splunk-security_content

7zip_commandline_to_smb_share_path.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

access_lsass_memory_for_dump_creation.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

active_directory_lateral_movement_identified.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

active_directory_privilege_escalation_identified.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

active_setup_registry_autostart.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

add_defaultuser_and_password_in_registry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

add_or_set_windows_defender_exclusion.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

adsisearcher_account_discovery.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

advanced_ip_or_port_scanner_execution.yml

New Rules & Updates - Oct 25 (#3726 )

2025-10-24 14:19:48 -07:00

allow_file_and_printing_sharing_in_firewall.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

allow_inbound_traffic_by_firewall_rule_registry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

allow_inbound_traffic_in_firewall_rule.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

allow_network_discovery_in_firewall.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

allow_operation_with_consent_admin.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

anomalous_usage_of_7zip.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

attacker_tools_on_endpoint.yml

Update attack_data links

2025-09-09 08:35:57 -04:00

attempt_to_add_certificate_to_untrusted_store.yml

Fix Issues & Updates (#3705 )

2025-10-13 09:18:21 -07:00

auto_admin_logon_registry_entry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

batch_file_write_to_system32.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

bcdedit_command_back_to_normal_mode_boot.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

bcdedit_failure_recovery_modification.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

bits_job_persistence.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

bitsadmin_download_file.yml

version bumps (#3732 )

2025-10-17 11:15:52 -07:00

certutil_exe_certificate_extraction.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

certutil_with_decode_argument.yml

GhostRedirectors

2025-09-18 13:39:40 -06:00

change_to_safe_mode_with_network_config.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

chcp_command_execution.yml

more_interlock_rat

2025-08-07 13:50:17 +02:00

check_elevated_cmd_using_whoami.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

child_processes_of_spoolsv_exe.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

cisco_isovalent___access_to_cloud_metadata_service.yml

Cisco Isovalent - Add first batch of new detections (#3706 )

2026-01-06 01:24:39 +01:00

cisco_isovalent___cron_job_creation.yml

Cisco Isovalent - Add first batch of new detections (#3706 )

2026-01-06 01:24:39 +01:00

cisco_isovalent___curl_execution_with_insecure_flags.yml

Cisco Isovalent - Add first batch of new detections (#3706 )

2026-01-06 01:24:39 +01:00

cisco_isovalent___kprobe_spike.yml

Cisco Isovalent - Add first batch of new detections (#3706 )

2026-01-06 01:24:39 +01:00

cisco_isovalent___late_process_execution.yml

Cisco Isovalent - Add first batch of new detections (#3706 )

2026-01-06 01:24:39 +01:00

cisco_isovalent___non_allowlisted_image_use.yml

Cisco Isovalent - Add first batch of new detections (#3706 )

2026-01-06 01:24:39 +01:00

cisco_isovalent___nsenter_usage_in_kubernetes_pod.yml

Cisco Isovalent - Add first batch of new detections (#3706 )

2026-01-06 01:24:39 +01:00

cisco_isovalent___pods_running_offensive_tools.yml

Cisco Isovalent - Add first batch of new detections (#3706 )

2026-01-06 01:24:39 +01:00

cisco_isovalent___potential_escape_to_host.yml

Cisco Isovalent - Add first batch of new detections (#3706 )

2026-01-06 01:24:39 +01:00

cisco_isovalent___shell_execution.yml

Cisco Isovalent - Add first batch of new detections (#3706 )

2026-01-06 01:24:39 +01:00

cisco_nvm___curl_execution_with_insecure_flags.yml

Add some missing products. I assume all these detections want to be for all 3 splunk products.

2025-12-17 11:46:11 -08:00

cisco_nvm___installation_of_typosquatted_python_package.yml

Add some missing products. I assume all these detections want to be for all 3 splunk products.

2025-12-17 11:46:11 -08:00

cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml

Add some missing products. I assume all these detections want to be for all 3 splunk products.

2025-12-17 11:46:11 -08:00

cisco_nvm___non_network_binary_making_network_connection.yml

Add some missing products. I assume all these detections want to be for all 3 splunk products.

2025-12-17 11:46:11 -08:00

cisco_nvm___outbound_connection_to_suspicious_port.yml

Add some missing products. I assume all these detections want to be for all 3 splunk products.

2025-12-17 11:46:11 -08:00

cisco_nvm___rclone_execution_with_network_activity.yml

Add some missing products. I assume all these detections want to be for all 3 splunk products.

2025-12-17 11:46:11 -08:00

cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml

Add some missing products. I assume all these detections want to be for all 3 splunk products.

2025-12-17 11:46:11 -08:00

cisco_nvm___susp_script_from_archive_triggering_network_activity.yml

Add some missing products. I assume all these detections want to be for all 3 splunk products.

2025-12-17 11:46:11 -08:00

cisco_nvm___suspicious_download_from_file_sharing_website.yml

Add some missing products. I assume all these detections want to be for all 3 splunk products.

2025-12-17 11:46:11 -08:00

cisco_nvm___suspicious_file_download_via_headless_browser.yml

Add some missing products. I assume all these detections want to be for all 3 splunk products.

2025-12-17 11:46:11 -08:00

cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml

Add some missing products. I assume all these detections want to be for all 3 splunk products.

2025-12-17 11:46:11 -08:00

cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml

Add some missing products. I assume all these detections want to be for all 3 splunk products.

2025-12-17 11:46:11 -08:00

cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml

Add some missing products. I assume all these detections want to be for all 3 splunk products.

2025-12-17 11:46:11 -08:00

cisco_nvm___webserver_download_from_file_sharing_website.yml

Add some missing products. I assume all these detections want to be for all 3 splunk products.

2025-12-17 11:46:11 -08:00

clear_unallocated_sector_using_cipher_app.yml

Scattered Spider Tags

2025-07-31 10:54:21 -06:00

clop_common_exec_parameter.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

clop_ransomware_known_service_name.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

cmd_carry_out_string_command_parameter.yml

objectivity_stealer

2025-08-25 18:46:15 +02:00

cmd_echo_pipe___escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

cmlua_or_cmstplua_uac_bypass.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

common_ransomware_extensions.yml

Fix Issues & Updates (#3705 )

2025-10-13 09:18:21 -07:00

common_ransomware_notes.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

connectwise_screenconnect_path_traversal_windows_sacl.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

connectwise_screenconnect_path_traversal.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

conti_common_exec_parameter.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

control_loading_from_world_writable_directory.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

create_or_delete_windows_shares_using_net_exe.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

create_remote_thread_in_shell_application.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

create_remote_thread_into_lsass.yml

lokibot (#3701 )

2025-10-10 18:32:18 +00:00

creation_of_lsass_dump_with_taskmgr.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

creation_of_shadow_copy_with_wmic_and_powershell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

creation_of_shadow_copy.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

credential_dumping_via_copy_command_from_shadow_copy.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

credential_dumping_via_symlink_to_shadow_copy.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

crowdstrike_admin_weak_password_policy.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

crowdstrike_admin_with_duplicate_password.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

crowdstrike_falcon_stream_alerts.yml

updating the eval

2025-07-07 13:14:30 -07:00

crowdstrike_high_identity_risk_severity.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

crowdstrike_medium_identity_risk_severity.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

crowdstrike_medium_severity_alert.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

crowdstrike_multiple_low_severity_alerts.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

crowdstrike_privilege_escalation_for_non_admin_user.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

crowdstrike_user_weak_password_policy.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

crowdstrike_user_with_duplicate_password.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

csc_net_on_the_fly_compilation.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

delete_shadowcopy_with_powershell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

deleting_shadow_copies.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_azurehound_command_line_arguments.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_azurehound_file_modifications.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_baron_samedit_cve_2021_3156_segfault.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_baron_samedit_cve_2021_3156_via_osquery.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_baron_samedit_cve_2021_3156.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_certify_command_line_arguments.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_certify_with_powershell_script_block_logging.yml

Version bumps

2025-06-24 12:43:01 -05:00

detect_certipy_file_modifications.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_computer_changed_with_anonymous_account.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_copy_of_shadowcopy_with_script_block_logging.yml

Version bumps

2025-06-24 12:43:01 -05:00

detect_credential_dumping_through_lsass_access.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

detect_empire_with_powershell_script_block_logging.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

detect_excessive_account_lockouts_from_endpoint.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_excessive_user_account_lockouts.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

detect_exchange_web_shell.yml

GhostRedirectors

2025-09-18 13:39:40 -06:00

detect_html_help_renamed.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

detect_html_help_url_in_command_line.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

detect_html_help_using_infotech_storage_handlers.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

detect_mimikatz_with_powershell_script_block_logging.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

detect_mshta_inline_hta_execution.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

detect_mshta_renamed.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

detect_mshta_url_in_command_line.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

detect_new_local_admin_account.yml

New Rules & Updates - Oct 25 (#3726 )

2025-10-24 14:19:48 -07:00

detect_outlook_exe_writing_a_zip_file.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

detect_password_spray_attack_behavior_from_source.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_password_spray_attack_behavior_on_user.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_path_interception_by_creation_of_program_exe.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

detect_prohibited_applications_spawning_cmd_exe.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

detect_psexec_with_accepteula_flag.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

detect_rare_executables.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_rclone_command_line_usage.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

detect_regasm_spawning_a_process.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_regasm_with_network_connection.yml

New Rules & Updates - Oct 25 (#3726 )

2025-10-24 14:19:48 -07:00

detect_regasm_with_no_command_line_arguments.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

detect_regsvcs_spawning_a_process.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_regsvcs_with_network_connection.yml

New Rules & Updates - Oct 25 (#3726 )

2025-10-24 14:19:48 -07:00

detect_regsvcs_with_no_command_line_arguments.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

detect_regsvr32_application_control_bypass.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_remote_access_software_usage_file.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

detect_remote_access_software_usage_fileinfo.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

detect_remote_access_software_usage_process.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

detect_remote_access_software_usage_registry.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

detect_renamed_7_zip.yml

innoloader

2025-06-02 09:43:51 +02:00

detect_renamed_psexec.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_renamed_rclone.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_renamed_winrar.yml

multiple updates and fixes

2025-06-17 01:22:13 +02:00

detect_rtlo_in_file_name.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_rtlo_in_process.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_rundll32_inline_hta_execution.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

detect_sharphound_command_line_arguments.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_sharphound_file_modifications.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_sharphound_usage.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_use_of_cmd_exe_to_launch_script_interpreters.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_wmi_event_subscription_persistence.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

detection_of_tools_built_by_nirsoft.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

disable_amsi_through_registry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

disable_defender_antivirus_registry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

disable_defender_blockatfirstseen_feature.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

disable_defender_enhanced_notification.yml

Fix incorrect data sources

2025-06-10 16:04:59 +02:00

disable_defender_mpengine_registry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

disable_defender_spynet_reporting.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

disable_defender_submit_samples_consent_feature.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

disable_etw_through_registry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

disable_logs_using_wevtutil.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

disable_registry_tool.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

disable_schedule_task.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

disable_security_logs_using_minint_registry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

disable_show_hidden_files.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

disable_uac_remote_restriction.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

disable_windows_app_hotkeys.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

disable_windows_behavior_monitoring.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

disable_windows_smartscreen_protection.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml

