admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
cyclopsblink_fix
splunk-security_content/detections/endpoint
T
History
patel-bhavin 489829b2a6 Merge branch 'develop' into cyclopsblink_fix
2022-05-02 11:06:38 -07:00
..
7zip_commandline_to_smb_share_path.yml
Refactored security content
2022-03-09 14:43:09 +01:00
access_lsass_memory_for_dump_creation.yml
Refactored security content
2022-03-09 14:43:09 +01:00
account_discovery_with_net_app.yml
Update account_discovery_with_net_app.yml
2022-03-16 11:34:43 -06:00
active_setup_registry_autostart.yml
hermeticwipertagswindowsprivesc
2022-04-05 07:55:03 -07:00
add_defaultuser_and_password_in_registry.yml
Refactored security content
2022-03-09 14:43:09 +01:00
add_or_set_windows_defender_exclusion.yml
Refactored security content
2022-03-09 14:43:09 +01:00
adsisearcher_account_discovery.yml
industroyer2
2022-04-25 12:03:54 +02:00
allow_file_and_printing_sharing_in_firewall.yml
Refactored security content
2022-03-09 14:43:09 +01:00
allow_inbound_traffic_by_firewall_rule_registry.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
allow_inbound_traffic_in_firewall_rule.yml
Refactored security content
2022-03-09 14:43:09 +01:00
allow_network_discovery_in_firewall.yml
Refactored security content
2022-03-09 14:43:09 +01:00
allow_operation_with_consent_admin.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
anomalous_usage_of_7zip.yml
Refactored security content
2022-03-09 14:43:09 +01:00
any_powershell_downloadfile.yml
T# add
2022-04-07 15:06:13 -06:00
any_powershell_downloadstring.yml
T# add
2022-04-07 15:06:13 -06:00
attacker_tools_on_endpoint.yml
Added automaticc generation of finding report
2022-03-14 12:12:48 +01:00
attempt_to_add_certificate_to_untrusted_store.yml
Refactored security content
2022-03-09 14:43:09 +01:00
attempt_to_stop_security_service.yml
Refactored security content
2022-03-09 14:43:09 +01:00
attempted_credential_dump_from_registry_via_reg_exe.yml
industroyer2
2022-04-25 09:36:55 +02:00
auto_admin_logon_registry_entry.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
batch_file_write_to_system32.yml
Refactored security content
2022-03-09 14:43:09 +01:00
bcdedit_command_back_to_normal_mode_boot.yml
Refactored security content
2022-03-09 14:43:09 +01:00
bcdedit_failure_recovery_modification.yml
Refactored security content
2022-03-09 14:43:09 +01:00
bits_job_persistence.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
bitsadmin_download_file.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
certutil_download_with_urlcache_and_split_arguments.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
certutil_download_with_verifyctl_and_split_arguments.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
certutil_exe_certificate_extraction.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
certutil_with_decode_argument.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
change_default_file_association.yml
hermeticwipertagswindowsprivesc
2022-04-05 07:55:03 -07:00
change_to_safe_mode_with_network_config.yml
Refactored security content
2022-03-09 14:43:09 +01:00
chcp_command_execution.yml
Refactored security content
2022-03-09 14:43:09 +01:00
check_elevated_cmd_using_whoami.yml
Refactored security content
2022-03-09 14:43:09 +01:00
clear_unallocated_sector_using_cipher_app.yml
Refactored security content
2022-03-09 14:43:09 +01:00
clop_common_exec_parameter.yml
Refactored security content
2022-03-09 14:43:09 +01:00
clop_ransomware_known_service_name.yml
Refactored security content
2022-03-09 14:43:09 +01:00
cmd_carry_out_string_command_parameter.yml
fixeddatadestructiontagnewstories
2022-03-25 13:35:13 -07:00
cmd_echo_pipe___escalation.yml
Refactored security content
2022-03-09 14:43:09 +01:00
cmdline_tool_not_executed_in_cmd_shell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
cmlua_or_cmstplua_uac_bypass.yml
Refactored security content
2022-03-09 14:43:09 +01:00
cobalt_strike_named_pipes.yml
Refactored security content
2022-03-09 14:43:09 +01:00
common_ransomware_extensions.yml
Refactored security content
2022-03-09 14:43:09 +01:00
common_ransomware_notes.yml
Refactored security content
2022-03-09 14:43:09 +01:00
conti_common_exec_parameter.yml
Refactored security content
2022-03-09 14:43:09 +01:00
control_loading_from_world_writable_directory.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
create_local_admin_accounts_using_net_exe.yml
Refactored security content
2022-03-09 14:43:09 +01:00
create_or_delete_windows_shares_using_net_exe.yml
Refactored security content
2022-03-09 14:43:09 +01:00
create_remote_thread_in_shell_application.yml
Refactored security content
2022-03-09 14:43:09 +01:00
create_remote_thread_into_lsass.yml
Refactored security content
2022-03-09 14:43:09 +01:00
creation_of_lsass_dump_with_taskmgr.yml
Refactored security content
2022-03-09 14:43:09 +01:00
creation_of_shadow_copy_with_wmic_and_powershell.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
creation_of_shadow_copy.yml
Refactored security content
2022-03-09 14:43:09 +01:00
credential_dumping_via_copy_command_from_shadow_copy.yml
Refactored security content
2022-03-09 14:43:09 +01:00
credential_dumping_via_symlink_to_shadow_copy.yml
Refactored security content
2022-03-09 14:43:09 +01:00
csc_net_on_the_fly_compilation.yml
Refactored security content
2022-03-09 14:43:09 +01:00
curl_download_and_bash_execution.yml
Refactored security content
2022-03-09 14:43:09 +01:00
delete_shadowcopy_with_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
deleting_of_net_users.yml
Refactored security content
2022-03-09 14:43:09 +01:00
deleting_shadow_copies.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_activity_related_to_pass_the_hash_attacks.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_azurehound_command_line_arguments.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_azurehound_file_modifications.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_copy_of_shadowcopy_with_script_block_logging.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_credential_dumping_through_lsass_access.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_empire_with_powershell_script_block_logging.yml
powershelldetectionstaghermetic
2022-03-31 15:29:51 -07:00
detect_excessive_account_lockouts_from_endpoint.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_excessive_user_account_lockouts.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_exchange_web_shell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_html_help_renamed.yml
Hunting
2022-04-07 14:39:56 -06:00
detect_html_help_spawn_child_process.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
detect_html_help_url_in_command_line.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
detect_html_help_using_infotech_storage_handlers.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
detect_mimikatz_using_loaded_images.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_mimikatz_with_powershell_script_block_logging.yml
powershelldetectionstaghermetic
2022-03-31 15:29:51 -07:00
detect_mshta_inline_hta_execution.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
detect_mshta_renamed.yml
Hunting
2022-04-07 14:39:56 -06:00
detect_mshta_url_in_command_line.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
detect_new_local_admin_account.yml
Added automaticc generation of finding report
2022-03-14 12:12:48 +01:00
detect_path_interception_by_creation_of_program_exe.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_processes_used_for_system_network_configuration_discovery.yml
Added automaticc generation of finding report
2022-03-14 12:12:48 +01:00
detect_prohibited_applications_spawning_cmd_exe.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_psexec_with_accepteula_flag.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_rclone_command_line_usage.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_regasm_spawning_a_process.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
detect_regasm_with_network_connection.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
detect_regasm_with_no_command_line_arguments.yml
Branch was auto-updated.
