_s3_buckets.json similarity index 100% rename from searches/detection_new_open_s3_buckets.json rename to detections/detection_new_open_s3_buckets.json diff --git a/searches/detection_new_user_accounts.json b/detections/detection_new_user_accounts.json similarity index 100% rename from searches/detection_new_user_accounts.json rename to detections/detection_new_user_accounts.json diff --git a/searches/detection_no_win_updates_in_timeframe.json b/detections/detection_no_win_updates_in_timeframe.json similarity index 100% rename from searches/detection_no_win_updates_in_timeframe.json rename to detections/detection_no_win_updates_in_timeframe.json diff --git a/searches/detection_open_redirect_in_splunk_web.json b/detections/detection_open_redirect_in_splunk_web.json similarity index 100% rename from searches/detection_open_redirect_in_splunk_web.json rename to detections/detection_open_redirect_in_splunk_web.json diff --git a/searches/detection_osx_coldroot_pack.json b/detections/detection_osx_coldroot_pack.json similarity index 100% rename from searches/detection_osx_coldroot_pack.json rename to detections/detection_osx_coldroot_pack.json diff --git a/searches/detection_osx_keyboard_taps.json b/detections/detection_osx_keyboard_taps.json similarity index 100% rename from searches/detection_osx_keyboard_taps.json rename to detections/detection_osx_keyboard_taps.json diff --git a/searches/detection_outbound_smb_connections.json b/detections/detection_outbound_smb_connections.json similarity index 100% rename from searches/detection_outbound_smb_connections.json rename to detections/detection_outbound_smb_connections.json diff --git a/searches/detection_overwrite_accessibility_binaries.json b/detections/detection_overwrite_accessibility_binaries.json similarity index 100% rename from searches/detection_overwrite_accessibility_binaries.json rename to detections/detection_overwrite_accessibility_binaries.json diff --git a/searches/detection_password_sharing.json b/detections/detection_password_sharing.json similarity index 100% rename from searches/detection_password_sharing.json rename to detections/detection_password_sharing.json diff --git a/searches/detection_path_interception_program.exe.json b/detections/detection_path_interception_program.exe.json similarity index 100% rename from searches/detection_path_interception_program.exe.json rename to detections/detection_path_interception_program.exe.json diff --git a/searches/detection_port_monitor_via_registry.json b/detections/detection_port_monitor_via_registry.json similarity index 100% rename from searches/detection_port_monitor_via_registry.json rename to detections/detection_port_monitor_via_registry.json diff --git a/searches/detection_powershell_get_sedebug.json b/detections/detection_powershell_get_sedebug.json similarity index 100% rename from searches/detection_powershell_get_sedebug.json rename to detections/detection_powershell_get_sedebug.json diff --git a/searches/detection_powershell_read_from_lsass.json b/detections/detection_powershell_read_from_lsass.json similarity index 100% rename from searches/detection_powershell_read_from_lsass.json rename to detections/detection_powershell_read_from_lsass.json diff --git a/searches/detection_powershell_reg_key_mod.json b/detections/detection_powershell_reg_key_mod.json similarity index 100% rename from searches/detection_powershell_reg_key_mod.json rename to detections/detection_powershell_reg_key_mod.json diff --git a/searches/detection_process_launching_netsh.json b/detections/detection_process_launching_netsh.json similarity index 100% rename from searches/detection_process_launching_netsh.json rename to detections/detection_process_launching_netsh.json diff --git a/searches/detection_process_with_double_extension.json b/detections/detection_process_with_double_extension.json similarity index 100% rename from searches/detection_process_with_double_extension.json rename to detections/detection_process_with_double_extension.json diff --git a/searches/detection_process_with_spaces_before_extension.json b/detections/detection_process_with_spaces_before_extension.json similarity index 100% rename from searches/detection_process_with_spaces_before_extension.json rename to detections/detection_process_with_spaces_before_extension.json diff --git a/searches/detection_prohibited_allowed_through_fw.json b/detections/detection_prohibited_allowed_through_fw.json similarity index 100% rename from searches/detection_prohibited_allowed_through_fw.json rename to detections/detection_prohibited_allowed_through_fw.json diff --git a/searches/detection_prohibited_apps_spawning_cmdprompt.json b/detections/detection_prohibited_apps_spawning_cmdprompt.json similarity index 100% rename from searches/detection_prohibited_apps_spawning_cmdprompt.json rename to