interlock_ransomware

2025-07-28 11:58:45 +02:00

disabled_kerberos_pre_authentication_discovery_with_powerview.yml

interlock_ransomware

2025-07-28 11:58:45 +02:00

disabling_cmd_application.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

disabling_controlpanel.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

disabling_defender_services.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

disabling_firewall_with_netsh.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

disabling_folderoptions_windows_feature.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

disabling_norun_windows_app.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

disabling_remote_user_account_control.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

disabling_systemrestore_in_registry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

disabling_task_manager.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

disabling_windows_local_security_authority_defences_via_registry.yml

disable_lsa

2025-08-20 17:16:02 +02:00

dllhost_with_no_command_line_arguments_with_network.yml

small updates

2025-06-30 23:41:42 +02:00

dns_exfiltration_using_nslookup_app.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

domain_account_discovery_with_dsquery.yml

lamehug

2025-08-27 13:48:15 +02:00

domain_account_discovery_with_wmic.yml

interlock_ransomware

2025-07-28 11:58:45 +02:00

domain_controller_discovery_with_nltest.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

domain_controller_discovery_with_wmic.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

domain_group_discovery_with_adsisearcher.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

domain_group_discovery_with_dsquery.yml

lamehug

2025-08-27 13:48:15 +02:00

domain_group_discovery_with_wmic.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

download_files_using_telegram.yml

objectivity_stealer

2025-08-25 18:46:15 +02:00

drop_icedid_license_dat.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

dsquery_domain_discovery.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

dump_lsass_via_comsvcs_dll.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

dump_lsass_via_procdump.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

elevated_group_discovery_with_powerview.yml

Version bumps

2025-06-24 12:43:01 -05:00

elevated_group_discovery_with_wmic.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

enable_rdp_in_other_port_number.yml

rdp_artifacts_and_evasion

2025-08-07 14:25:22 +02:00

enable_wdigest_uselogoncredential_registry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

enumerate_users_local_group_using_telegram.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

esentutl_sam_copy.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

etw_registry_disabled.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

eventvwr_uac_bypass.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

excessive_attempt_to_disable_services.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

excessive_distinct_processes_from_windows_temp.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

excessive_file_deletion_in_windefender_folder.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

excessive_number_of_service_control_start_as_disabled.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

excessive_number_of_taskhost_processes.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

excessive_usage_of_cacls_app.yml

multiple updates and fixes

2025-06-17 01:22:13 +02:00

excessive_usage_of_nslookup_app.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

excessive_usage_of_sc_service_utility.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

excessive_usage_of_taskkill.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

exchange_powershell_abuse_via_ssrf.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

exchange_powershell_module_usage.yml

Scattered Spider Tags

2025-07-31 10:54:21 -06:00

executable_file_written_in_administrative_smb_share.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

executables_or_script_creation_in_suspicious_path.yml

Add New Analytics Covering SesameOp and PromptFlux (#3827 )

2026-01-08 00:58:33 +01:00

executables_or_script_creation_in_temp_path.yml

Add New Analytics Covering SesameOp and PromptFlux (#3827 )

2026-01-08 00:58:33 +01:00

execute_javascript_with_jscript_com_clsid.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

execution_of_file_with_multiple_extensions.yml

execution of file with multiple extensions: fixing rtf.exe (#3778 )

2025-11-12 16:32:08 -08:00

file_download_or_read_to_pipe_execution.yml

npm Supply Chain Compromise & Lifecycle Hook Abuse Detection (#3806 )

2025-11-25 14:56:20 -08:00

file_with_samsam_extension.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

firewall_allowed_program_enable.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

first_time_seen_child_process_of_zoom.yml

Bumping version & date

2025-05-15 08:04:29 -05:00

first_time_seen_running_windows_service.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

fodhelper_uac_bypass.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

fsutil_zeroing_file.yml

updating detections

2025-05-08 13:03:10 -07:00

get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

get_addefaultdomainpasswordpolicy_with_powershell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

get_aduser_with_powershell_script_block.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

get_aduser_with_powershell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

get_aduserresultantpasswordpolicy_with_powershell_script_block.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

get_aduserresultantpasswordpolicy_with_powershell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

get_domainpolicy_with_powershell_script_block.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

get_domainpolicy_with_powershell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

get_domaintrust_with_powershell_script_block.yml

Version bumps

2025-06-24 12:43:01 -05:00

get_domaintrust_with_powershell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

get_domainuser_with_powershell_script_block.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

get_domainuser_with_powershell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

get_foresttrust_with_powershell_script_block.yml

Version bumps

2025-06-24 12:43:01 -05:00

get_foresttrust_with_powershell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

get_wmiobject_group_discovery_with_script_block_logging.yml

Version bumps

2025-06-24 12:43:01 -05:00

get_wmiobject_group_discovery.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

getadcomputer_with_powershell_script_block.yml

Version bumps

2025-06-24 12:43:01 -05:00

getadcomputer_with_powershell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

getadgroup_with_powershell_script_block.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

getadgroup_with_powershell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

getcurrent_user_with_powershell_script_block.yml

Version bumps

2025-06-24 12:43:01 -05:00

getcurrent_user_with_powershell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

getdomaincomputer_with_powershell_script_block.yml

Version bumps

2025-06-24 12:43:01 -05:00

getdomaincomputer_with_powershell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

getdomaincontroller_with_powershell_script_block.yml

Version bumps

2025-06-24 12:43:01 -05:00

getdomaincontroller_with_powershell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

getdomaingroup_with_powershell_script_block.yml

Version bumps

2025-06-24 12:43:01 -05:00

getdomaingroup_with_powershell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

getlocaluser_with_powershell_script_block.yml

Version bumps

2025-06-24 12:43:01 -05:00

getlocaluser_with_powershell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

getnettcpconnection_with_powershell_script_block.yml

Version bumps

2025-06-24 12:43:01 -05:00

getnettcpconnection_with_powershell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

getwmiobject_ds_computer_with_powershell_script_block.yml

Version bumps

2025-06-24 12:43:01 -05:00

getwmiobject_ds_computer_with_powershell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

getwmiobject_ds_group_with_powershell_script_block.yml

Version bumps

2025-06-24 12:43:01 -05:00

getwmiobject_ds_group_with_powershell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

getwmiobject_ds_user_with_powershell_script_block.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

getwmiobject_ds_user_with_powershell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

getwmiobject_user_account_with_powershell_script_block.yml

Version bumps

2025-06-24 12:43:01 -05:00

getwmiobject_user_account_with_powershell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

github_workflow_file_creation_or_modification.yml

npm Supply Chain Compromise & Lifecycle Hook Abuse Detection (#3806 )

2025-11-25 14:56:20 -08:00

gpupdate_with_no_command_line_arguments_with_network.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

headless_browser_mockbin_or_mocky_request.yml

GhostRedirectors

2025-09-18 13:39:40 -06:00

headless_browser_usage.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

hide_user_account_from_sign_in_screen.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

hiding_files_and_directories_with_attrib_exe.yml

quick fixes and updates

2025-06-17 20:32:55 +02:00

high_frequency_copy_of_files_in_network_share.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

high_process_termination_frequency.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

hunting_3cxdesktopapp_software.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

icacls_deny_command.yml

multiple updates and fixes

2025-06-17 01:22:13 +02:00

icacls_grant_command.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

icedid_exfiltrated_archived_file_creation.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

impacket_lateral_movement_commandline_parameters.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

impacket_lateral_movement_smbexec_commandline_parameters.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

impacket_lateral_movement_wmiexec_commandline_parameters.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

interactive_session_on_remote_endpoint_with_powershell.yml

Version bumps

2025-06-24 12:43:01 -05:00

java_writing_jsp_file.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

jscript_execution_using_cscript_app.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kerberoasting_spn_request_with_rc4_encryption.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

kerberos_pre_authentication_flag_disabled_with_powershell.yml

Version bumps

2025-06-24 12:43:01 -05:00

kerberos_service_ticket_request_using_rc4_encryption.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

kerberos_tgt_request_using_rc4_encryption.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

kerberos_user_enumeration.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_account_manipulation_of_ssh_config_and_keys.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

linux_add_files_in_known_crontab_directories.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_add_user_account.yml

Cisco Isovalent - Add first batch of new detections (#3706 )

2026-01-06 01:24:39 +01:00

linux_adding_crontab_using_list_parameter.yml

Cisco Isovalent - Add first batch of new detections (#3706 )

2026-01-06 01:24:39 +01:00

linux_apt_get_privilege_escalation.yml

Cisco Isovalent - Add first batch of new detections (#3706 )

2026-01-06 01:24:39 +01:00

linux_apt_privilege_escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_at_allow_config_file_creation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_at_application_execution.yml

Cisco Isovalent - Add first batch of new detections (#3706 )

2026-01-06 01:24:39 +01:00

linux_auditd_add_user_account_type.yml

linux_auditd_daemon_update

2025-06-26 10:45:53 +02:00

linux_auditd_add_user_account.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_auditd_at_application_execution.yml

Merge branch 'develop' into linux_syscall_auditd_update

2025-05-05 19:37:41 +02:00

linux_auditd_auditd_daemon_abort.yml

linux_auditd_daemon_update

2025-06-12 13:28:03 +02:00

linux_auditd_auditd_daemon_shutdown.yml

linux_auditd_daemon_update

2025-06-12 13:28:03 +02:00

linux_auditd_auditd_daemon_start.yml

linux_auditd_daemon_update

2025-06-12 13:28:03 +02:00

linux_auditd_auditd_service_stop.yml

linux_auditd_daemon_update

2025-06-12 13:28:03 +02:00

linux_auditd_base64_decode_files.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_auditd_change_file_owner_to_root.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_auditd_clipboard_data_copy.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_auditd_data_destruction_command.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_auditd_data_transfer_size_limits_via_split_syscall.yml

Merge branch 'develop' into linux_syscall_auditd_update

2025-05-05 19:37:41 +02:00

linux_auditd_data_transfer_size_limits_via_split.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

linux_auditd_database_file_and_directory_discovery.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_auditd_dd_file_overwrite.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_auditd_disable_or_modify_system_firewall.yml

linux_auditd_daemon_update

2025-06-12 13:28:03 +02:00

linux_auditd_doas_conf_file_creation.yml

update indentations and logic

2025-12-02 18:58:56 +01:00

linux_auditd_doas_tool_execution.yml

Merge branch 'develop' into linux_syscall_auditd_update

2025-05-05 19:37:41 +02:00

linux_auditd_edit_cron_table_parameter.yml

Merge branch 'develop' into linux_syscall_auditd_update

2025-05-05 19:37:41 +02:00

linux_auditd_file_and_directory_discovery.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_auditd_file_permission_modification_via_chmod.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_auditd_file_permissions_modification_via_chattr.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_auditd_find_credentials_from_password_managers.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

linux_auditd_find_credentials_from_password_stores.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

linux_auditd_find_ssh_private_keys.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

linux_auditd_hardware_addition_swapoff.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

linux_auditd_hidden_files_and_directories_creation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_auditd_insert_kernel_module_using_insmod_utility.yml

