Michael Haag dafa859f55 The Haag Element: Breaking Down AA24-241A

2024-09-03 13:03:21 -06:00

..

detect_arp_poisoning.yml

network detections

2024-08-15 15:38:15 -05:00

detect_dga_domains_using_pretrained_model_in_dsdl.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

detect_hosts_connecting_to_dynamic_domain_providers.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

detect_ipv6_network_infrastructure_threats.yml

Release Branch v4.33.0

2024-06-05 21:05:06 +00:00

detect_large_outbound_icmp_packets.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

detect_outbound_ldap_traffic.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

detect_outbound_smb_traffic.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

detect_port_security_violation.yml

Missed version and date updates

2024-08-16 08:41:51 -05:00

detect_remote_access_software_usage_dns.yml

The Haag Element: Breaking Down AA24-241A

2024-09-03 13:03:21 -06:00

detect_remote_access_software_usage_traffic.yml

Modified macro name for clarity, updated how to implements with details

2024-07-26 14:11:24 -05:00

detect_rogue_dhcp_server.yml

network detections

2024-08-15 15:38:15 -05:00

detect_snicat_sni_exfiltration.yml

Release Branch v4.33.0

2024-06-05 21:05:06 +00:00

detect_software_download_to_network_device.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

detect_traffic_mirroring.yml

network detections

2024-08-15 15:38:15 -05:00

detect_unauthorized_assets_by_mac_address.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

detect_windows_dns_sigred_via_splunk_stream.yml

network detections

2024-08-15 15:38:15 -05:00

detect_windows_dns_sigred_via_zeek.yml

Missed cloud

2024-08-19 10:32:38 -05:00

detect_zerologon_via_zeek.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

dns_query_length_outliers___mltk.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

dns_query_length_with_high_standard_deviation.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

excessive_dns_failures.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml

The Haag Element: Breaking Down AA24-241A

2024-09-03 13:03:21 -06:00

high_volume_of_bytes_out_to_url.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

hosts_receiving_high_volume_of_network_traffic_from_email_server.yml

Release Branch v4.33.0

2024-06-05 21:05:06 +00:00

internal_horizontal_port_scan.yml

updating risk_message

2024-08-07 12:50:29 -07:00

internal_vertical_port_scan.yml

updating data source files

2024-07-16 08:11:24 -07:00

internal_vulnerability_scan.yml

updating descriptions

2024-07-11 18:06:51 +10:00

large_volume_of_dns_any_queries.yml

Release Branch v4.33.0

2024-06-05 21:05:06 +00:00

multiple_archive_files_http_post_traffic.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

ngrok_reverse_proxy_on_network.yml

The Haag Element: Breaking Down AA24-241A

2024-09-03 13:03:21 -06:00

plain_http_post_exfiltrated_data.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

prohibited_network_traffic_allowed.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

protocol_or_port_mismatch.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

protocols_passing_authentication_in_cleartext.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

remote_desktop_network_bruteforce.yml

Release Branch v4.33.0

2024-06-05 21:05:06 +00:00

remote_desktop_network_traffic.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

smb_traffic_spike___mltk.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

smb_traffic_spike.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

ssl_certificates_with_punycode.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

tor_traffic.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

unusually_long_content_type_length.yml

Release Branch v4.33.0

2024-06-05 21:05:06 +00:00

windows_ad_replication_service_traffic.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

windows_ad_rogue_domain_controller_network_activity.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

zeek_x509_certificate_with_punycode.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00