detections/detection_prohibited_apps_spawning_cmdprompt.json diff --git a/searches/detection_prohibited_software_on_endpoint.json b/detections/detection_prohibited_software_on_endpoint.json similarity index 100% rename from searches/detection_prohibited_software_on_endpoint.json rename to detections/detection_prohibited_software_on_endpoint.json diff --git a/searches/detection_protocol_mismatch.json b/detections/detection_protocol_mismatch.json similarity index 100% rename from searches/detection_protocol_mismatch.json rename to detections/detection_protocol_mismatch.json diff --git a/searches/detection_protocols_authenticating_in_cleartext.json b/detections/detection_protocols_authenticating_in_cleartext.json similarity index 100% rename from searches/detection_protocols_authenticating_in_cleartext.json rename to detections/detection_protocols_authenticating_in_cleartext.json diff --git a/searches/detection_psexec_accepteula.json b/detections/detection_psexec_accepteula.json similarity index 100% rename from searches/detection_psexec_accepteula.json rename to detections/detection_psexec_accepteula.json diff --git a/searches/detection_rare_executables_on_endpoint.json b/detections/detection_rare_executables_on_endpoint.json similarity index 100% rename from searches/detection_rare_executables_on_endpoint.json rename to detections/detection_rare_executables_on_endpoint.json diff --git a/searches/detection_reg_manipulating_services.json b/detections/detection_reg_manipulating_services.json similarity index 100% rename from searches/detection_reg_manipulating_services.json rename to detections/detection_reg_manipulating_services.json diff --git a/searches/detection_reg_used_to_hide_files.json b/detections/detection_reg_used_to_hide_files.json similarity index 100% rename from searches/detection_reg_used_to_hide_files.json rename to detections/detection_reg_used_to_hide_files.json diff --git a/searches/detection_registry_persistence.json b/detections/detection_registry_persistence.json similarity index 100% rename from searches/detection_registry_persistence.json rename to detections/detection_registry_persistence.json diff --git a/searches/detection_registry_privilege_escalation.json b/detections/detection_registry_privilege_escalation.json similarity index 100% rename from searches/detection_registry_privilege_escalation.json rename to detections/detection_registry_privilege_escalation.json diff --git a/searches/detection_remote_desktop_bruteforce.json b/detections/detection_remote_desktop_bruteforce.json similarity index 100% rename from searches/detection_remote_desktop_bruteforce.json rename to detections/detection_remote_desktop_bruteforce.json diff --git a/searches/detection_remote_desktop_network_traffic.json b/detections/detection_remote_desktop_network_traffic.json similarity index 100% rename from searches/detection_remote_desktop_network_traffic.json rename to detections/detection_remote_desktop_network_traffic.json diff --git a/searches/detection_remote_desktop_process_running_on_system.json b/detections/detection_remote_desktop_process_running_on_system.json similarity index 100% rename from searches/detection_remote_desktop_process_running_on_system.json rename to detections/detection_remote_desktop_process_running_on_system.json diff --git a/searches/detection_remote_registry_modifications.json b/detections/detection_remote_registry_modifications.json similarity index 100% rename from searches/detection_remote_registry_modifications.json rename to detections/detection_remote_registry_modifications.json diff --git a/searches/detection_remote_wmi_command_attempt.json b/detections/detection_remote_wmi_command_attempt.json similarity index 100% rename from searches/detection_remote_wmi_command_attempt.json rename to detections/detection_remote_wmi_command_attempt.json diff --git a/searches/detection_remote_wmi_process_instantiation.json b/detections/detection_remote_wmi_process_instantiation.json similarity index 100% rename from searches/detection_remote_wmi_process_instantiation.json rename to detections/detection_remote_wmi_process_instantiation.json diff --git a/searches/detection_rundll_loading_dll_by_ordinal.json b/detections/detection_rundll_loading_dll_by_ordinal.json similarity index 100% rename from searches/detection_rundll_loading_dll_by_ordinal.json rename to detections/detection_rundll_loading_dll_by_ordinal.json diff --git a/searches/detection_s3_access_from_new_ip.json b/detections/detection_s3_access_from_new_ip.json similarity index 100% rename from searches/detection_s3_access_from_new_ip.json rename to detections/detection_s3_access_from_new_ip.json diff --git a/searches/detection_samsam_payload_extensions.json b/detections/detection_samsam_payload_extensions.json similarity index 100% rename from searches/detection_samsam_payload_extensions.json