Merge branch 'develop' into linux_syscall_auditd_update

2025-05-05 19:37:41 +02:00

linux_auditd_install_kernel_module_using_modprobe_utility.yml

Updates for 3886

2025-08-18 15:17:37 -04:00

linux_auditd_kernel_module_enumeration.yml

Merge branch 'develop' into linux_syscall_auditd_update

2025-05-05 19:37:41 +02:00

linux_auditd_kernel_module_using_rmmod_utility.yml

Merge branch 'develop' into linux_syscall_auditd_update

2025-05-05 19:37:41 +02:00

linux_auditd_nopasswd_entry_in_sudoers_file.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_auditd_osquery_service_stop.yml

linux_auditd_daemon_update

2025-06-12 13:28:03 +02:00

linux_auditd_possible_access_or_modification_of_sshd_config_file.yml

update descriptions

2025-12-03 00:23:36 +01:00

linux_auditd_possible_access_to_credential_files.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_auditd_possible_access_to_sudoers_file.yml

update descriptions

2025-12-03 00:23:36 +01:00

linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml

update descriptions

2025-12-03 00:23:36 +01:00

linux_auditd_preload_hijack_library_calls.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_auditd_preload_hijack_via_preload_file.yml

RBA Messages

2025-12-08 20:43:02 -05:00

linux_auditd_private_keys_and_certificate_enumeration.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_auditd_service_restarted.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_auditd_service_started.yml

fix_auditd_service_Start

2025-09-18 10:36:04 +02:00

linux_auditd_setuid_using_chmod_utility.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_auditd_setuid_using_setcap_utility.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_auditd_shred_overwrite_command.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_auditd_stop_services.yml

linux_auditd_daemon_update

2025-06-12 13:28:03 +02:00

linux_auditd_sudo_or_su_execution.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_auditd_sysmon_service_stop.yml

linux_auditd_daemon_update

2025-06-12 13:28:03 +02:00

linux_auditd_system_network_configuration_discovery.yml

Merge branch 'develop' into linux_syscall_auditd_update

2025-05-05 19:37:41 +02:00

linux_auditd_unix_shell_configuration_modification.yml

RBA Messages

2025-12-08 20:43:02 -05:00

linux_auditd_unload_module_via_modprobe.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_auditd_virtual_disk_file_and_directory_discovery.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_auditd_whoami_user_discovery.yml

Merge branch 'develop' into linux_syscall_auditd_update

2025-05-05 19:37:41 +02:00

linux_awk_privilege_escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_busybox_privilege_escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_c89_privilege_escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_c99_privilege_escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_change_file_owner_to_root.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_clipboard_data_copy.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_common_process_for_elevation_control.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_composer_privilege_escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_cpulimit_privilege_escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_csvtool_privilege_escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_curl_upload_file.yml

Cisco Isovalent - Add first batch of new detections (#3706 )

2026-01-06 01:24:39 +01:00

linux_data_destruction_command.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_dd_file_overwrite.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_decode_base64_to_shell.yml

Cisco Isovalent - Add first batch of new detections (#3706 )

2026-01-06 01:24:39 +01:00

linux_deleting_critical_directory_using_rm_command.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_deletion_of_cron_jobs.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_deletion_of_init_daemon_script.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_deletion_of_services.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_deletion_of_ssl_certificate.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_disable_services.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_doas_conf_file_creation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_doas_tool_execution.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_docker_privilege_escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_edit_cron_table_parameter.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_emacs_privilege_escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_file_created_in_kernel_driver_directory.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_file_creation_in_init_boot_directory.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_file_creation_in_profile_directory.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_find_privilege_escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_gdb_privilege_escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_gdrive_binary_activity.yml

Add Medusa content

2025-08-06 10:16:03 -05:00

linux_gem_privilege_escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_gnu_awk_privilege_escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_hardware_addition_swapoff.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

linux_high_frequency_of_file_deletion_in_boot_folder.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_high_frequency_of_file_deletion_in_etc_folder.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_impair_defenses_process_kill.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

linux_indicator_removal_clear_cache.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_indicator_removal_service_file_deletion.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_ingress_tool_transfer_hunting.yml

npm Supply Chain Compromise & Lifecycle Hook Abuse Detection (#3806 )

2025-11-25 14:56:20 -08:00

linux_ingress_tool_transfer_with_curl.yml

npm Supply Chain Compromise & Lifecycle Hook Abuse Detection (#3806 )

2025-11-25 14:56:20 -08:00

linux_insert_kernel_module_using_insmod_utility.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_install_kernel_module_using_modprobe_utility.yml

Updates for 3886

2025-08-18 15:17:37 -04:00

linux_iptables_firewall_modification.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_kernel_module_enumeration.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_kworker_process_in_writable_process_path.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_magic_sysrq_key_abuse.yml

update descriptions

2025-12-03 00:23:36 +01:00

linux_make_privilege_escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_medusa_rootkit.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

linux_mysql_privilege_escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_ngrok_reverse_proxy_usage.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_node_privilege_escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_nopasswd_entry_in_sudoers_file.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_obfuscated_files_or_information_base64_decode.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_octave_privilege_escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_openvpn_privilege_escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_persistence_and_privilege_escalation_risk_behavior.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_php_privilege_escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_pkexec_privilege_escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_possible_access_or_modification_of_sshd_config_file.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_possible_access_to_credential_files.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_possible_access_to_sudoers_file.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_possible_append_command_to_at_allow_config_file.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_possible_append_command_to_profile_config_file.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_possible_cronjob_modification_with_editor.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_possible_ssh_key_file_creation.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

linux_preload_hijack_library_calls.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_proxy_socks_curl.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_puppet_privilege_escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_rpm_privilege_escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_ruby_privilege_escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_service_file_created_in_systemd_directory.yml

Bump versions

2025-08-06 11:00:30 -05:00

linux_service_restarted.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_service_started_or_enabled.yml

Fix Issues & Updates (#3705 )

2025-10-13 09:18:21 -07:00

linux_setuid_using_chmod_utility.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_setuid_using_setcap_utility.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_shred_overwrite_command.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_sqlite3_privilege_escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_ssh_authorized_keys_modification.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

linux_ssh_remote_services_script_execute.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

linux_stdout_redirection_to_dev_null_file.yml

add drilldowns to production analytics

2025-06-10 16:26:40 +02:00

linux_stop_services.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_sudo_or_su_execution.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_sudoers_tmp_file_creation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_suspicious_react_or_next_js_child_process.yml

Message formatting changes

2025-12-08 21:26:34 -05:00

linux_system_network_discovery.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_system_reboot_via_system_request_key.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_unix_shell_enable_all_sysrq_functions.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

linux_visudo_utility_execution.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

living_off_the_land_detection.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

llm_model_file_creation.yml

Rod- Suspicious Local LLM Frameworks (#3780 )

2025-11-24 13:06:41 -08:00

loading_of_dynwrapx_module.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

local_account_discovery_with_wmic.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

local_llm_framework_dns_query.yml

Rod- Suspicious Local LLM Frameworks (#3780 )

2025-11-24 13:06:41 -08:00

log4shell_cve_2021_44228_exploitation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

logon_script_event_trigger_execution.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

lolbas_with_network_traffic.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

macos___re_opened_applications.yml

Apply suggestions from code review

2025-05-05 19:07:48 +02:00

macos_amos_stealer___virtual_machine_check_activity.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

macos_lolbin.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

macos_plutil.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

mailsniper_invoke_functions.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

malicious_inprocserver32_modification.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

malicious_powershell_executed_as_a_service.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

malicious_powershell_process___encoded_command.yml

WSUSpect in Custody: CVE-2025-59287 (#3743 )

2025-10-27 09:48:44 -07:00

malicious_powershell_process___execution_policy_bypass.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

malicious_powershell_process_with_obfuscation_techniques.yml

version bumps (#3732 )

2025-10-17 11:15:52 -07:00

microsoft_defender_atp_alerts.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

microsoft_defender_incident_alerts.yml

Removed grouping by dest (#3759 )

2025-11-05 11:17:48 -08:00

mimikatz_passtheticket_commandline_parameters.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

mmc_lolbas_execution_process_spawn.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

modification_of_wallpaper.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

modify_acl_permission_to_files_or_folder.yml

multiple updates and fixes

2025-06-17 01:22:13 +02:00

monitor_registry_keys_for_print_monitors.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

moveit_certificate_store_access_failure.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

moveit_empty_key_fingerprint_authentication_attempt.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

ms_exchange_mailbox_replication_service_writing_active_server_pages.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

ms_scripting_process_loading_ldap_module.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

ms_scripting_process_loading_wmi_module.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

msbuild_suspicious_spawned_by_script_process.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

mshta_spawning_rundll32_or_regsvr32_process.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

msi_module_loaded_by_non_system_binary.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

msmpeng_application_dll_side_loading.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

net_profiler_uac_bypass.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

network_connection_discovery_with_arp.yml

interlock_ransomware

2025-07-28 11:58:45 +02:00

network_connection_discovery_with_netstat.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

network_discovery_using_route_windows_app.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

network_share_discovery_via_dir_command.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

network_traffic_to_active_directory_web_services_protocol.yml

multiple updates and fixes

2025-06-17 01:22:13 +02:00

nishang_powershelltcponeline.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

nltest_domain_trust_discovery.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

non_chrome_process_accessing_chrome_default_dir.yml

lokibot (#3701 )

2025-10-10 18:32:18 +00:00

non_firefox_process_access_firefox_profile_dir.yml

lokibot (#3701 )

2025-10-10 18:32:18 +00:00

notepad_with_no_command_line_arguments.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

ntdsutil_export_ntds.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

outbound_network_connection_from_java_using_default_ports.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

overwriting_accessibility_binaries.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

papercut_ng_suspicious_behavior_debug_log.yml

upgrade detection with tests to production

2025-06-10 13:56:06 +02:00

permission_modification_using_takeown_app.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

petitpotam_network_share_access_request.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

petitpotam_suspicious_kerberos_tgt_request.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

ping_sleep_batch_command.yml

quasar_and_loader

2025-07-17 14:51:43 +02:00

possible_browser_pass_view_parameter.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

possible_lateral_movement_powershell_spawn.yml

WSUSpect in Custody: CVE-2025-59287 (#3743 )

2025-10-27 09:48:44 -07:00

potential_password_in_username.yml

Remove manual test (#3717 )

2025-10-10 11:51:50 -07:00

potential_system_network_configuration_discovery_activity.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

potential_telegram_api_request_via_commandline.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

potentially_malicious_code_on_commandline.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

powershell_4104_hunting.yml

WSUSpect in Custody: CVE-2025-59287 (#3743 )

2025-10-27 09:48:44 -07:00

powershell___connect_to_internet_with_hidden_window.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

powershell_com_hijacking_inprocserver32_modification.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

powershell_creating_thread_mutex.yml

Version bumps

2025-06-24 12:43:01 -05:00

powershell_disable_security_monitoring.yml

New Rules & Updates - Oct 25 (#3726 )

2025-10-24 14:19:48 -07:00

powershell_domain_enumeration.yml

WSUSpect in Custody: CVE-2025-59287 (#3743 )