2022-03-15 14:05:07 -07:00
detect_regsvcs_spawning_a_process.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
detect_regsvcs_with_network_connection.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
detect_regsvcs_with_no_command_line_arguments.yml
Branch was auto-updated.
2022-03-15 14:05:07 -07:00
detect_regsvr32_application_control_bypass.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
detect_renamed_7_zip.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_renamed_psexec.yml
Hunting
2022-04-07 14:39:56 -06:00
detect_renamed_rclone.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_renamed_winrar.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_rundll32_application_control_bypass___advpack.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
detect_rundll32_application_control_bypass___setupapi.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
detect_rundll32_application_control_bypass___syssetup.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
detect_rundll32_inline_hta_execution.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
detect_sharphound_command_line_arguments.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_sharphound_file_modifications.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_sharphound_usage.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_use_of_cmd_exe_to_launch_script_interpreters.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_wmi_event_subscription_persistence.yml
Refactored security content
2022-03-09 14:43:09 +01:00
disable_amsi_through_registry.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
disable_defender_antivirus_registry.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
disable_defender_blockatfirstseen_feature.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
disable_defender_enhanced_notification.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
disable_defender_mpengine_registry.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
disable_defender_spynet_reporting.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
disable_defender_submit_samples_consent_feature.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
disable_etw_through_registry.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
disable_logs_using_wevtutil.yml
Refactored security content
2022-03-09 14:43:09 +01:00
disable_registry_tool.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
disable_schedule_task.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
disable_security_logs_using_minint_registry.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
disable_show_hidden_files.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
disable_uac_remote_restriction.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
disable_windows_app_hotkeys.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
disable_windows_behavior_monitoring.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
disable_windows_smartscreen_protection.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml
Refactored security content
2022-03-09 14:43:09 +01:00
disabled_kerberos_pre_authentication_discovery_with_powerview.yml
Refactored security content
2022-03-09 14:43:09 +01:00
disabling_cmd_application.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
disabling_controlpanel.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
disabling_defender_services.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
disabling_firewall_with_netsh.yml
Refactored security content
2022-03-09 14:43:09 +01:00
disabling_folderoptions_windows_feature.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
disabling_net_user_account.yml
Refactored security content
2022-03-09 14:43:09 +01:00
disabling_norun_windows_app.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
disabling_remote_user_account_control.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
disabling_systemrestore_in_registry.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
disabling_task_manager.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
dllhost_with_no_command_line_arguments_with_network.yml
rookie mistake
2022-03-15 12:30:39 -06:00
dns_exfiltration_using_nslookup_app.yml
fix broken detections
2022-03-14 15:51:05 +01:00
domain_account_discovery_with_dsquery.yml
Refactored security content
2022-03-09 14:43:09 +01:00
domain_account_discovery_with_net_app.yml
Refactored security content
2022-03-09 14:43:09 +01:00
domain_account_discovery_with_wmic.yml
Refactored security content
2022-03-09 14:43:09 +01:00
domain_controller_discovery_with_nltest.yml
Refactored security content
2022-03-09 14:43:09 +01:00
domain_controller_discovery_with_wmic.yml
Refactored security content
2022-03-09 14:43:09 +01:00
domain_group_discovery_with_adsisearcher.yml
Refactored security content
2022-03-09 14:43:09 +01:00
domain_group_discovery_with_dsquery.yml
Refactored security content
2022-03-09 14:43:09 +01:00
domain_group_discovery_with_net.yml
Refactored security content
2022-03-09 14:43:09 +01:00
domain_group_discovery_with_wmic.yml
Refactored security content
2022-03-09 14:43:09 +01:00
download_files_using_telegram.yml
Refactored security content
2022-03-09 14:43:09 +01:00
drop_icedid_license_dat.yml
Refactored security content
2022-03-09 14:43:09 +01:00
dsquery_domain_discovery.yml
Refactored security content
2022-03-09 14:43:09 +01:00
dump_lsass_via_comsvcs_dll.yml
industroyer2
2022-04-25 09:36:55 +02:00
dump_lsass_via_procdump.yml
Refactored security content
2022-03-09 14:43:09 +01:00
elevated_group_discovery_with_net.yml
Refactored security content
2022-03-09 14:43:09 +01:00
elevated_group_discovery_with_powerview.yml
Refactored security content
2022-03-09 14:43:09 +01:00
elevated_group_discovery_with_wmic.yml
Refactored security content
2022-03-09 14:43:09 +01:00
enable_rdp_in_other_port_number.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
enable_wdigest_uselogoncredential_registry.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
enumerate_users_local_group_using_telegram.yml
Refactored security content
2022-03-09 14:43:09 +01:00
esentutl_sam_copy.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