rename to detections/detection_samsam_payload_extensions.json diff --git a/searches/detection_samsam_test_file_write.json b/detections/detection_samsam_test_file_write.json similarity index 100% rename from searches/detection_samsam_test_file_write.json rename to detections/detection_samsam_test_file_write.json diff --git a/searches/detection_sc_manipulating_services.json b/detections/detection_sc_manipulating_services.json similarity index 100% rename from searches/detection_sc_manipulating_services.json rename to detections/detection_sc_manipulating_services.json diff --git a/searches/detection_schtasks_forced_reboot.json b/detections/detection_schtasks_forced_reboot.json similarity index 100% rename from searches/detection_schtasks_forced_reboot.json rename to detections/detection_schtasks_forced_reboot.json diff --git a/searches/detection_schtasks_scheduling_job_on_remote_system.json b/detections/detection_schtasks_scheduling_job_on_remote_system.json similarity index 100% rename from searches/detection_schtasks_scheduling_job_on_remote_system.json rename to detections/detection_schtasks_scheduling_job_on_remote_system.json diff --git a/searches/detection_shim_database_file_creation.json b/detections/detection_shim_database_file_creation.json similarity index 100% rename from searches/detection_shim_database_file_creation.json rename to detections/detection_shim_database_file_creation.json diff --git a/searches/detection_shim_database_installation.json b/detections/detection_shim_database_installation.json similarity index 100% rename from searches/detection_shim_database_installation.json rename to detections/detection_shim_database_installation.json diff --git a/searches/detection_short_lived_accounts.json b/detections/detection_short_lived_accounts.json similarity index 100% rename from searches/detection_short_lived_accounts.json rename to detections/detection_short_lived_accounts.json diff --git a/searches/detection_single_letter_executables.json b/detections/detection_single_letter_executables.json similarity index 100% rename from searches/detection_single_letter_executables.json rename to detections/detection_single_letter_executables.json diff --git a/searches/detection_smb_traffic_spike.json b/detections/detection_smb_traffic_spike.json similarity index 100% rename from searches/detection_smb_traffic_spike.json rename to detections/detection_smb_traffic_spike.json diff --git a/searches/detection_sncd_processes.json b/detections/detection_sncd_processes.json similarity index 100% rename from searches/detection_sncd_processes.json rename to detections/detection_sncd_processes.json diff --git a/searches/detection_spectre_meltdown_vulnerabilities.json b/detections/detection_spectre_meltdown_vulnerabilities.json similarity index 100% rename from searches/detection_spectre_meltdown_vulnerabilities.json rename to detections/detection_spectre_meltdown_vulnerabilities.json diff --git a/searches/detection_spike_aws_api_call_per_account.json b/detections/detection_spike_aws_api_call_per_account.json similarity index 100% rename from searches/detection_spike_aws_api_call_per_account.json rename to detections/detection_spike_aws_api_call_per_account.json diff --git a/searches/detection_spike_aws_security_group_activity.json b/detections/detection_spike_aws_security_group_activity.json similarity index 100% rename from searches/detection_spike_aws_security_group_activity.json rename to detections/detection_spike_aws_security_group_activity.json diff --git a/searches/detection_spike_s3_deletion.json b/detections/detection_spike_s3_deletion.json similarity index 100% rename from searches/detection_spike_s3_deletion.json rename to detections/detection_spike_s3_deletion.json diff --git a/searches/detection_spike_vpc_blocked_traffic.json b/detections/detection_spike_vpc_blocked_traffic.json similarity index 100% rename from searches/detection_spike_vpc_blocked_traffic.json rename to detections/detection_spike_vpc_blocked_traffic.json diff --git a/searches/detection_splunk_information_disclosure.json b/detections/detection_splunk_information_disclosure.json similarity index 100% rename from searches/detection_splunk_information_disclosure.json rename to detections/detection_splunk_information_disclosure.json diff --git a/searches/detection_sql_injection_with_long_urls.json b/detections/detection_sql_injection_with_long_urls.json similarity index 100% rename from searches/detection_sql_injection_with_long_urls.json rename to detections/detection_sql_injection_with_long_urls.json diff --git a/searches/detection_stop_security_services.json b/detections/detection_stop_security_services.json similarity index 100% rename from searches/detection_stop_security_services.json rename to detections/detection_stop_security_services.json diff --git