2025-10-27 09:48:44 -07:00

powershell_enable_powershell_remoting.yml

Version bumps

2025-06-24 12:43:01 -05:00

powershell_enable_smb1protocol_feature.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

powershell_execute_com_object.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

powershell_fileless_process_injection_via_getprocaddress.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

powershell_fileless_script_contains_base64_encoded_content.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

powershell_get_localgroup_discovery_with_script_block_logging.yml

Version bumps

2025-06-24 12:43:01 -05:00

powershell_get_localgroup_discovery.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

powershell_invoke_cimmethod_cimsession.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

powershell_invoke_wmiexec_usage.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

powershell_load_module_in_meterpreter.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

powershell_loading_dotnet_into_memory_via_reflection.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

powershell_processing_stream_of_data.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

powershell_remote_services_add_trustedhost.yml

Version bumps

2025-06-24 12:43:01 -05:00

powershell_remote_thread_to_known_windows_process.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

powershell_remove_windows_defender_directory.yml

Version bumps

2025-06-24 12:43:01 -05:00

powershell_script_block_with_url_chain.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

powershell_start_bitstransfer.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

powershell_start_or_stop_service.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

powershell_using_memory_as_backing_store.yml

Version bumps

2025-06-24 12:43:01 -05:00

powershell_webrequest_using_memory_stream.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

powershell_windows_defender_exclusion_commands.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

prevent_automatic_repair_mode_using_bcdedit.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

print_processor_registry_autostart.yml

Update print_processor_registry_autostart.yml

2025-06-17 17:09:39 -07:00

print_spooler_adding_a_printer_driver.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

print_spooler_failed_to_load_a_plug_in.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

process_creating_lnk_file_in_suspicious_location.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

process_deleting_its_process_file_path.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

process_execution_via_wmi.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

process_kill_base_on_file_path.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

process_writing_dynamicwrapperx.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

processes_launching_netsh.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

processes_tapping_keyboard_events.yml

New Rules & Updates - Oct 25 (#3726 )

2025-10-24 14:19:48 -07:00

randomly_generated_scheduled_task_name.yml

objectivity_stealer

2025-08-25 18:46:15 +02:00

randomly_generated_windows_service_name.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

ransomware_notes_bulk_creation.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

recon_avproduct_through_pwh_or_wmi.yml

quasar_and_loader

2025-07-17 14:51:43 +02:00

recon_using_wmi_class.yml

Scattered Spider Tags

2025-07-31 10:54:21 -06:00

recursive_delete_of_directory_in_batch_cmd.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

reg_exe_manipulating_windows_services_registry_keys.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

registry_keys_for_creating_shim_databases.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

registry_keys_used_for_persistence.yml

Add New Analytics Covering SesameOp and PromptFlux (#3827 )

2026-01-08 00:58:33 +01:00

registry_keys_used_for_privilege_escalation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

regsvr32_silent_and_install_param_dll_loading.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

regsvr32_with_known_silent_switch_cmdline.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

remcos_client_registry_install_entry.yml

prep for sysmon 5 release

2025-07-30 13:15:33 -05:00

remcos_rat_file_creation_in_remcos_folder.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

remote_desktop_process_running_on_system.yml

rdp_artifacts_and_evasion

2025-08-07 14:29:17 +02:00

remote_process_instantiation_via_dcom_and_powershell_script_block.yml

Version bumps

2025-06-24 12:43:01 -05:00

remote_process_instantiation_via_dcom_and_powershell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

remote_process_instantiation_via_winrm_and_powershell_script_block.yml

Version bumps

2025-06-24 12:43:01 -05:00

remote_process_instantiation_via_winrm_and_powershell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

remote_process_instantiation_via_winrm_and_winrs.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

remote_process_instantiation_via_wmi_and_powershell_script_block.yml

Correct versions

2025-06-24 13:03:16 -05:00

remote_process_instantiation_via_wmi_and_powershell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

remote_process_instantiation_via_wmi.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

remote_system_discovery_with_adsisearcher.yml

Correct versions

2025-06-24 13:03:16 -05:00

remote_system_discovery_with_dsquery.yml

lamehug

2025-08-27 13:48:15 +02:00

remote_system_discovery_with_wmic.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

remote_wmi_command_attempt.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

resize_shadowstorage_volume.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

revil_common_exec_parameter.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

revil_registry_entry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

rubeus_command_line_parameters.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

rubeus_kerberos_ticket_exports_through_winlogon_access.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

runas_execution_in_commandline.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

rundll32_control_rundll_hunt.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

rundll32_control_rundll_world_writable_directory.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

rundll32_create_remote_thread_to_a_process.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

rundll32_createremotethread_in_browser.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

rundll32_lockworkstation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

rundll32_process_creating_exe_dll_files.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

rundll32_shimcache_flush.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

rundll32_with_no_command_line_arguments_with_network.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

rundll_loading_dll_by_ordinal.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

ryuk_test_files_detected.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

ryuk_wake_on_lan_command.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

sam_database_file_access_attempt.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

samsam_test_file_write.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

sc_exe_manipulating_windows_services.yml

Scattered Spider Tags

2025-07-31 10:54:21 -06:00

schcache_change_by_app_connect_and_create_adsi_object.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

schedule_task_with_http_command_arguments.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

schedule_task_with_rundll32_command_trigger.yml

castlerat (#3750 )

2025-11-07 11:08:44 -08:00

scheduled_task_creation_on_remote_endpoint_using_at.yml

objectivity_stealer

2025-08-25 18:46:15 +02:00

scheduled_task_deleted_or_created_via_cmd.yml

Add New Analytics Covering SesameOp and PromptFlux (#3827 )

2026-01-08 00:58:33 +01:00

scheduled_task_initiation_on_remote_endpoint.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

schtasks_run_task_on_demand.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

schtasks_scheduling_job_on_remote_system.yml

quasar_and_loader

2025-07-17 14:51:43 +02:00

schtasks_used_for_forcing_a_reboot.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

screensaver_event_trigger_execution.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

script_execution_via_wmi.yml

Scattered Spider Tags

2025-07-31 10:54:21 -06:00

sdclt_uac_bypass.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

sdelete_application_execution.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

searchprotocolhost_with_no_command_line_with_network.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

secretdumps_offline_ntds_dumping_tool.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

serviceprincipalnames_discovery_with_powershell.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

serviceprincipalnames_discovery_with_setspn.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

services_escalate_exe.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

services_lolbas_execution_process_spawn.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml

Fix incorrect data sources

2025-06-10 16:04:59 +02:00

shai_hulud_2_exfiltration_artifact_files.yml

npm Supply Chain Compromise & Lifecycle Hook Abuse Detection (#3806 )

2025-11-25 14:56:20 -08:00

shai_hulud_workflow_file_creation_or_modification.yml

npm Supply Chain Compromise & Lifecycle Hook Abuse Detection (#3806 )

2025-11-25 14:56:20 -08:00

shim_database_file_creation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

shim_database_installation_with_suspicious_parameters.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

short_lived_scheduled_task.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

short_lived_windows_accounts.yml

GhostRedirectors

2025-09-18 13:39:40 -06:00

silentcleanup_uac_bypass.yml

Fix incorrect data sources

2025-06-10 16:04:59 +02:00

single_letter_process_on_endpoint.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

slui_runas_elevated.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

slui_spawning_a_process.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

spike_in_file_writes.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

spoolsv_spawning_rundll32.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

spoolsv_suspicious_loaded_modules.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

spoolsv_suspicious_process_access.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

spoolsv_writing_a_dll___sysmon.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

spoolsv_writing_a_dll.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

sqlite_module_in_temp_folder.yml

lokibot (#3701 )

2025-10-10 18:32:18 +00:00

steal_or_forge_authentication_certificates_behavior_identified.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

sunburst_correlation_dll_and_network_event.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

suspicious_computer_account_name_change.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

suspicious_copy_on_system32.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

suspicious_curl_network_connection.yml

version bumps (#3732 )

2025-10-17 11:15:52 -07:00

suspicious_dllhost_no_command_line_arguments.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

suspicious_gpupdate_no_command_line_arguments.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

suspicious_icedid_rundll32_cmdline.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

suspicious_image_creation_in_appdata_folder.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

suspicious_kerberos_service_ticket_request.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

suspicious_linux_discovery_commands.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

suspicious_microsoft_workflow_compiler_rename.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

suspicious_microsoft_workflow_compiler_usage.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

suspicious_msbuild_path.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

suspicious_msbuild_rename.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

suspicious_msbuild_spawn.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

suspicious_mshta_child_process.yml

Suspicious mshta child process minor fixes (#3787 )

2025-11-14 08:49:56 -08:00

suspicious_mshta_spawn.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

suspicious_plistbuddy_usage_via_osquery.yml

New Rules & Updates - Oct 25 (#3726 )

2025-10-24 14:19:48 -07:00

suspicious_plistbuddy_usage.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

suspicious_process_executed_from_container_file.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

suspicious_reg_exe_process.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

suspicious_regsvr32_register_suspicious_path.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

suspicious_rundll32_dllregisterserver.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

suspicious_rundll32_no_command_line_arguments.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

suspicious_rundll32_plugininit.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

suspicious_rundll32_startw.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

suspicious_scheduled_task_from_public_directory.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

suspicious_searchprotocolhost_no_command_line_arguments.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

suspicious_sqlite3_lsquarantine_behavior.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

suspicious_ticket_granting_ticket_request.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

suspicious_wav_file_in_appdata_folder.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

suspicious_wevtutil_usage.yml

Scattered Spider Tags

2025-07-31 10:54:21 -06:00

suspicious_writes_to_windows_recycle_bin.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

svchost_lolbas_execution_process_spawn.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

system_info_gathering_using_dxdiag_application.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

system_information_discovery_detection.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

system_processes_run_from_unexpected_locations.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

system_user_discovery_with_query.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

system_user_discovery_with_whoami.yml

lamehug

2025-08-27 13:48:15 +02:00

time_provider_persistence_registry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

trickbot_named_pipe.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

uac_bypass_mmc_load_unsigned_dll.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

uac_bypass_with_colorui_com_object.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

uninstall_app_using_msiexec.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

unknown_process_using_the_kerberos_protocol.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

unload_sysmon_filter_driver.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

unloading_amsi_via_reflection.yml

Version bumps

2025-06-24 12:43:01 -05:00

unusual_number_of_computer_service_tickets_requested.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

unusual_number_of_kerberos_service_tickets_requested.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

unusual_number_of_remote_endpoint_authentication_events.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

unusually_long_command_line___mltk.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

unusually_long_command_line.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

user_discovery_with_env_vars_powershell_script_block.yml

Version bumps

2025-06-24 12:43:01 -05:00

user_discovery_with_env_vars_powershell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

usn_journal_deletion.yml

Fix Issues & Updates (#3705 )

2025-10-13 09:18:21 -07:00

vbscript_execution_using_wscript_app.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

verclsid_clsid_execution.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

wbadmin_delete_system_backups.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

wbemprox_com_object_execution.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

web_or_application_server_spawning_a_shell.yml

WSUSpect in Custody: CVE-2025-59287 (#3743 )

2025-10-27 09:48:44 -07:00

web_servers_executing_suspicious_processes.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

wermgr_process_create_executable_file.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

wermgr_process_spawned_cmd_or_powershell_process.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_access_token_manipulation_sedebugprivilege.yml

Add tuoni content and named pipe detection (#3816 )

2025-12-08 21:25:09 +01:00

windows_access_token_manipulation_winlogon_duplicate_token_handle.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml

path_wiper

2025-08-20 12:13:44 +02:00

windows_account_access_removal_via_logoff_exec.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_account_discovery_for_none_disable_user_account.yml

