srv-rr-gh-researchbt 37b4d3b29c Branch was auto-updated.

2023-04-20 12:18:29 -07:00

..

ssa___anomalous_usage_of_account_credentials.yml

Added data sources

2023-01-23 16:55:32 +01:00

ssa___anomalous_usage_of_archive_tools.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___attempt_to_delete_services.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___attempt_to_disable_services.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___attempted_credential_dump_from_registry_via_reg_exe.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___bcdedit_failure_recovery_modification.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___clear_unallocated_sector_using_cipher_app.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___delete_a_net_user.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___deny_permission_using_cacls_utility.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___detect_kerberoasting.yml

Added data sources

2023-01-23 16:55:32 +01:00

ssa___detect_prohibited_applications_spawning_cmd_exe.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___detect_rclone_command_line_usage.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___disable_defender_antivirus_registry.yml

Added data sources

2023-01-23 16:55:32 +01:00

ssa___disable_net_user_account.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___dns_exfiltration_using_nslookup_app.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___excessive_number_of_office_files_copied.yml

Added data sources

2023-01-23 16:55:32 +01:00

ssa___first_time_seen_command_line_argument.yml

converted ssa detections to ocsf

2023-02-28 12:00:16 +01:00

ssa___fsutil_zeroing_file.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___grant_permission_using_cacls_utility.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___hiding_files_and_directories_with_attrib_exe.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___high_file_deletion_frequency.yml

Added data sources

2023-01-23 16:55:32 +01:00

ssa___modify_acls_permission_of_files_or_folders.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___office_product_spawning_windows_script_host.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___rare_parent_child_process_relationship.yml

Added data sources

2023-01-23 16:55:32 +01:00

ssa___resize_shadowstorage_volume.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___sdelete_application_execution.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___system_process_running_from_unexpected_location.yml

version bump

2023-04-20 13:32:18 -05:00

ssa___wbadmin_delete_system_backups.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___wevtutil_usage_to_clear_logs.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___wevtutil_usage_to_disable_logs.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_bits_job_persistence.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_bitsadmin_download_file.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_certutil_decode_file.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_certutil_urlcache_download.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_certutil_verifyctl_download.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_com_hijacking_inprocserver32_modification.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_curl_upload_to_remote_destination.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_defender_tools_in_non_standard_path.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_diskshadow_proxy_execution.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_dotnet_binary_in_non_standard_path.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_eventvwr_uac_bypass.yml

adding files for missing detection

2023-04-19 19:25:56 -07:00

ssa___windows_exchange_powershell_module_usage.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_execute_arbitrary_commands_with_msdt.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_ingress_tool_transfer_using_explorer.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_lolbin_binary_in_non_standard_path.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_mshta_child_process.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_mshta_command_line_url.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_mshta_inline_hta_execution.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_odbcconf_load_response_file.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_os_credential_dumping_with_procdump.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_powershell_connect_to_internet_with_hidden_window.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_powershell_downloadfile.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_powershell_start_bitstransfer.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_rasautou_dll_execution.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_rundll32_comsvcs_memory_dump.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_rundll32_inline_hta_execution.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_script_host_spawn_msbuild.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_wmiprvse_spawn_msbuild.yml

updated detections

2023-03-30 10:30:26 +02:00

ssa___windows_wsreset_uac_bypass.yml

Added data sources

2023-01-23 16:55:32 +01:00