a/searches/detection_suspicious_email_attachments.json b/detections/detection_suspicious_email_attachments.json similarity index 100% rename from searches/detection_suspicious_email_attachments.json rename to detections/detection_suspicious_email_attachments.json diff --git a/searches/detection_suspicious_file_writes.json b/detections/detection_suspicious_file_writes.json similarity index 100% rename from searches/detection_suspicious_file_writes.json rename to detections/detection_suspicious_file_writes.json diff --git a/searches/detection_suspicious_java_classes.json b/detections/detection_suspicious_java_classes.json similarity index 100% rename from searches/detection_suspicious_java_classes.json rename to detections/detection_suspicious_java_classes.json diff --git a/searches/detection_suspicious_reg_process.json b/detections/detection_suspicious_reg_process.json similarity index 100% rename from searches/detection_suspicious_reg_process.json rename to detections/detection_suspicious_reg_process.json diff --git a/searches/detection_suspicious_wevtutil_usage.json b/detections/detection_suspicious_wevtutil_usage.json similarity index 100% rename from searches/detection_suspicious_wevtutil_usage.json rename to detections/detection_suspicious_wevtutil_usage.json diff --git a/searches/detection_suspicious_write_to_recycler.json b/detections/detection_suspicious_write_to_recycler.json similarity index 100% rename from searches/detection_suspicious_write_to_recycler.json rename to detections/detection_suspicious_write_to_recycler.json diff --git a/searches/detection_suspicious_write_to_sysvol.json b/detections/detection_suspicious_write_to_sysvol.json similarity index 100% rename from searches/detection_suspicious_write_to_sysvol.json rename to detections/detection_suspicious_write_to_sysvol.json diff --git a/searches/detection_system_processes_run_from_unexpected_locations.json b/detections/detection_system_processes_run_from_unexpected_locations.json similarity index 100% rename from searches/detection_system_processes_run_from_unexpected_locations.json rename to detections/detection_system_processes_run_from_unexpected_locations.json diff --git a/searches/detection_tor_traffic.json b/detections/detection_tor_traffic.json similarity index 100% rename from searches/detection_tor_traffic.json rename to detections/detection_tor_traffic.json diff --git a/searches/detection_unauthorized_assets_via_mac_address.json b/detections/detection_unauthorized_assets_via_mac_address.json similarity index 100% rename from searches/detection_unauthorized_assets_via_mac_address.json rename to detections/detection_unauthorized_assets_via_mac_address.json diff --git a/searches/detection_unauthorized_dns_servers.json b/detections/detection_unauthorized_dns_servers.json similarity index 100% rename from searches/detection_unauthorized_dns_servers.json rename to detections/detection_unauthorized_dns_servers.json diff --git a/searches/detection_uncommon_processes.json b/detections/detection_uncommon_processes.json similarity index 100% rename from searches/detection_uncommon_processes.json rename to detections/detection_uncommon_processes.json diff --git a/searches/detection_unusually_long_commandlines.json b/detections/detection_unusually_long_commandlines.json similarity index 100% rename from searches/detection_unusually_long_commandlines.json rename to detections/detection_unusually_long_commandlines.json diff --git a/searches/detection_unusually_long_content-type_length.json b/detections/detection_unusually_long_content-type_length.json similarity index 100% rename from searches/detection_unusually_long_content-type_length.json rename to detections/detection_unusually_long_content-type_length.json diff --git a/searches/detection_usb_insertion.json b/detections/detection_usb_insertion.json similarity index 100% rename from searches/detection_usb_insertion.json rename to detections/detection_usb_insertion.json diff --git a/searches/detection_users_without_mfa.json b/detections/detection_users_without_mfa.json similarity index 100% rename from searches/detection_users_without_mfa.json rename to detections/detection_users_without_mfa.json diff --git a/searches/detection_web_servers_executing_suspicious_processes.json b/detections/detection_web_servers_executing_suspicious_processes.json similarity index 100% rename from searches/detection_web_servers_executing_suspicious_processes.json rename to detections/detection_web_servers_executing_suspicious_processes.json diff --git a/searches/detection_windows_event_log_cleared.json b/detections/detection_windows_event_log_cleared.json similarity index 100% rename from searches/detection_windows_event_log_cleared.json rename to detections/detection_windows_event_log_cleared.json diff --git a/searches/detection_wmi_perm_event_subscription.json