Version bumps

2025-06-24 12:43:01 -05:00

windows_account_discovery_for_sam_account_name.yml

Version bumps

2025-06-24 12:43:01 -05:00

windows_account_discovery_with_netuser_preauthnotrequire.yml

Correct versions

2025-06-24 13:03:16 -05:00

windows_ad_abnormal_object_access_activity.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ad_add_self_to_group.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ad_adminsdholder_acl_modified.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ad_cross_domain_sid_history_addition.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ad_dangerous_deny_acl_modification.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ad_dangerous_group_acl_modification.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ad_dangerous_user_acl_modification.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ad_dcshadow_privileges_acl_addition.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ad_domain_controller_audit_policy_disabled.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ad_domain_controller_promotion.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ad_domain_replication_acl_addition.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ad_domain_root_acl_deletion.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ad_domain_root_acl_modification.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ad_dsrm_account_changes.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_ad_dsrm_password_reset.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_ad_gpo_deleted.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ad_gpo_disabled.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ad_gpo_new_cse_addition.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ad_hidden_ou_creation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ad_object_owner_updated.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ad_privileged_account_sid_history_addition.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ad_privileged_group_modification.yml

update output fields

2025-06-10 20:07:40 +02:00

windows_ad_privileged_object_access_activity.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ad_replication_request_initiated_by_user_account.yml

updating detections after taking screenshorts

2025-08-11 15:27:03 -07:00

windows_ad_replication_request_initiated_from_unsanctioned_location.yml

mionr tick

2025-08-11 15:56:45 -07:00

windows_ad_same_domain_sid_history_addition.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ad_self_dacl_assignment.yml

Update windows_ad_self_dacl_assignment.yml (#3721 )

2025-10-13 09:30:50 -07:00

windows_ad_serviceprincipalname_added_to_domain_account.yml

interlock_ransomware

2025-07-28 11:58:45 +02:00

windows_ad_short_lived_domain_account_serviceprincipalname.yml

interlock_ransomware

2025-07-28 11:58:45 +02:00

windows_ad_short_lived_domain_controller_spn_attribute.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ad_short_lived_server_object.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ad_sid_history_attribute_modified.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ad_suspicious_attribute_modification.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_adfind_exe.yml

New Rules & Updates - Oct 25 (#3726 )

2025-10-24 14:19:48 -07:00

windows_admin_permission_discovery.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_administrative_shares_accessed_on_multiple_hosts.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_admon_default_group_policy_object_modified.yml

Version bumps

2025-06-24 12:43:01 -05:00

windows_admon_group_policy_object_created.yml

Correct versions

2025-06-24 13:03:16 -05:00

windows_advanced_installer_msix_with_ai_stubs_execution.yml

Update attack_data links

2025-09-09 08:35:57 -04:00

windows_ai_platform_dns_query.yml

Add New Analytics Covering SesameOp and PromptFlux (#3827 )

2026-01-08 00:58:33 +01:00

windows_alternate_datastream___base64_content.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

windows_alternate_datastream___executable_content.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_alternate_datastream___process_execution.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_anonymous_pipe_activity.yml

CIM App name and Switch sourcetypes (#3799 )

2025-11-21 08:33:33 -08:00

windows_apache_benchmark_binary.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_app_layer_protocol_qakbot_namedpipe.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_application_whitelisting_bypass_attempt_via_rundll32.yml

Fix Issues & Updates (#3705 )

2025-10-13 09:18:21 -07:00

windows_applocker_block_events.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_applocker_execution_from_uncommon_locations.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_applocker_privilege_escalation_via_unauthorized_bypass.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_applocker_rare_application_launch_detection.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_appx_deployment_full_trust_package_installation.yml

updates

2025-08-18 16:21:35 -06:00

windows_appx_deployment_package_installation_success.yml

updates

2025-08-18 16:21:35 -06:00

windows_appx_deployment_unsigned_package_installation.yml

messsage

2025-08-19 09:35:58 -07:00

windows_archive_collected_data_via_powershell.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

windows_archive_collected_data_via_rar.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

windows_archived_collected_data_in_temp_folder.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

windows_attempt_to_stop_security_service.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_audit_policy_auditing_option_disabled_via_auditpol.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_audit_policy_auditing_option_modified___registry.yml

prep for sysmon 5 release

2025-07-30 13:15:33 -05:00

windows_audit_policy_cleared_via_auditpol.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_audit_policy_disabled_via_auditpol.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_audit_policy_disabled_via_legacy_auditpol.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_audit_policy_excluded_category_via_auditpol.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_audit_policy_restored_via_auditpol.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_audit_policy_security_descriptor_tampering_via_auditpol.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_autoit3_execution.yml

Fix Issues & Updates (#3705 )

2025-10-13 09:18:21 -07:00

windows_autostart_execution_lsass_driver_registry_modification.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_binary_proxy_execution_mavinject_dll_injection.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_bitlocker_suspicious_command_usage.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_bitlockertogo_process_execution.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_bitlockertogo_with_network_activity.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

windows_boot_or_logon_autostart_execution_in_startup_folder.yml

Add New Analytics Covering SesameOp and PromptFlux (#3827 )

2026-01-08 00:58:33 +01:00

windows_bootloader_inventory.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_browser_process_launched_with_unusual_flags.yml

castlerat (#3750 )

2025-11-07 11:08:44 -08:00

windows_bypass_uac_via_pkgmgr_tool.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_cab_file_on_disk.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

windows_cabinet_file_extraction_via_expand.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

windows_cached_domain_credentials_reg_query.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_certutil_root_certificate_addition.yml

Fix Issues & Updates (#3705 )

2025-10-13 09:18:21 -07:00

windows_change_file_association_command_to_notepad.yml

Fix Issues & Updates (#3705 )

2025-10-13 09:18:21 -07:00

windows_chromium_browser_no_security_sandbox_process.yml

quick fixes and updates

2025-06-17 20:32:55 +02:00

windows_chromium_browser_with_custom_user_data_directory.yml

lokibot (#3701 )

2025-10-10 18:32:18 +00:00

windows_cisco_secure_endpoint_related_service_stopped.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_cisco_secure_endpoint_stop_immunet_service_via_sfc.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_cisco_secure_endpoint_unblock_file_via_sfc.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_cisco_secure_endpoint_uninstall_immunet_service_via_sfc.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_clipboard_data_via_get_clipboard.yml

Version bumps

2025-06-24 12:43:01 -05:00

windows_cmdline_tool_execution_from_non_shell_process.yml

Add tuoni content and named pipe detection (#3816 )

2025-12-08 21:25:09 +01:00

windows_com_hijacking_inprocserver32_modification.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_command_and_scripting_interpreter_hunting_path_traversal.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_command_and_scripting_interpreter_path_traversal_exec.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_command_shell_dcrat_forkbomb_payload.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_common_abused_cmd_shell_risk_behavior.yml

WSUSpect in Custody: CVE-2025-59287 (#3743 )

2025-10-27 09:48:44 -07:00

windows_compatibility_telemetry_suspicious_child_process.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_compatibility_telemetry_tampering_through_registry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_computer_account_created_by_computer_account.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_computer_account_requesting_kerberos_ticket.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_computer_account_with_spn.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_computerdefaults_spawning_a_process.yml

castlerat (#3750 )

2025-11-07 11:08:44 -08:00

windows_conhost_with_headless_argument.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_consolehost_history_file_deletion.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_create_local_account.yml

New Rules & Updates - Oct 25 (#3726 )

2025-10-24 14:19:48 -07:00

windows_create_local_administrator_account_via_net.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_credential_access_from_browser_password_store.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_credential_dumping_lsass_memory_createdump.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_credential_target_information_structure_in_commandline.yml

NTLM Reflection via DNS Object SPN Spoofing (#3789 )

2025-11-18 12:59:34 -08:00

windows_credentials_access_via_vaultcli_module.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

windows_credentials_from_password_stores_chrome_copied_in_temp_dir.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_credentials_from_password_stores_chrome_extension_access.yml

objectivity_stealer

2025-08-25 18:46:15 +02:00

windows_credentials_from_password_stores_chrome_localstate_access.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_credentials_from_password_stores_chrome_login_data_access.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_credentials_from_password_stores_creation.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

windows_credentials_from_password_stores_deletion.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

windows_credentials_from_password_stores_query.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

windows_credentials_from_web_browsers_saved_in_temp_folder.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_credentials_in_registry_reg_query.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_curl_download_to_suspicious_path.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

windows_curl_upload_to_remote_destination.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

windows_data_destruction_recursive_exec_files_deletion.yml

diskwiper

2025-06-27 09:40:18 +02:00

windows_debugger_tool_execution.yml

New Rules & Updates - Oct 25 (#3726 )

2025-10-24 14:19:48 -07:00

windows_defacement_modify_transcodedwallpaper_file.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_default_group_policy_object_modified_with_gpme.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_default_group_policy_object_modified.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_default_rdp_file_creation_by_non_mstsc_process.yml

detection_fixed (#3746 )

2025-10-27 10:23:56 -07:00

windows_default_rdp_file_deletion.yml

rdp_artifacts_and_evasion

2025-08-07 14:09:06 +02:00

windows_default_rdp_file_unhidden.yml

rdp_artifacts_and_evasion

2025-08-06 13:02:46 +02:00

windows_defender_asr_audit_events.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_defender_asr_block_events.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_defender_asr_or_threat_configuration_tamper.yml

New Rules & Updates - Oct 25 (#3726 )

2025-10-24 14:19:48 -07:00

windows_defender_asr_registry_modification.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_defender_asr_rule_disabled.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_defender_asr_rules_stacking.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_defender_exclusion_registry_entry.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

windows_delete_or_modify_system_firewall.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_deleted_registry_by_a_non_critical_process_file_path.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_detect_network_scanner_behavior.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_developer_signed_msix_package_installation.yml

updates

2025-08-18 16:21:35 -06:00

windows_disable_change_password_through_registry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_disable_internet_explorer_addons.yml

quick fixes and updates

2025-06-17 20:32:55 +02:00

windows_disable_lock_workstation_feature_through_registry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_disable_logoff_button_through_registry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_disable_memory_crash_dump.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_disable_notification_center.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_disable_or_modify_tools_via_taskkill.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_disable_or_stop_browser_process.yml

castlerat (#3750 )

2025-11-07 11:08:44 -08:00

windows_disable_shutdown_button_through_registry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_disable_windows_event_logging_disable_http_logging.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_disable_windows_group_policy_features_through_registry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_disableantispyware_registry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_diskcryptor_usage.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_diskshadow_proxy_execution.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

windows_dism_install_powershell_web_access.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_dism_remove_defender.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_dll_module_loaded_in_temp_dir.yml

lokibot (#3701 )

2025-10-10 18:32:18 +00:00

windows_dll_search_order_hijacking_hunt_with_sysmon.yml

quick fixes and updates

2025-06-17 20:32:55 +02:00

windows_dll_search_order_hijacking_with_iscsicpl.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_dll_side_loading_in_calc.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_dll_side_loading_process_child_of_calc.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_dns_gather_network_info.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_dns_query_request_to_tinyurl.yml

quick fixes and updates

2025-06-17 20:32:55 +02:00

windows_dnsadmins_new_member_added.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_domain_account_discovery_via_get_netcomputer.yml

Version bumps

2025-06-24 12:43:01 -05:00

windows_domain_admin_impersonation_indicator.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_dotnet_binary_in_non_standard_path.yml

Move Unused Macros to Deprecate Sub-Folder (#3847 )