etw_registry_disabled.yml
hermeticwipertagswindowsprivesc
2022-04-05 07:55:03 -07:00
eventvwr_uac_bypass.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
excel_spawning_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
excel_spawning_windows_script_host.yml
Refactored security content
2022-03-09 14:43:09 +01:00
excessive_attempt_to_disable_services.yml
Refactored security content
2022-03-09 14:43:09 +01:00
excessive_distinct_processes_from_windows_temp.yml
all the changes again
2022-03-16 13:35:48 -07:00
excessive_file_deletion_in_windefender_folder.yml
Refactored security content
2022-03-09 14:43:09 +01:00
excessive_number_of_service_control_start_as_disabled.yml
Refactored security content
2022-03-09 14:43:09 +01:00
excessive_number_of_taskhost_processes.yml
Refactored security content
2022-03-09 14:43:09 +01:00
excessive_service_stop_attempt.yml
Refactored security content
2022-03-09 14:43:09 +01:00
excessive_usage_of_cacls_app.yml
Refactored security content
2022-03-09 14:43:09 +01:00
excessive_usage_of_net_app.yml
Refactored security content
2022-03-09 14:43:09 +01:00
excessive_usage_of_nslookup_app.yml
fix broken detections
2022-03-14 15:51:05 +01:00
excessive_usage_of_sc_service_utility.yml
Refactored security content
2022-03-09 14:43:09 +01:00
excessive_usage_of_taskkill.yml
Refactored security content
2022-03-09 14:43:09 +01:00
executable_file_written_in_administrative_smb_share.yml
industroyer2
2022-04-25 09:36:55 +02:00
executables_or_script_creation_in_suspicious_path.yml
industroyer2
2022-04-25 09:36:55 +02:00
execute_javascript_with_jscript_com_clsid.yml
Refactored security content
2022-03-09 14:43:09 +01:00
execution_of_file_with_multiple_extensions.yml
Refactored security content
2022-03-09 14:43:09 +01:00
extraction_of_registry_hives.yml
Refactored security content
2022-03-09 14:43:09 +01:00
file_with_samsam_extension.yml
Refactored security content
2022-03-09 14:43:09 +01:00
firewall_allowed_program_enable.yml
Refactored security content
2022-03-09 14:43:09 +01:00
fodhelper_uac_bypass.yml
Refactored security content
2022-03-09 14:43:09 +01:00
fsutil_zeroing_file.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_addefaultdomainpasswordpolicy_with_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_aduser_with_powershell_script_block.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_aduser_with_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_aduserresultantpasswordpolicy_with_powershell_script_block.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_aduserresultantpasswordpolicy_with_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_domainpolicy_with_powershell_script_block.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_domainpolicy_with_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_domaintrust_with_powershell_script_block.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_domaintrust_with_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_domainuser_with_powershell_script_block.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_domainuser_with_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_foresttrust_with_powershell_script_block.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_foresttrust_with_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_wmiobject_group_discovery_with_script_block_logging.yml
Refactored security content
2022-03-09 14:43:09 +01:00
get_wmiobject_group_discovery.yml
Refactored security content
2022-03-09 14:43:09 +01:00
getadcomputer_with_powershell_script_block.yml
Refactored security content
2022-03-09 14:43:09 +01:00
getadcomputer_with_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
getadgroup_with_powershell_script_block.yml
Refactored security content
2022-03-09 14:43:09 +01:00
getadgroup_with_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
getcurrent_user_with_powershell_script_block.yml
Refactored security content
2022-03-09 14:43:09 +01:00
getcurrent_user_with_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
getdomaincomputer_with_powershell_script_block.yml
Refactored security content
2022-03-09 14:43:09 +01:00
getdomaincomputer_with_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
getdomaincontroller_with_powershell_script_block.yml
Refactored security content
2022-03-09 14:43:09 +01:00
getdomaincontroller_with_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
getdomaingroup_with_powershell_script_block.yml
Refactored security content
2022-03-09 14:43:09 +01:00
getdomaingroup_with_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
getlocaluser_with_powershell_script_block.yml
Refactored security content
2022-03-09 14:43:09 +01:00
getlocaluser_with_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
getnettcpconnection_with_powershell_script_block.yml
Refactored security content
2022-03-09 14:43:09 +01:00
getnettcpconnection_with_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
getwmiobject_ds_computer_with_powershell_script_block.yml
Refactored security content
2022-03-09 14:43:09 +01:00
getwmiobject_ds_computer_with_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
getwmiobject_ds_group_with_powershell_script_block.yml
Refactored security content
2022-03-09 14:43:09 +01:00
getwmiobject_ds_group_with_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
getwmiobject_ds_user_with_powershell_script_block.yml
Refactored security content
2022-03-09 14:43:09 +01:00
getwmiobject_ds_user_with_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
getwmiobject_user_account_with_powershell_script_block.yml
Refactored security content
2022-03-09 14:43:09 +01:00
getwmiobject_user_account_with_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
gpupdate_with_no_command_line_arguments_with_network.yml
rookie mistake
2022-03-15 12:30:39 -06:00
hide_user_account_from_sign_in_screen.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
hiding_files_and_directories_with_attrib_exe.yml
Refactored security content
2022-03-09 14:43:09 +01:00
high_frequency_copy_of_files_in_network_share.yml
Refactored security content
2022-03-09 14:43:09 +01:00
high_process_termination_frequency.yml