b/detections/detection_wmi_perm_event_subscription.json similarity index 100% rename from searches/detection_wmi_perm_event_subscription.json rename to detections/detection_wmi_perm_event_subscription.json diff --git a/searches/detection_wmi_perm_event_subscription_sysmon.json b/detections/detection_wmi_perm_event_subscription_sysmon.json similarity index 100% rename from searches/detection_wmi_perm_event_subscription_sysmon.json rename to detections/detection_wmi_perm_event_subscription_sysmon.json diff --git a/searches/detection_wmi_process_launch.json b/detections/detection_wmi_process_launch.json similarity index 100% rename from searches/detection_wmi_process_launch.json rename to detections/detection_wmi_process_launch.json diff --git a/searches/detection_wmi_script_execution.json b/detections/detection_wmi_script_execution.json similarity index 100% rename from searches/detection_wmi_script_execution.json rename to detections/detection_wmi_script_execution.json diff --git a/searches/detection_wmi_temp_event_subscription.json b/detections/detection_wmi_temp_event_subscription.json similarity index 100% rename from searches/detection_wmi_temp_event_subscription.json rename to detections/detection_wmi_temp_event_subscription.json diff --git a/searches/contextual_aws_network_interface_details.json b/investigations/contextual_aws_network_interface_details.json similarity index 100% rename from searches/contextual_aws_network_interface_details.json rename to investigations/contextual_aws_network_interface_details.json diff --git a/searches/contextual_aws_s3_bucket_details.json b/investigations/contextual_aws_s3_bucket_details.json similarity index 100% rename from searches/contextual_aws_s3_bucket_details.json rename to investigations/contextual_aws_s3_bucket_details.json diff --git a/searches/contextual_first_occurrence_mac_address.json b/investigations/contextual_first_occurrence_mac_address.json similarity index 100% rename from searches/contextual_first_occurrence_mac_address.json rename to investigations/contextual_first_occurrence_mac_address.json diff --git a/searches/contextual_get_acl_details.json b/investigations/contextual_get_acl_details.json similarity index 100% rename from searches/contextual_get_acl_details.json rename to investigations/contextual_get_acl_details.json diff --git a/searches/contextual_get_authentication_logs_for_endpoint.json b/investigations/contextual_get_authentication_logs_for_endpoint.json similarity index 100% rename from searches/contextual_get_authentication_logs_for_endpoint.json rename to investigations/contextual_get_authentication_logs_for_endpoint.json diff --git a/searches/contextual_get_backup_logs_for_endpoint.json b/investigations/contextual_get_backup_logs_for_endpoint.json similarity index 100% rename from searches/contextual_get_backup_logs_for_endpoint.json rename to investigations/contextual_get_backup_logs_for_endpoint.json diff --git a/searches/contextual_get_ec2_details_by_instance_id.json b/investigations/contextual_get_ec2_details_by_instance_id.json similarity index 100% rename from searches/contextual_get_ec2_details_by_instance_id.json rename to investigations/contextual_get_ec2_details_by_instance_id.json diff --git a/searches/contextual_get_ec2_launch_details.json b/investigations/contextual_get_ec2_launch_details.json similarity index 100% rename from searches/contextual_get_ec2_launch_details.json rename to investigations/contextual_get_ec2_launch_details.json diff --git a/searches/contextual_get_notable_history_for_endpoint.json b/investigations/contextual_get_notable_history_for_endpoint.json similarity index 100% rename from searches/contextual_get_notable_history_for_endpoint.json rename to investigations/contextual_get_notable_history_for_endpoint.json diff --git a/searches/contextual_get_notable_info.json b/investigations/contextual_get_notable_info.json similarity index 100% rename from searches/contextual_get_notable_info.json rename to investigations/contextual_get_notable_info.json diff --git a/searches/contextual_get_risk_for_endpoint.json b/investigations/contextual_get_risk_for_endpoint.json similarity index 100% rename from searches/contextual_get_risk_for_endpoint.json rename to investigations/contextual_get_risk_for_endpoint.json diff --git a/searches/contextual_get_risk_for_user.json b/investigations/contextual_get_risk_for_user.json similarity index 100% rename from searches/contextual_get_risk_for_user.json rename to investigations/contextual_get_risk_for_user.json diff --git a/searches/contextual_get_update_logs_for_endpoint.json b/investigations/contextual_get_update_logs_for_endpoint.json similarity index 100% rename from searches/contextual_get_update_logs_for_endpoint.json rename to investigations/contextual_get_update_logs_for_endpoint.json diff --git