2025-12-22 14:01:09 +01:00

windows_driver_inventory.yml

more updates

2025-06-16 23:38:10 +02:00

windows_driver_load_non_standard_path.yml

Update windows_driver_load_non_standard_path.yml

2025-09-23 15:07:01 +02:00

windows_drivers_loaded_by_signature.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_enable_powershell_web_access.yml

Version bumps

2025-06-24 12:43:01 -05:00

windows_enable_win32_scheduledjob_via_registry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_esx_admins_group_creation_security_event.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_esx_admins_group_creation_via_net.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_esx_admins_group_creation_via_powershell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_event_for_service_disabled.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_event_log_cleared.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_event_logging_service_has_shutdown.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_event_triggered_image_file_execution_options_injection.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_eventlog_cleared_via_wevtutil.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_eventlog_recon_activity_using_log_query_utilities.yml

New Rules & Updates - Oct 25 (#3726 )

2025-10-24 14:19:48 -07:00

windows_excel_activemicrosoftapp_child_process.yml

path_wiper

2025-08-21 12:42:07 +02:00

windows_excessive_disabled_services_event.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_excessive_service_stop_attempt.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_excessive_usage_of_net_app.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_executable_in_loaded_modules.yml

lokibot (#3701 )

2025-10-10 18:32:18 +00:00

windows_executable_masquerading_as_benign_file_types.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

windows_execute_arbitrary_commands_with_msdt.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_exfiltration_over_c2_via_invoke_restmethod.yml

WSUSpect in Custody: CVE-2025-59287 (#3743 )

2025-10-27 09:48:44 -07:00

windows_exfiltration_over_c2_via_powershell_uploadstring.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

windows_explorer_exe_spawning_powershell_or_cmd.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_explorer_lnk_exploit_process_launch_with_padding.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_export_certificate.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_file_and_directory_enable_readonly_permissions.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

windows_file_and_directory_permissions_enable_inheritance.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

windows_file_and_directory_permissions_remove_inheritance.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_file_collection_via_copy_utilities.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

windows_file_download_via_certutil.yml

Update attack_data links

2025-09-09 08:35:57 -04:00

windows_file_download_via_powershell.yml

Add tuoni content and named pipe detection (#3816 )

2025-12-08 21:25:09 +01:00

windows_file_share_discovery_with_powerview.yml

Version bumps

2025-06-24 12:43:01 -05:00

windows_file_transfer_protocol_in_non_common_process_path.yml

New Rules & Updates - Oct 25 (#3726 )

2025-10-24 14:19:48 -07:00

windows_file_without_extension_in_critical_folder.yml

Update Driver and Extensionless Files Related Detections (#3846 )

2026-01-06 02:02:25 +01:00

windows_files_and_dirs_access_rights_modification_via_icacls.yml

Update windows_files_and_dirs_access_rights_modification_via_icacls.yml

2025-06-17 01:42:32 +02:00

windows_find_domain_organizational_units_with_getdomainou.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_find_interesting_acl_with_findinterestingdomainacl.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_findstr_gpp_discovery.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_firewall_rule_added.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

windows_firewall_rule_deletion.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

windows_firewall_rule_modification.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

windows_forest_discovery_with_getforestdomain.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_gather_victim_host_information_camera.yml

Version bumps

2025-06-24 12:43:01 -05:00

windows_gather_victim_identity_sam_info.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_gdrive_binary_activity.yml

Updates for 3886

2025-08-05 12:32:01 -05:00

windows_get_adcomputer_unconstrained_delegation_discovery.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_get_local_admin_with_findlocaladminaccess.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_global_object_access_audit_list_cleared_via_auditpol.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_group_discovery_via_net.yml

WSUSpect in Custody: CVE-2025-59287 (#3743 )

2025-10-27 09:48:44 -07:00

windows_group_policy_object_created.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_handle_duplication_in_known_uac_bypass_binaries.yml

castlerat (#3750 )

2025-11-07 11:08:44 -08:00

windows_hidden_schedule_task_settings.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

windows_hide_notification_features_through_registry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_high_file_deletion_frequency.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

windows_hijack_execution_flow_version_dll_side_load.yml

quick fixes and updates

2025-06-17 20:32:55 +02:00

windows_http_network_communication_from_msiexec.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

windows_hunting_system_account_targeting_lsass.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_identify_powershell_web_access_iis_pool.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_identify_protocol_handlers.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_iis_components_add_new_module.yml

GhostRedirectors

2025-09-18 13:39:40 -06:00

windows_iis_components_get_webglobalmodule_module_query.yml

GhostRedirectors

2025-09-18 13:39:40 -06:00

windows_iis_components_module_failed_to_load.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_iis_components_new_module_added.yml

GhostRedirectors

2025-09-18 13:39:40 -06:00

windows_impair_defense_add_xml_applocker_rules.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_impair_defense_change_win_defender_health_check_intervals.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_impair_defense_change_win_defender_quick_scan_interval.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_impair_defense_change_win_defender_throttle_rate.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_impair_defense_change_win_defender_tracing_level.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_impair_defense_configure_app_install_control.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_impair_defense_define_win_defender_threat_action.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_impair_defense_delete_win_defender_context_menu.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_impair_defense_delete_win_defender_profile_registry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_impair_defense_deny_security_software_with_applocker.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_impair_defense_disable_controlled_folder_access.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_impair_defense_disable_defender_firewall_and_network.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_impair_defense_disable_defender_protocol_recognition.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_impair_defense_disable_pua_protection.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_impair_defense_disable_realtime_signature_delivery.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_impair_defense_disable_web_evaluation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_impair_defense_disable_win_defender_app_guard.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_impair_defense_disable_win_defender_compute_file_hashes.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_impair_defense_disable_win_defender_gen_reports.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_impair_defense_disable_win_defender_network_protection.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_impair_defense_disable_win_defender_report_infection.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_impair_defense_disable_win_defender_scan_on_update.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_impair_defense_disable_win_defender_signature_retirement.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_impair_defense_overide_win_defender_phishing_filter.yml

prep for sysmon 5 release

2025-07-30 13:15:33 -05:00

windows_impair_defense_override_smartscreen_prompt.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_impair_defense_set_win_defender_smart_screen_level_to_warn.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_impair_defenses_disable_auto_logger_session.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_impair_defenses_disable_av_autostart_via_registry.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_impair_defenses_disable_hvci.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_impair_defenses_disable_win_defender_auto_logging.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_important_audit_policy_disabled.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_increase_in_group_or_object_modification_activity.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_increase_in_user_modification_activity.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_indicator_removal_via_rmdir.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

windows_indirect_command_execution_via_forfiles.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_indirect_command_execution_via_pcalua.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_indirect_command_execution_via_series_of_forfiles.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_information_discovery_fsutil.yml

Fix Issues & Updates (#3705 )

2025-10-13 09:18:21 -07:00

windows_ingress_tool_transfer_using_explorer.yml

up version for ci overlords

2025-07-01 23:18:54 +02:00

windows_inprocserver32_new_outlook_form.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_input_capture_using_credential_ui_dll.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

windows_installutil_credential_theft.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_installutil_in_non_standard_path.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_installutil_remote_network_connection.yml

Bumped versions

2025-09-09 08:49:59 -04:00

windows_installutil_uninstall_option.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_installutil_url_in_command_line.yml

Bumped versions

2025-09-09 08:49:59 -04:00

windows_iso_lnk_file_creation.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

windows_kerberos_coercion_via_dns.yml

NTLM Reflection via DNS Object SPN Spoofing (#3789 )

2025-11-18 12:59:34 -08:00

windows_kerberos_local_successful_logon.yml

Automated Splunk TA Update 440 (#3761 )

2025-11-10 12:24:06 -08:00

windows_known_abused_dll_created.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_known_abused_dll_loaded_suspiciously.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_known_graphicalproton_loaded_modules.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

windows_krbrelayup_service_creation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_large_number_of_computer_service_tickets_requested.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ldifde_directory_object_behavior.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_linked_policies_in_adsi_discovery.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_list_env_variables_via_set_command_from_uncommon_parent.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_local_administrator_credential_stuffing.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_local_llm_framework_execution.yml

Rod- Suspicious Local LLM Frameworks (#3780 )

2025-11-24 13:06:41 -08:00

windows_lolbas_executed_as_renamed_file.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_lolbas_executed_outside_expected_path.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_lsa_secrets_nolmhash_registry.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_mail_protocol_in_non_common_process_path.yml

New Rules & Updates - Oct 25 (#3726 )

2025-10-24 14:19:48 -07:00

windows_mark_of_the_web_bypass.yml

quasar_and_loader

2025-07-17 14:51:43 +02:00

windows_masquerading_explorer_as_child_process.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_masquerading_msdtc_process.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_mimikatz_binary_execution.yml

Scattered Spider Tags

2025-07-31 10:54:21 -06:00

windows_mimikatz_crypto_export_file_extensions.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_authenticationleveloverride.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_auto_minor_updates.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_auto_update_notif.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_configure_bitlocker.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_default_icon_setting.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_delete_firewall_rules.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

windows_modify_registry_disable_rdp.yml

rdp_artifacts_and_evasion

2025-08-01 10:13:08 +02:00

windows_modify_registry_disable_restricted_admin.yml

GhostRedirectors

2025-09-18 13:39:40 -06:00

windows_modify_registry_disable_toast_notifications.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_disable_win_defender_raw_write_notif.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_disable_windefender_notifications.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_disable_windows_security_center_notif.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_disableremotedesktopantialias.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_disablesecuritysettings.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_disabling_wer_settings.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_disallow_windows_app.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_do_not_connect_to_win_update.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_dontshowui.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_enablelinkedconnections.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_longpathsenabled.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_maxconnectionperserver.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_no_auto_reboot_with_logon_user.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_no_auto_update.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_nochangingwallpaper.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_on_smart_card_group_policy.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_proxyenable.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_proxyserver.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_qakbot_binary_data_registry.yml

Fix incorrect data sources

2025-06-10 16:04:59 +02:00

windows_modify_registry_regedit_silent_reg_import.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_risk_behavior.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_suppress_win_defender_notif.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_tamper_protection.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_modify_registry_to_add_or_modify_firewall_rule.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

windows_modify_registry_updateserviceurlalternate.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_usewuserver.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_utilize_progids.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_valleyrat_c2_config.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_valleyrat_pwn_reg_entry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_with_md5_reg_key_name.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_wuserver.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_registry_wustatusserver.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_show_compress_color_and_info_tip_registry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_modify_system_firewall_with_notable_process_path.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_mof_event_triggered_execution_via_wmi.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_moveit_transfer_writing_aspx.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

windows_msc_eviltwin_directory_path_manipulation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_msexchange_management_mailbox_cmdlet_usage.yml

Scattered Spider Tags

2025-07-31 10:54:21 -06:00

windows_mshta_execution_in_registry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_mshta_writing_to_world_writable_path.yml

xworm

2025-05-08 11:00:32 +02:00

windows_msiexec_dllregisterserver.yml

fix reported issues

2025-05-19 23:20:51 +02:00

windows_msiexec_hidewindow_rundll32_execution.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_msiexec_remote_download.yml

Bumped versions

2025-09-09 08:49:59 -04:00

windows_msiexec_spawn_discovery_command.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_msiexec_spawn_windbg.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_msiexec_unregister_dllregisterserver.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_msix_package_interaction.yml