Refactored security content
2022-03-09 14:43:09 +01:00
hunting_for_log4shell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
icacls_deny_command.yml
Refactored security content
2022-03-09 14:43:09 +01:00
icacls_grant_command.yml
Refactored security content
2022-03-09 14:43:09 +01:00
icedid_exfiltrated_archived_file_creation.yml
Refactored security content
2022-03-09 14:43:09 +01:00
impacket_lateral_movement_commandline_parameters.yml
industroyer2
2022-04-25 09:36:55 +02:00
interactive_session_on_remote_endpoint_with_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
java_class_file_download_by_java_user_agent.yml
Refactored security content
2022-03-09 14:43:09 +01:00
java_writing_jsp_file.yml
Update java_writing_jsp_file.yml
2022-04-06 13:47:38 -06:00
jscript_execution_using_cscript_app.yml
Refactored security content
2022-03-09 14:43:09 +01:00
kerberoasting_spn_request_with_rc4_encryption.yml
hermeticwipertagswindowsprivesc
2022-04-05 07:55:03 -07:00
kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml
Refactored security content
2022-03-09 14:43:09 +01:00
kerberos_pre_authentication_flag_disabled_with_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
kerberos_service_ticket_request_using_rc4_encryption.yml
minor changes
2022-03-22 12:48:09 -04:00
kerberos_tgt_request_using_rc4_encryption.yml
Update kerberos_tgt_request_using_rc4_encryption.yml
2022-04-04 12:04:55 -07:00
kerberos_user_enumeration.yml
validation update
2022-03-15 14:36:47 -07:00
known_services_killed_by_ransomware.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_add_files_in_known_crontab_directories.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_add_user_account.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_at_allow_config_file_creation.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_at_application_execution.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_change_file_owner_to_root.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_common_process_for_elevation_control.yml
descp_fix
2022-04-04 17:11:12 +02:00
linux_dd_file_overwrite.yml
industroyer2
2022-04-25 09:36:55 +02:00
linux_deletion_of_cron_jobs.yml
acidrain
2022-04-13 10:07:22 +02:00
linux_deletion_of_init_daemon_script.yml
acidrain
2022-04-13 10:07:22 +02:00
linux_deletion_of_services.yml
acidrain
2022-04-13 10:07:22 +02:00
linux_deletion_of_ssh_key.yml
acidrain
2022-04-13 10:07:22 +02:00
linux_deletion_of_ssl_certificate.yml
acidrain
2022-04-13 10:07:22 +02:00
linux_doas_conf_file_creation.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_doas_tool_execution.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_edit_cron_table_parameter.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_file_created_in_kernel_driver_directory.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_file_creation_in_init_boot_directory.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_file_creation_in_profile_directory.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_high_frequency_of_file_deletion_in_etc_folder.yml
acidrain
2022-04-13 10:07:22 +02:00
linux_insert_kernel_module_using_insmod_utility.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_install_kernel_module_using_modprobe_utility.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_iptables_firewall_modification.yml
Update linux_iptables_firewall_modification.yml
2022-04-29 17:40:36 +02:00
linux_java_spawning_shell.yml
function and CVE-2022-22965 fixes
2022-04-05 15:36:38 -06:00
linux_kworker_process_in_writable_process_path.yml
cyclopsblink_fix
2022-04-29 12:11:29 +02:00
linux_nopasswd_entry_in_sudoers_file.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_pkexec_privilege_escalation.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_possible_access_or_modification_of_sshd_config_file.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_possible_access_to_credential_files.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_possible_access_to_sudoers_file.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_possible_append_command_to_at_allow_config_file.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_possible_append_command_to_profile_config_file.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_possible_cronjob_modification_with_editor.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_possible_ssh_key_file_creation.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_preload_hijack_library_calls.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_service_file_created_in_systemd_directory.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_service_restarted.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_service_started_or_enabled.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_setuid_using_chmod_utility.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_setuid_using_setcap_utility.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_sudo_or_su_execution.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_sudoers_tmp_file_creation.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_system_network_discovery.yml
industroyer2
2022-04-25 09:36:55 +02:00
linux_visudo_utility_execution.yml
Refactored security content
2022-03-09 14:43:09 +01:00
loading_of_dynwrapx_module.yml
Refactored security content
2022-03-09 14:43:09 +01:00
local_account_discovery_with_net.yml
Refactored security content
2022-03-09 14:43:09 +01:00
local_account_discovery_with_wmic.yml
Refactored security content
2022-03-09 14:43:09 +01:00
log4shell_cve_2021_44228_exploitation.yml
bug fix description log4j detection
2022-04-01 15:46:48 +02:00
logon_script_event_trigger_execution.yml
hermeticwipertagswindowsprivesc
2022-04-05 07:55:03 -07:00
macos_lolbin.yml
improved MacOS detection
2022-04-05 19:00:05 +02:00
macos_plutil.yml
small change
2022-04-04 10:43:01 +02:00
mailsniper_invoke_functions.yml
Refactored security content
2022-03-09 14:43:09 +01:00
malicious_inprocserver32_modification.yml
Refactored security content
2022-03-09 14:43:09 +01:00
malicious_powershell_executed_as_a_service.yml
Refactored security content
2022-03-09 14:43:09 +01:00