a/searches/contextual_get_user_info_from_identity_table.json b/investigations/contextual_get_user_info_from_identity_table.json similarity index 100% rename from searches/contextual_get_user_info_from_identity_table.json rename to investigations/contextual_get_user_info_from_identity_table.json diff --git a/searches/contextual_get_vulnerability_logs_for_endpoint.json b/investigations/contextual_get_vulnerability_logs_for_endpoint.json similarity index 100% rename from searches/contextual_get_vulnerability_logs_for_endpoint.json rename to investigations/contextual_get_vulnerability_logs_for_endpoint.json diff --git a/searches/investigative_aws_activity_via_region.json b/investigations/investigative_aws_activity_via_region.json similarity index 100% rename from searches/investigative_aws_activity_via_region.json rename to investigations/investigative_aws_activity_via_region.json diff --git a/searches/investigative_aws_user_activities_by_user_field.json b/investigations/investigative_aws_user_activities_by_user_field.json similarity index 100% rename from searches/investigative_aws_user_activities_by_user_field.json rename to investigations/investigative_aws_user_activities_by_user_field.json diff --git a/searches/investigative_aws_user_activity_by_accesskeyid.json b/investigations/investigative_aws_user_activity_by_accesskeyid.json similarity index 100% rename from searches/investigative_aws_user_activity_by_accesskeyid.json rename to investigations/investigative_aws_user_activity_by_accesskeyid.json diff --git a/searches/investigative_aws_user_activity_by_src_user.json b/investigations/investigative_aws_user_activity_by_src_user.json similarity index 100% rename from searches/investigative_aws_user_activity_by_src_user.json rename to investigations/investigative_aws_user_activity_by_src_user.json diff --git a/searches/investigative_dns_server_history.json b/investigations/investigative_dns_server_history.json similarity index 100% rename from searches/investigative_dns_server_history.json rename to investigations/investigative_dns_server_history.json diff --git a/searches/investigative_dns_traffic_stats.json b/investigations/investigative_dns_traffic_stats.json similarity index 100% rename from searches/investigative_dns_traffic_stats.json rename to investigations/investigative_dns_traffic_stats.json diff --git a/searches/investigative_email_sent_to_hidden_cobra_actors.json b/investigations/investigative_email_sent_to_hidden_cobra_actors.json similarity index 100% rename from searches/investigative_email_sent_to_hidden_cobra_actors.json rename to investigations/investigative_email_sent_to_hidden_cobra_actors.json diff --git a/searches/investigative_get_all_aws_activitiy_from_city.json b/investigations/investigative_get_all_aws_activitiy_from_city.json similarity index 100% rename from searches/investigative_get_all_aws_activitiy_from_city.json rename to investigations/investigative_get_all_aws_activitiy_from_city.json diff --git a/searches/investigative_get_all_aws_activitiy_from_country.json b/investigations/investigative_get_all_aws_activitiy_from_country.json similarity index 100% rename from searches/investigative_get_all_aws_activitiy_from_country.json rename to investigations/investigative_get_all_aws_activitiy_from_country.json diff --git a/searches/investigative_get_all_aws_activitiy_from_region.json b/investigations/investigative_get_all_aws_activitiy_from_region.json similarity index 100% rename from searches/investigative_get_all_aws_activitiy_from_region.json rename to investigations/investigative_get_all_aws_activitiy_from_region.json diff --git a/searches/investigative_get_all_aws_activitiy_from_src_ip.json b/investigations/investigative_get_all_aws_activitiy_from_src_ip.json similarity index 100% rename from searches/investigative_get_all_aws_activitiy_from_src_ip.json rename to investigations/investigative_get_all_aws_activitiy_from_src_ip.json diff --git a/searches/investigative_get_all_backup_data_for_host.json b/investigations/investigative_get_all_backup_data_for_host.json similarity index 100% rename from searches/investigative_get_all_backup_data_for_host.json rename to investigations/investigative_get_all_backup_data_for_host.json diff --git a/searches/investigative_get_email_info.json b/investigations/investigative_get_email_info.json similarity index 100% rename from searches/investigative_get_email_info.json rename to investigations/investigative_get_email_info.json diff --git a/searches/investigative_get_emails_from_sender.json b/investigations/investigative_get_emails_from_sender.json similarity index 100% rename from searches/investigative_get_emails_from_sender.json rename to investigations/investigative_get_emails_from_sender.json diff --git a/searches/investigative_get_emails_from_source.json b/investigations/investigative_get_emails_from_source.json