The Lost Payload: MSIX Resurrection

2025-08-18 11:46:34 -06:00

windows_mstsc_rdp_commandline.yml

rdp_artifacts_and_evasion

2025-08-01 10:18:59 +02:00

windows_multiple_account_passwords_changed.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_multiple_accounts_deleted.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_multiple_accounts_disabled.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_multiple_ntlm_null_domain_authentications.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_multiple_users_failed_to_authenticate_from_process.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_multiple_users_failed_to_authenticate_using_kerberos.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_multiple_users_remotely_failed_to_authenticate_from_host.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_net_system_service_discovery.yml

lamehug

2025-08-28 15:22:47 +02:00

windows_netsupport_rmm_dll_loaded_by_uncommon_process.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

windows_network_connection_discovery_via_net.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_network_share_interaction_via_net.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_new_custom_security_descriptor_set_on_eventlog_channel.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_new_default_file_association_value_set.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_new_deny_permission_set_on_service_sd_via_sc_exe.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_new_eventlog_channelaccess_registry_value_set.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_new_inprocserver32_added.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

windows_new_service_security_descriptor_set_via_sc_exe.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ngrok_reverse_proxy_usage.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_nirsoft_advancedrun.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_nirsoft_tool_bundle_file_created.yml

Add New ASA Analytics (#3794 )

2025-11-21 14:50:18 -08:00

windows_nirsoft_utilities.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

windows_njrat_fileless_storage_via_registry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_non_discord_app_access_discord_leveldb.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_non_system_account_targeting_lsass.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_obfuscated_files_or_information_via_rar_sfx.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

windows_odbcconf_hunting.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_odbcconf_load_dll.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_odbcconf_load_response_file.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_office_product_dropped_cab_or_inf_file.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

windows_office_product_dropped_uncommon_file.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_office_product_loaded_mshtml_module.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_office_product_loading_taskschd_dll.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_office_product_loading_vbe7_dll.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_office_product_spawned_child_process_for_download.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

windows_office_product_spawned_control.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_office_product_spawned_msdt.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_office_product_spawned_rundll32_with_no_dll.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_office_product_spawned_uncommon_process.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

windows_outlook_dialogs_disabled_from_unusual_process.yml

NotDoor Outlook Macro Detections

2025-09-11 11:42:25 -04:00

windows_outlook_loadmacroprovideronboot_persistence.yml

NotDoor Outlook Macro Detections

2025-09-11 11:42:25 -04:00

windows_outlook_macro_created_by_suspicious_process.yml

NotDoor Outlook Macro Detections

2025-09-11 11:42:25 -04:00

windows_outlook_macro_security_modified.yml

NotDoor Outlook Macro Detections

2025-09-11 11:42:25 -04:00

windows_outlook_webview_registry_modification.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_papercut_ng_spawn_shell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_parent_pid_spoofing_with_explorer.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_password_managers_discovery.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_password_policy_discovery_with_net.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_phishing_outlook_drop_dll_in_form_dir.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_phishing_pdf_file_executes_url_link.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_phishing_recent_iso_exec_registry.yml

prep for sysmon 5 release

2025-07-30 13:15:33 -05:00

windows_possible_credential_dumping.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_post_exploitation_risk_behavior.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_potential_appdomainmanager_hijack_artifacts_creation.yml

Add New Analytics Covering SesameOp and PromptFlux (#3827 )

2026-01-08 00:58:33 +01:00

windows_powershell_add_module_to_global_assembly_cache.yml

Version bumps

2025-06-24 12:43:01 -05:00

windows_powershell_cryptography_namespace.yml

Version bumps

2025-06-24 12:43:01 -05:00

windows_powershell_disable_http_logging.yml

Version bumps

2025-06-24 12:43:01 -05:00

windows_powershell_export_certificate.yml

Version bumps

2025-06-24 12:43:01 -05:00

windows_powershell_export_pfxcertificate.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_powershell_fakecaptcha_clipboard_execution.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

windows_powershell_get_ciminstance_remote_computer.yml

Version bumps

2025-06-24 12:43:01 -05:00

windows_powershell_history_file_deletion.yml

Version bumps

2025-06-24 12:43:01 -05:00

windows_powershell_iis_components_webglobalmodule_usage.yml

GhostRedirectors

2025-09-18 13:39:40 -06:00

windows_powershell_import_applocker_policy.yml

Version bumps

2025-06-24 12:43:01 -05:00

windows_powershell_invoke_restmethod_ip_information_collection.yml

Version bumps

2025-06-24 12:43:01 -05:00

windows_powershell_invoke_sqlcmd_execution.yml

GhostRedirectors

2025-09-18 13:39:40 -06:00

windows_powershell_logoff_user_via_quser.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_powershell_msix_package_installation.yml

Bumped versions

2025-09-09 08:49:59 -04:00

windows_powershell_process_implementing_manual_base64_decoder.yml

Add New ASA Analytics (#3794 )

2025-11-21 14:50:18 -08:00

windows_powershell_process_with_malicious_string.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_powershell_remotesigned_file.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_powershell_scheduletask.yml

Scattered Spider Tags

2025-07-31 10:54:21 -06:00

windows_powershell_script_block_with_malicious_string.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_powershell_script_from_windowsapps_directory.yml

The Lost Payload: MSIX Resurrection

2025-08-18 11:46:34 -06:00

windows_powershell_wmi_win32_scheduledjob.yml

Version bumps

2025-06-24 12:43:01 -05:00

windows_powersploit_gpp_discovery.yml

Version bumps

2025-06-24 12:43:01 -05:00

windows_powerview_ad_access_control_list_enumeration.yml

Version bumps

2025-06-24 12:43:01 -05:00

windows_powerview_constrained_delegation_discovery.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_powerview_kerberos_service_ticket_request.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_powerview_spn_discovery.yml

interlock_ransomware

2025-07-28 11:58:45 +02:00

windows_powerview_unconstrained_delegation_discovery.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_private_keys_discovery.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_privilege_escalation_suspicious_process_elevation.yml

GhostRedirectors

2025-09-18 13:39:40 -06:00

windows_privilege_escalation_system_process_without_system_parent.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_privilege_escalation_user_process_spawn_system_process.yml

GhostRedirectors

2025-09-18 13:39:40 -06:00

windows_privileged_group_modification.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_process_commandline_discovery.yml

fix reported issues

2025-05-19 23:20:51 +02:00

windows_process_executed_from_removable_media.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

windows_process_execution_from_programdata.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

windows_process_execution_from_rdp_share.yml

New Rules & Updates - Oct 25 (#3726 )

2025-10-24 14:19:48 -07:00

windows_process_execution_in_temp_dir.yml

Add New Analytics Covering SesameOp and PromptFlux (#3827 )

2026-01-08 00:58:33 +01:00

windows_process_injection_in_non_service_searchindexer.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_process_injection_into_commonly_abused_processes.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

windows_process_injection_into_notepad.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

windows_process_injection_of_wermgr_to_known_browser.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_process_injection_remote_thread.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_process_injection_wermgr_child_process.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_process_injection_with_public_source_path.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_process_with_namedpipe_commandline.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_process_with_netexec_command_line_parameters.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_process_writing_file_to_world_writable_path.yml

New Rules & Updates - Oct 25 (#3726 )

2025-10-24 14:19:48 -07:00

windows_processes_killed_by_industroyer2_malware.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_protocol_tunneling_with_plink.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_proxy_via_netsh.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_proxy_via_registry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_pstools_recon_usage.yml

Add New ASA Analytics (#3794 )

2025-11-21 14:50:18 -08:00

windows_pua_named_pipe.yml

Add tuoni content and named pipe detection (#3816 )

2025-12-08 21:25:09 +01:00

windows_query_registry_browser_list_application.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_query_registry_uninstall_program_list.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_raccine_scheduled_task_deletion.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_rapid_authentication_on_multiple_hosts.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_rasautou_dll_execution.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

windows_raw_access_to_disk_volume_partition.yml

path_wiper

2025-08-20 12:13:44 +02:00

windows_raw_access_to_master_boot_record_drive.yml

path_wiper

2025-08-20 12:13:44 +02:00

windows_rdp_automaticdestinations_deletion.yml

rdp_artifacts_and_evasion

2025-08-07 14:09:06 +02:00

windows_rdp_bitmap_cache_file_creation.yml

rdp_artifacts_and_evasion

2025-08-06 10:55:23 +02:00

windows_rdp_cache_file_deletion.yml

rdp_artifacts_and_evasion

2025-08-07 14:09:06 +02:00

windows_rdp_client_launched_with_admin_session.yml

rdp_artifacts_and_evasion

2025-08-07 14:09:06 +02:00

windows_rdp_connection_successful.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

windows_rdp_file_execution.yml

rdp_artifacts_and_evasion

2025-08-07 14:25:22 +02:00

windows_rdp_login_session_was_established.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_rdp_server_registry_deletion.yml

rdp_artifacts_and_evasion

2025-08-07 14:14:39 +02:00

windows_rdp_server_registry_entry_created.yml

rdp_artifacts_and_evasion

2025-08-06 12:36:46 +02:00

windows_rdpclient_connection_sequence_events.yml

rdp_artifacts_and_evasion

2025-08-07 14:25:22 +02:00

windows_registry_bootexecute_modification.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_registry_certificate_added.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_registry_delete_task_sd.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_registry_dotnet_etw_disabled_via_env_variable.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_registry_entries_exported_via_reg.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_registry_entries_restored_via_reg.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_registry_modification_for_safe_mode_persistence.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_registry_payload_injection.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_registry_sip_provider_modification.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_regsvr32_renamed_binary.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_remote_access_software_brc4_loaded_dll.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_remote_access_software_rms_registry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_remote_assistance_spawning_process.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_remote_create_service.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_remote_host_computer_management_access.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_remote_management_execute_shell.yml

Fix Issues & Updates (#3705 )

2025-10-13 09:18:21 -07:00

windows_remote_service_rdpwinst_tool_execution.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_remote_services_allow_rdp_in_firewall.yml

rdp_artifacts_and_evasion

2025-08-01 10:13:08 +02:00

windows_remote_services_allow_remote_assistance.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_remote_services_rdp_enable.yml

rdp_artifacts_and_evasion

2025-08-01 10:13:08 +02:00

windows_renamed_powershell_execution.yml

version bumps (#3732 )

2025-10-17 11:15:52 -07:00

windows_replication_through_removable_media.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

windows_rmm_named_pipe.yml

Add tuoni content and named pipe detection (#3816 )

2025-12-08 21:25:09 +01:00

windows_root_domain_linked_policies_discovery.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_rundll32_apply_user_settings_changes.yml

Fix Issues & Updates (#3705 )

2025-10-13 09:18:21 -07:00

windows_rundll32_load_dll_in_temp_dir.yml

Remove duplicate filter macro

2025-08-22 10:24:02 -04:00

windows_rundll32_webdav_request.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_rundll32_webdav_with_network_connection.yml

Update windows_rundll32_webdav_with_network_connection.yml

2025-06-17 11:44:13 +02:00

windows_runmru_command_execution.yml

Fix incorrect data sources

2025-06-10 16:04:59 +02:00

windows_runmru_registry_key_or_value_deleted.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

windows_scheduled_task_created_via_xml.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

windows_scheduled_task_dll_module_loaded.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_scheduled_task_service_spawned_shell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_scheduled_task_with_highest_privileges.yml

netsupport (#3798 )