malicious_powershell_process___encoded_command.yml
powershelldetectionstaghermetic
2022-03-31 15:29:51 -07:00
malicious_powershell_process___execution_policy_bypass.yml
Added automaticc generation of finding report
2022-03-14 12:12:48 +01:00
malicious_powershell_process_with_obfuscation_techniques.yml
powershelldetectionstaghermetic
2022-03-31 15:29:51 -07:00
mimikatz_passtheticket_commandline_parameters.yml
Refactored security content
2022-03-09 14:43:09 +01:00
mmc_exe_lolbas_execution_process_spawn.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
modification_of_wallpaper.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
modify_acl_permission_to_files_or_folder.yml
add_story_and_minor_fix
2022-03-17 11:39:39 +01:00
monitor_registry_keys_for_print_monitors.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
ms_scripting_process_loading_ldap_module.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ms_scripting_process_loading_wmi_module.yml
Refactored security content
2022-03-09 14:43:09 +01:00
msbuild_suspicious_spawned_by_script_process.yml
Refactored security content
2022-03-09 14:43:09 +01:00
mshta_spawning_rundll32_or_regsvr32_process.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
mshtml_module_load_in_office_product.yml
fixes
2022-03-16 12:40:39 -06:00
msi_module_loaded_by_non_system_binary.yml
secondbatchwinprivesctaghermeticwiper
2022-04-05 08:02:47 -07:00
msmpeng_application_dll_side_loading.yml
Refactored security content
2022-03-09 14:43:09 +01:00
multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml
Refactored security content
2022-03-09 14:43:09 +01:00
multiple_users_failing_to_authenticate_from_host_using_kerberos.yml
Refactored security content
2022-03-09 14:43:09 +01:00
multiple_users_failing_to_authenticate_from_host_using_ntlm.yml
Refactored security content
2022-03-09 14:43:09 +01:00
multiple_users_failing_to_authenticate_from_process.yml
Refactored security content
2022-03-09 14:43:09 +01:00
multiple_users_remotely_failing_to_authenticate_from_host.yml
Refactored security content
2022-03-09 14:43:09 +01:00
net_localgroup_discovery.yml
Refactored security content
2022-03-09 14:43:09 +01:00
net_profiler_uac_bypass.yml
Refactored security content
2022-03-09 14:43:09 +01:00
network_connection_discovery_arp.yml
Refactored security content
2022-03-09 14:43:09 +01:00
network_connection_discovery_net.yml
Refactored security content
2022-03-09 14:43:09 +01:00
network_connection_discovery_netstat.yml
Refactored security content
2022-03-09 14:43:09 +01:00
network_discovery_using_route_windows_app.yml
Refactored security content
2022-03-09 14:43:09 +01:00
nishang_powershelltcponeline.yml
Refactored security content
2022-03-09 14:43:09 +01:00
nltest_domain_trust_discovery.yml
Update nltest_domain_trust_discovery.yml
2022-04-18 10:01:25 -06:00
non_chrome_process_accessing_chrome_default_dir.yml
Refactored security content
2022-03-09 14:43:09 +01:00
non_firefox_process_access_firefox_profile_dir.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ntdsutil_export_ntds.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
office_application_drop_executable.yml
Refactored security content
2022-03-09 14:43:09 +01:00
office_application_spawn_regsvr32_process.yml
Refactored security content
2022-03-09 14:43:09 +01:00
office_application_spawn_rundll32_process.yml
Refactored security content
2022-03-09 14:43:09 +01:00
office_document_creating_schedule_task.yml
Refactored security content
2022-03-09 14:43:09 +01:00
office_document_executing_macro_code.yml
Refactored security content
2022-03-09 14:43:09 +01:00
office_document_spawned_child_process_to_download.yml
Refactored security content
2022-03-09 14:43:09 +01:00
office_product_spawn_cmd_process.yml
Refactored security content
2022-03-09 14:43:09 +01:00
office_product_spawning_bitsadmin.yml
Refactored security content
2022-03-09 14:43:09 +01:00
office_product_spawning_certutil.yml
Refactored security content
2022-03-09 14:43:09 +01:00
office_product_spawning_mshta.yml
Refactored security content
2022-03-09 14:43:09 +01:00
office_product_spawning_rundll32_with_no_dll.yml
Refactored security content
2022-03-09 14:43:09 +01:00
office_product_spawning_wmic.yml
Refactored security content
2022-03-09 14:43:09 +01:00
office_product_writing_cab_or_inf.yml
Refactored security content
2022-03-09 14:43:09 +01:00
office_spawning_control.yml
Refactored security content
2022-03-09 14:43:09 +01:00
outbound_network_connection_from_java_using_default_ports.yml
Refactored security content
2022-03-09 14:43:09 +01:00
overwriting_accessibility_binaries.yml
secondbatchwinprivesctaghermeticwiper
2022-04-05 08:02:47 -07:00
password_policy_discovery_with_net.yml
Refactored security content
2022-03-09 14:43:09 +01:00
permission_modification_using_takeown_app.yml
Refactored security content
2022-03-09 14:43:09 +01:00
petitpotam_network_share_access_request.yml
Refactored security content
2022-03-09 14:43:09 +01:00
petitpotam_suspicious_kerberos_tgt_request.yml
minor changes
2022-03-22 12:48:09 -04:00
ping_sleep_batch_command.yml
Refactored security content
2022-03-09 14:43:09 +01:00
possible_browser_pass_view_parameter.yml
Refactored security content
2022-03-09 14:43:09 +01:00
possible_lateral_movement_powershell_spawn.yml
powershelldetectionstaghermetic
2022-03-31 15:29:51 -07:00
potentially_malicious_code_on_commandline.yml
Refactored security content
2022-03-09 14:43:09 +01:00
powershell_4104_hunting.yml
powershelldetectionstaghermetic
2022-03-31 15:29:51 -07:00
powershell___connect_to_internet_with_hidden_window.yml
powershelldetectionstaghermetic
2022-03-31 15:29:51 -07:00
powershell_creating_thread_mutex.yml
Refactored security content
2022-03-09 14:43:09 +01:00
powershell_disable_security_monitoring.yml
Refactored security content
2022-03-09 14:43:09 +01:00
powershell_domain_enumeration.yml
powershelldetectionstaghermetic
2022-03-31 15:29:51 -07:00
powershell_enable_smb1protocol_feature.yml
powershelldetectionstaghermetic
2022-03-31 15:29:51 -07:00
powershell_execute_com_object.yml
powershelldetectionstaghermetic
2022-03-31 15:29:51 -07:00
powershell_fileless_process_injection_via_getprocaddress.yml