similarity index 100% rename from searches/investigative_get_emails_from_source.json rename to investigations/investigative_get_emails_from_source.json diff --git a/searches/investigative_get_logon_rights_modifications_for_endpoint.json b/investigations/investigative_get_logon_rights_modifications_for_endpoint.json similarity index 100% rename from searches/investigative_get_logon_rights_modifications_for_endpoint.json rename to investigations/investigative_get_logon_rights_modifications_for_endpoint.json diff --git a/searches/investigative_get_logon_rights_modifications_for_user.json b/investigations/investigative_get_logon_rights_modifications_for_user.json similarity index 100% rename from searches/investigative_get_logon_rights_modifications_for_user.json rename to investigations/investigative_get_logon_rights_modifications_for_user.json diff --git a/searches/investigative_get_network_traffic_from_src_ip.json b/investigations/investigative_get_network_traffic_from_src_ip.json similarity index 100% rename from searches/investigative_get_network_traffic_from_src_ip.json rename to investigations/investigative_get_network_traffic_from_src_ip.json diff --git a/searches/investigative_get_parent_process_info.json b/investigations/investigative_get_parent_process_info.json similarity index 100% rename from searches/investigative_get_parent_process_info.json rename to investigations/investigative_get_parent_process_info.json diff --git a/searches/investigative_get_process_creating_dns_traffic.json b/investigations/investigative_get_process_creating_dns_traffic.json similarity index 100% rename from searches/investigative_get_process_creating_dns_traffic.json rename to investigations/investigative_get_process_creating_dns_traffic.json diff --git a/searches/investigative_get_process_info.json b/investigations/investigative_get_process_info.json similarity index 100% rename from searches/investigative_get_process_info.json rename to investigations/investigative_get_process_info.json diff --git a/searches/investigative_get_process_info_for_port.json b/investigations/investigative_get_process_info_for_port.json similarity index 100% rename from searches/investigative_get_process_info_for_port.json rename to investigations/investigative_get_process_info_for_port.json diff --git a/searches/investigative_get_rdp_authentications.json b/investigations/investigative_get_rdp_authentications.json similarity index 100% rename from searches/investigative_get_rdp_authentications.json rename to investigations/investigative_get_rdp_authentications.json diff --git a/searches/investigative_get_registry_activities.json b/investigations/investigative_get_registry_activities.json similarity index 100% rename from searches/investigative_get_registry_activities.json rename to investigations/investigative_get_registry_activities.json diff --git a/searches/investigative_get_web_activity.json b/investigations/investigative_get_web_activity.json similarity index 100% rename from searches/investigative_get_web_activity.json rename to investigations/investigative_get_web_activity.json diff --git a/searches/investigative_get_web_activity_by_src_ip.json b/investigations/investigative_get_web_activity_by_src_ip.json similarity index 100% rename from searches/investigative_get_web_activity_by_src_ip.json rename to investigations/investigative_get_web_activity_by_src_ip.json diff --git a/searches/investigative_get_web_posts_by_src.json b/investigations/investigative_get_web_posts_by_src.json similarity index 100% rename from searches/investigative_get_web_posts_by_src.json rename to investigations/investigative_get_web_posts_by_src.json diff --git a/searches/investigative_get_web_session_info.json b/investigations/investigative_get_web_session_info.json similarity index 100% rename from searches/investigative_get_web_session_info.json rename to investigations/investigative_get_web_session_info.json diff --git a/searches/investigative_get_wmi_sysmon_events.json b/investigations/investigative_get_wmi_sysmon_events.json similarity index 100% rename from searches/investigative_get_wmi_sysmon_events.json rename to investigations/investigative_get_wmi_sysmon_events.json diff --git a/searches/investigative_suspicious_strings_in_HTTP_header.json b/investigations/investigative_suspicious_strings_in_HTTP_header.json similarity index 100% rename from searches/investigative_suspicious_strings_in_HTTP_header.json rename to investigations/investigative_suspicious_strings_in_HTTP_header.json diff --git a/searches/investigative_user_activity_via_cloudtrail.json b/investigations/investigative_user_activity_via_cloudtrail.json similarity index 100% rename from searches/investigative_user_activity_via_cloudtrail.json rename to investigations/investigative_user_activity_via_cloudtrail.json