2025-11-21 13:27:52 -08:00

windows_scheduled_task_with_suspicious_command.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

windows_scheduled_task_with_suspicious_name.yml

castlerat (#3750 )

2025-11-07 11:08:44 -08:00

windows_scheduled_tasks_for_compmgmtlauncher_or_eventvwr.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_schtasks_create_run_as_system.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

windows_scmanager_security_descriptor_tampering_via_sc_exe.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_screen_capture_in_temp_folder.yml

version bumps (#3732 )

2025-10-17 11:15:52 -07:00

windows_screen_capture_via_powershell.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

windows_security_account_manager_stopped.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_security_and_backup_services_stop.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_security_support_provider_reg_query.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_sensitive_group_discovery_with_net.yml

WSUSpect in Custody: CVE-2025-59287 (#3743 )

2025-10-27 09:48:44 -07:00

windows_sensitive_registry_hive_dump_via_commandline.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

windows_server_software_component_gacutil_install_to_gac.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_service_create_kernel_mode_driver.yml

Update Driver and Extensionless Files Related Detections (#3846 )

2026-01-06 02:02:25 +01:00

windows_service_create_remcomsvc.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_service_create_sliverc2.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

windows_service_create_with_tscon.yml

rdp_artifacts_and_evasion

2025-08-01 10:13:08 +02:00

windows_service_created_with_suspicious_service_name.yml

Add tuoni content and named pipe detection (#3816 )

2025-12-08 21:25:09 +01:00

windows_service_created_with_suspicious_service_path.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

windows_service_creation_on_remote_endpoint.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_service_creation_using_registry_entry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_service_deletion_in_registry.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_service_execution_remcom.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_service_initiation_on_remote_endpoint.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_service_stop_attempt.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_service_stop_by_deletion.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_service_stop_win_updates.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_set_account_password_policy_to_unlimited_via_net.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_set_network_profile_category_to_private_via_registry.yml

fix_net_profile_analytic (#3689 )

2025-10-10 17:20:14 +00:00

windows_sharepoint_spinstall0_webshell_file_creation.yml

Create windows_sharepoint_spinstall0_webshell_file_creation.yml

2025-07-21 13:57:05 -06:00

windows_shell_process_from_crushftp.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_short_lived_dns_record.yml

NTLM Reflection via DNS Object SPN Spoofing (#3789 )

2025-11-18 12:59:34 -08:00

windows_sip_provider_inventory.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_sip_winverifytrust_failed_trust_validation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_snake_malware_file_modification_crmlog.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_snake_malware_kernel_driver_comadmin.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_snake_malware_registry_modification_wav_openwithprogids.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_snake_malware_service_create.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_snappybee_create_test_registry.yml

CIM App name and Switch sourcetypes (#3799 )

2025-11-21 08:33:33 -08:00

windows_soaphound_binary_execution.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_spearphishing_attachment_onenote_spawn_mshta.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

windows_special_privileged_logon_on_multiple_hosts.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_speechruntime_com_hijacking_dll_load.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_speechruntime_suspicious_child_process.yml

Improve descriptions

2025-08-28 13:59:56 -04:00

windows_sql_server_configuration_option_hunt.yml

Updates to SQL Content

2025-08-28 11:32:03 -06:00

windows_sql_server_critical_procedures_enabled.yml

Update windows_sql_server_critical_procedures_enabled.yml

2025-09-03 09:18:14 -07:00

windows_sql_server_extended_procedure_dll_loading_hunt.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_sql_server_startup_procedure.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

windows_sql_server_xp_cmdshell_config_change.yml

GhostRedirectors

2025-09-18 13:39:40 -06:00

windows_sql_spawning_certutil.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_sqlcmd_execution.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

windows_sqlservr_spawning_shell.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_sqlwriter_sqldumper_dll_sideload.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ssh_proxy_command.yml

New Rules & Updates - Oct 25 (#3726 )

2025-10-24 14:19:48 -07:00

windows_steal_authentication_certificates___esc1_abuse.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_steal_authentication_certificates___esc1_authentication.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_steal_authentication_certificates_certificate_issued.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_steal_authentication_certificates_certificate_request.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_steal_authentication_certificates_certutil_backup.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_steal_authentication_certificates_cryptoapi.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

windows_steal_authentication_certificates_cs_backup.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_steal_authentication_certificates_export_certificate.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_steal_authentication_certificates_export_pfxcertificate.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_steal_or_forge_kerberos_tickets_klist.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_subinacl_execution.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_suspect_process_with_authentication_traffic.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_suspicious_c2_named_pipe.yml

Add tuoni content and named pipe detection (#3816 )

2025-12-08 21:25:09 +01:00

windows_suspicious_child_process_spawned_from_webserver.yml

WSUSpect in Custody: CVE-2025-59287 (#3743 )

2025-10-27 09:48:44 -07:00

windows_suspicious_driver_loaded_path.yml

Update Driver and Extensionless Files Related Detections (#3846 )

2026-01-06 02:02:25 +01:00

windows_suspicious_named_pipe.yml

Add tuoni content and named pipe detection (#3816 )

2025-12-08 21:25:09 +01:00

windows_suspicious_process_file_path.yml

Add New Analytics Covering SesameOp and PromptFlux (#3827 )

2026-01-08 00:58:33 +01:00

windows_suspicious_react_or_next_js_child_process.yml

Message formatting changes

2025-12-08 21:26:34 -05:00

windows_suspicious_vmware_tools_child_process.yml

Updates for 3886

2025-08-05 12:32:01 -05:00

windows_svchost_exe_parent_process_anomaly.yml

switching source and sourcetype (#3779 )

2025-11-12 16:54:27 -08:00

windows_symlink_evaluation_change_via_fsutil.yml

Fix Issues & Updates (#3705 )

2025-10-13 09:18:21 -07:00

windows_system_binary_proxy_execution_compiled_html_file_decompile.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

windows_system_discovery_using_ldap_nslookup.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_system_discovery_using_qwinsta.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_system_file_on_disk.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_system_logoff_commandline.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_system_network_config_discovery_display_dns.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_system_network_connections_discovery_netsh.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_system_reboot_commandline.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_system_remote_discovery_with_query.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_system_script_proxy_execution_syncappvpublishingserver.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_system_shutdown_commandline.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_system_time_discovery_w32tm_delay.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_system_user_discovery_via_quser.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_system_user_privilege_discovery.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_terminating_lsass_process.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

windows_time_based_evasion_via_choice_exec.yml

objectivity_stealer

2025-08-25 18:46:15 +02:00

windows_time_based_evasion.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_uac_bypass_suspicious_child_process.yml

castlerat (#3750 )

2025-11-07 11:08:44 -08:00

windows_uac_bypass_suspicious_escalation_behavior.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_unsecured_outlook_credentials_access_in_registry.yml

lokibot (#3701 )

2025-10-10 18:32:18 +00:00

windows_unsigned_dll_side_loading_in_same_process_path.yml

lokibot (#3701 )

2025-10-10 18:32:18 +00:00

windows_unsigned_dll_side_loading.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_unsigned_ms_dll_side_loading.yml

xworm

2025-05-08 11:00:32 +02:00

windows_unusual_count_of_disabled_users_failed_auth_using_kerberos.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_unusual_count_of_users_failed_to_authenticate_from_process.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_unusual_filezilla_xml_config_access.yml

quasar_and_loader

2025-07-17 15:32:38 +02:00

windows_unusual_intelliform_storage_registry_access.yml

lokibot (#3701 )

2025-10-10 18:32:18 +00:00

windows_unusual_ntlm_authentication_destinations_by_source.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_unusual_ntlm_authentication_destinations_by_user.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_unusual_ntlm_authentication_users_by_destination.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_unusual_ntlm_authentication_users_by_source.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_unusual_process_load_mozilla_nss_mozglue_module.yml

lokibot (#3701 )

2025-10-10 18:32:18 +00:00

windows_unusual_syswow64_process_run_system32_executable.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_usbstor_registry_key_modification.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

windows_user_deletion_via_net.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_user_disabled_via_net.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_user_discovery_via_net.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_user_execution_malicious_url_shortcut_file.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

windows_visual_basic_commandline_compiler_dnsquery.yml

lokibot (#3701 )

2025-10-10 18:32:18 +00:00

windows_vulnerable_3cx_software.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_vulnerable_driver_installed.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_vulnerable_driver_loaded.yml

upgrade detection with tests to production

2025-06-10 13:56:06 +02:00

windows_wbadmin_file_recovery_from_backup.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

windows_windbg_spawning_autoit3.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_winlogon_with_public_network_connection.yml

update to fix ci errors

2025-06-16 16:24:51 +02:00

windows_wmi_impersonate_token.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_wmi_process_and_service_list.yml

Update WMI Process and Service List version and date

2025-08-25 12:53:21 +02:00

windows_wmi_process_call_create.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_wmic_cpu_discovery.yml

lamehug

2025-08-28 14:34:09 +02:00

windows_wmic_diskdrive_discovery.yml

lamehug

2025-08-28 14:34:09 +02:00

windows_wmic_memory_chip_discovery.yml

lamehug

2025-08-28 14:34:09 +02:00

windows_wmic_network_discovery.yml

lamehug

2025-08-28 14:34:09 +02:00

windows_wmic_shadowcopy_delete.yml

CIM App name and Switch sourcetypes (#3799 )

2025-11-21 08:33:33 -08:00

windows_wmic_systeminfo_discovery.yml

lamehug

2025-08-28 14:34:09 +02:00

windows_wpdbusenum_registry_key_modification.yml

APT 37 and The No Good Rustonotto (#3686 )

2025-10-13 13:54:03 -07:00

windows_wsus_spawning_shell.yml

WSUSpect in Custody: CVE-2025-59287 (#3743 )

2025-10-27 09:48:44 -07:00

winevent_scheduled_task_created_to_spawn_shell.yml

castlerat (#3750 )

2025-11-07 11:08:44 -08:00

winevent_scheduled_task_created_within_public_path.yml

Add New Analytics Covering SesameOp and PromptFlux (#3827 )

2026-01-08 00:58:33 +01:00

winevent_windows_task_scheduler_event_action_started.yml

Add New Analytics Covering SesameOp and PromptFlux (#3827 )

2026-01-08 00:58:33 +01:00

winhlp32_spawning_a_process.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

winrar_spawning_shell_application.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

winrm_spawning_a_process.yml

WSUSpect in Custody: CVE-2025-59287 (#3743 )

2025-10-27 09:48:44 -07:00

wmi_permanent_event_subscription___sysmon.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

wmi_permanent_event_subscription.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

wmi_recon_running_process_or_services.yml

Version bumps

2025-06-24 12:43:01 -05:00

wmi_temporary_event_subscription.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

wmic_group_discovery.yml

lamehug

2025-08-27 13:48:15 +02:00

wmic_noninteractive_app_uninstallation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

wmic_xsl_execution_via_url.yml

Bumped versions

2025-09-09 08:49:59 -04:00

wmiprvse_lolbas_execution_process_spawn.yml

Duplicate - 3737 (#3738 )

2025-10-21 12:42:28 -07:00

wscript_or_cscript_suspicious_child_process.yml

objectivity_stealer

2025-08-25 18:46:15 +02:00

wsmprovhost_lolbas_execution_process_spawn.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

wsreset_uac_bypass.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

xmrig_driver_loaded.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

xsl_script_execution_with_wmic.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00