powershelldetectionstaghermetic
2022-03-31 15:29:51 -07:00
powershell_fileless_script_contains_base64_encoded_content.yml
powershelldetectionstaghermetic
2022-03-31 15:29:51 -07:00
powershell_get_localgroup_discovery_with_script_block_logging.yml
Refactored security content
2022-03-09 14:43:09 +01:00
powershell_get_localgroup_discovery.yml
Refactored security content
2022-03-09 14:43:09 +01:00
powershell_loading_dotnet_into_memory_via_reflection.yml
powershelldetectionstaghermetic
2022-03-31 15:29:51 -07:00
powershell_processing_stream_of_data.yml
powershelldetectionstaghermetic
2022-03-31 15:29:51 -07:00
powershell_remote_thread_to_known_windows_process.yml
Refactored security content
2022-03-09 14:43:09 +01:00
powershell_remove_windows_defender_directory.yml
Refactored security content
2022-03-09 14:43:09 +01:00
powershell_start_bitstransfer.yml
Refactored security content
2022-03-09 14:43:09 +01:00
powershell_using_memory_as_backing_store.yml
powershelldetectionstaghermetic
2022-03-31 15:29:51 -07:00
powershell_windows_defender_exclusion_commands.yml
Refactored security content
2022-03-09 14:43:09 +01:00
prevent_automatic_repair_mode_using_bcdedit.yml
Refactored security content
2022-03-09 14:43:09 +01:00
print_spooler_adding_a_printer_driver.yml
Refactored security content
2022-03-09 14:43:09 +01:00
print_spooler_failed_to_load_a_plug_in.yml
Refactored security content
2022-03-09 14:43:09 +01:00
process_creating_lnk_file_in_suspicious_location.yml
Refactored security content
2022-03-09 14:43:09 +01:00
process_deleting_its_process_file_path.yml
Refactored security content
2022-03-09 14:43:09 +01:00
process_execution_via_wmi.yml
Refactored security content
2022-03-09 14:43:09 +01:00
process_kill_base_on_file_path.yml
Refactored security content
2022-03-09 14:43:09 +01:00
process_writing_dynamicwrapperx.yml
Refactored security content
2022-03-09 14:43:09 +01:00
processes_launching_netsh.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ransomware_notes_bulk_creation.yml
Refactored security content
2022-03-09 14:43:09 +01:00
recon_avproduct_through_pwh_or_wmi.yml
powershelldetectionstaghermetic
2022-03-31 15:29:51 -07:00
recon_using_wmi_class.yml
powershelldetectionstaghermetic
2022-03-31 15:29:51 -07:00
recursive_delete_of_directory_in_batch_cmd.yml
Refactored security content
2022-03-09 14:43:09 +01:00
reg_exe_manipulating_windows_services_registry_keys.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
registry_keys_for_creating_shim_databases.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
registry_keys_used_for_persistence.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
registry_keys_used_for_privilege_escalation.yml
secondbatchwinprivesctaghermeticwiper
2022-04-05 08:02:47 -07:00
regsvr32_silent_and_install_param_dll_loading.yml
fixeddatadestructiontagnewstories
2022-03-25 13:35:13 -07:00
regsvr32_with_known_silent_switch_cmdline.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
remcos_client_registry_install_entry.yml
add_story_and_minor_fix
2022-03-21 09:24:42 +01:00
remcos_rat_file_creation_in_remcos_folder.yml
Refactored security content
2022-03-09 14:43:09 +01:00
remote_process_instantiation_via_dcom_and_powershell_script_block.yml
Refactored security content
2022-03-09 14:43:09 +01:00
remote_process_instantiation_via_dcom_and_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
remote_process_instantiation_via_winrm_and_powershell_script_block.yml
Refactored security content
2022-03-09 14:43:09 +01:00
remote_process_instantiation_via_winrm_and_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
remote_process_instantiation_via_winrm_and_winrs.yml
Refactored security content
2022-03-09 14:43:09 +01:00
remote_process_instantiation_via_wmi_and_powershell_script_block.yml
Refactored security content
2022-03-09 14:43:09 +01:00
remote_process_instantiation_via_wmi_and_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
remote_process_instantiation_via_wmi.yml
Refactored security content
2022-03-09 14:43:09 +01:00
remote_system_discovery_with_adsisearcher.yml
Refactored security content
2022-03-09 14:43:09 +01:00
remote_system_discovery_with_dsquery.yml
Refactored security content
2022-03-09 14:43:09 +01:00
remote_system_discovery_with_net.yml
Refactored security content
2022-03-09 14:43:09 +01:00
remote_system_discovery_with_wmic.yml
Refactored security content
2022-03-09 14:43:09 +01:00
remote_wmi_command_attempt.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
resize_shadowstorage_volume.yml
Refactored security content
2022-03-09 14:43:09 +01:00
revil_common_exec_parameter.yml
Refactored security content
2022-03-09 14:43:09 +01:00
revil_registry_entry.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
rubeus_command_line_parameters.yml
minor changes
2022-03-22 12:48:09 -04:00
rubeus_kerberos_ticket_exports_through_winlogon_access.yml
Refactored security content
2022-03-09 14:43:09 +01:00
runas_execution_in_commandline.yml
secondbatchwinprivesctaghermeticwiper
2022-04-05 08:02:47 -07:00
rundll32_control_rundll_hunt.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
rundll32_control_rundll_world_writable_directory.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
rundll32_create_remote_thread_to_a_process.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
rundll32_createremotethread_in_browser.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
rundll32_dnsquery.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
rundll32_process_creating_exe_dll_files.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
rundll32_shimcache_flush.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
rundll32_with_no_command_line_arguments_with_network.yml
rookie mistake
2022-03-15 12:30:39 -06:00
rundll_loading_dll_by_ordinal.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
ryuk_test_files_detected.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ryuk_wake_on_lan_command.yml
Refactored security content
2022-03-09 14:43:09 +01:00
sam_database_file_access_attempt.yml
Refactored security content
2022-03-09 14:43:09 +01:00
samsam_test_file_write.yml
Refactored security content
2022-03-09 14:43:09 +01:00
sc_exe_manipulating_windows_services.yml
Refactored security content
2022-03-09 14:43:09 +01:00
schcache_change_by_app_connect_and_create_adsi_object.yml
Refactored security content
2022-03-09 14:43:09 +01:00
schedule_task_with_http_command_arguments.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
schedule_task_with_rundll32_command_trigger.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
scheduled_task_creation_on_remote_endpoint_using_at.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
scheduled_task_deleted_or_created_via_cmd.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
scheduled_task_initiation_on_remote_endpoint.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
schtasks_run_task_on_demand.yml
industroyer2
2022-04-25 09:36:55 +02:00
schtasks_scheduling_job_on_remote_system.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
schtasks_used_for_forcing_a_reboot.yml
Refactored security content
2022-03-09 14:43:09 +01:00
screensaver_event_trigger_execution.yml
secondbatchwinprivesctaghermeticwiper
2022-04-05 08:02:47 -07:00
script_execution_via_wmi.yml
Refactored security content
2022-03-09 14:43:09 +01:00
sdclt_uac_bypass.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
sdelete_application_execution.yml
Refactored security content
2022-03-09 14:43:09 +01:00
searchprotocolhost_with_no_command_line_with_network.yml
rookie mistake
2022-03-15 12:30:39 -06:00
secretdumps_offline_ntds_dumping_tool.yml
Refactored security content
2022-03-09 14:43:09 +01:00
serviceprincipalnames_discovery_with_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
serviceprincipalnames_discovery_with_setspn.yml
Refactored security content
2022-03-09 14:43:09 +01:00
services_escalate_exe.yml
Refactored security content
2022-03-09 14:43:09 +01:00
services_exe_lolbas_execution_process_spawn.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
powershelldetectionstaghermetic
2022-03-31 15:29:51 -07:00
shim_database_file_creation.yml
Refactored security content
2022-03-09 14:43:09 +01:00
shim_database_installation_with_suspicious_parameters.yml
Refactored security content
2022-03-09 14:43:09 +01:00
short_lived_scheduled_task.yml
Refactored security content
2022-03-09 14:43:09 +01:00
short_lived_windows_accounts.yml
Refactored security content
2022-03-09 14:43:09 +01:00
silentcleanup_uac_bypass.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
single_letter_process_on_endpoint.yml
Refactored security content
2022-03-09 14:43:09 +01:00
slui_runas_elevated.yml
Refactored security content
2022-03-09 14:43:09 +01:00
slui_spawning_a_process.yml
Refactored security content
2022-03-09 14:43:09 +01:00
spoolsv_spawning_rundll32.yml
Refactored security content
2022-03-09 14:43:09 +01:00
spoolsv_suspicious_loaded_modules.yml
Refactored security content
2022-03-09 14:43:09 +01:00
spoolsv_suspicious_process_access.yml
Refactored security content
2022-03-09 14:43:09 +01:00
spoolsv_writing_a_dll___sysmon.yml
Refactored security content
2022-03-09 14:43:09 +01:00
spoolsv_writing_a_dll.yml
Refactored security content
2022-03-09 14:43:09 +01:00
sqlite_module_in_temp_folder.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___anomalous_usage_of_archive_tools.yml
Added automaticc generation of finding report
2022-03-14 12:17:21 +01:00
ssa___attempt_to_delete_services.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___attempt_to_disable_services.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___bcdedit_failure_recovery_modification.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___clear_unallocated_sector_using_cipher_app.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___delete_a_net_user.yml
adding the changes
2022-03-21 15:39:46 -07:00
ssa___deny_permission_using_cacls_utility.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___detect_rclone_command_line_usage.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___disable_net_user_account.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___dns_exfiltration_using_nslookup_app.yml
fix broken detections
2022-03-14 15:51:05 +01:00
ssa___fsutil_zeroing_file.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___grant_permission_using_cacls_utility.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___hiding_files_and_directories_with_attrib_exe.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___modify_acls_permission_of_files_or_folders.yml
adding the changes
2022-03-21 15:39:46 -07:00
ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___prohibited_apps_spawning_cmdprompt.yml
fix broken detections
2022-03-14 15:51:05 +01:00
ssa___resize_shadowstorage_volume.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___sdelete_application_execution.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___system_process_running_from_unexpected_location.yml
adding CIS tags
2022-03-28 11:25:05 -07:00
ssa___unusual_lolbas_in_short_period_of_time.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___wbadmin_delete_system_backups.yml
Tweak detection
2022-03-18 12:56:02 -05:00
ssa___wevtutil_usage_to_clear_logs.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___wevtutil_usage_to_disable_logs.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___windows_bits_job_persistence.yml
adding CIS tags
2022-03-28 11:25:05 -07:00
ssa___windows_bitsadmin_download_file.yml
adding CIS tags
2022-03-28 11:25:05 -07:00
ssa___windows_certutil_decode_file.yml
adding CIS tags
2022-03-28 11:25:05 -07:00
ssa___windows_certutil_urlcache_download.yml
adding CIS tags
2022-03-28 11:25:05 -07:00
ssa___windows_certutil_verifyctl_download.yml
adding CIS tags
2022-03-28 11:25:05 -07:00
ssa___windows_curl_upload_to_remote_destination.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___windows_diskshadow_proxy_execution.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___windows_dotnet_binary_in_non_standard_path.yml
SSA DotNet and LOLBin Analytics
2022-03-18 06:15:50 -06:00
ssa___windows_eventvwr_uac_bypass.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___windows_lolbin_binary_in_non_standard_path.yml
Update ssa___windows_lolbin_binary_in_non_standard_path.yml
2022-04-14 13:40:01 -06:00
ssa___windows_mshta_child_process.yml
Fixed formatting
2022-04-12 13:11:57 -05:00
ssa___windows_mshta_command_line_url.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___windows_mshta_inline_hta_execution.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
Modified 'required fields'
2022-04-14 14:43:30 -05:00
ssa___windows_powershell_downloadfile.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___windows_powershell_start_bitstransfer.yml
adding CIS tags
2022-03-28 11:25:05 -07:00
ssa___windows_rasautou_dll_execution.yml
adding CIS tags
2022-03-28 11:25:05 -07:00
ssa___windows_rundll32_comsvcs_memory_dump.yml
Update ssa___windows_rundll32_comsvcs_memory_dump.yml
2022-04-14 14:13:22 -06:00
ssa___windows_rundll32_inline_hta_execution.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___windows_script_host_spawn_msbuild.yml
fix
2022-03-15 10:07:10 -06:00
ssa___windows_wmiprvse_spawn_msbuild.yml
more fix
2022-03-15 10:14:35 -06:00
suspicious_computer_account_name_change.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_copy_on_system32.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_dllhost_no_command_line_arguments.yml
Updated Rex
2022-03-15 09:54:59 -06:00
suspicious_driver_loaded_path.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_event_log_service_behavior.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_gpupdate_no_command_line_arguments.yml
Updated Rex
2022-03-15 09:54:59 -06:00
suspicious_icedid_rundll32_cmdline.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
suspicious_image_creation_in_appdata_folder.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_kerberos_service_ticket_request.yml
minor changes
2022-03-22 12:48:09 -04:00
suspicious_linux_discovery_commands.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_microsoft_workflow_compiler_rename.yml
Hunting
2022-04-07 14:39:56 -06:00
suspicious_microsoft_workflow_compiler_usage.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
suspicious_msbuild_path.yml
Branch was auto-updated.
2022-03-16 12:45:03 -07:00
suspicious_msbuild_rename.yml
Hunting
2022-04-07 14:39:56 -06:00
suspicious_msbuild_spawn.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
suspicious_mshta_child_process.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
suspicious_mshta_spawn.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
suspicious_process_dns_query_known_abuse_web_services.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_process_file_path.yml
industroyer2
2022-04-25 09:36:55 +02:00
suspicious_process_with_discord_dns_query.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_reg_exe_process.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_regsvr32_register_suspicious_path.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
suspicious_rundll32_dllregisterserver.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
suspicious_rundll32_plugininit.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_rundll32_startw.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_rundll32_with_no_command_line_arguments.yml
Updated Rex
2022-03-15 09:54:59 -06:00
suspicious_scheduled_task_from_public_directory.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
suspicious_searchprotocolhost_no_command_line_arguments.yml
Updated Rex
2022-03-15 09:54:59 -06:00
suspicious_ticket_granting_ticket_request.yml
minor changes
2022-03-22 12:48:09 -04:00
suspicious_wav_file_in_appdata_folder.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_wevtutil_usage.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_writes_to_windows_recycle_bin.yml
Refactored security content
2022-03-09 14:43:09 +01:00
svchost_exe_lolbas_execution_process_spawn.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
system_info_gathering_using_dxdiag_application.yml
Refactored security content
2022-03-09 14:43:09 +01:00
system_information_discovery_detection.yml
Refactored security content
2022-03-09 14:43:09 +01:00
system_processes_run_from_unexpected_locations.yml
Refactored security content
2022-03-09 14:43:09 +01:00
system_user_discovery_with_query.yml
Refactored security content
2022-03-09 14:43:09 +01:00
system_user_discovery_with_whoami.yml
Refactored security content
2022-03-09 14:43:09 +01:00
time_provider_persistence_registry.yml
secondbatchwinprivesctaghermeticwiper
2022-04-05 08:02:47 -07:00
trickbot_named_pipe.yml
Refactored security content
2022-03-09 14:43:09 +01:00
uac_bypass_mmc_load_unsigned_dll.yml
Refactored security content
2022-03-09 14:43:09 +01:00
uac_bypass_with_colorui_com_object.yml
Refactored security content
2022-03-09 14:43:09 +01:00
unified_messaging_service_spawning_a_process.yml
Refactored security content
2022-03-09 14:43:09 +01:00
uninstall_app_using_msiexec.yml
Refactored security content
2022-03-09 14:43:09 +01:00
unknown_process_using_the_kerberos_protocol.yml
validation update
2022-03-15 14:36:47 -07:00
unload_sysmon_filter_driver.yml
Refactored security content
2022-03-09 14:43:09 +01:00
unloading_amsi_via_reflection.yml
powershelldetectionstaghermetic
2022-03-31 15:29:51 -07:00
unusual_number_of_kerberos_service_tickets_requested.yml
Refactored security content
2022-03-09 14:43:09 +01:00
user_discocvery_with_env_vars_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
user_discovery_with_env_vars_powershell_script_block.yml
Refactored security content
2022-03-09 14:43:09 +01:00
usn_journal_deletion.yml
Refactored security content
2022-03-09 14:43:09 +01:00
vbscript_execution_using_wscript_app.yml
Refactored security content
2022-03-09 14:43:09 +01:00
verclsid_clsid_execution.yml
Refactored security content
2022-03-09 14:43:09 +01:00
w3wp_spawning_shell.yml
powershelldetectionstaghermetic
2022-03-31 15:29:51 -07:00
wbadmin_delete_system_backups.yml
Refactored security content
2022-03-09 14:43:09 +01:00
wbemprox_com_object_execution.yml
Refactored security content
2022-03-09 14:43:09 +01:00
wermgr_process_connecting_to_ip_check_web_services.yml
Refactored security content
2022-03-09 14:43:09 +01:00
wermgr_process_create_executable_file.yml
Refactored security content
2022-03-09 14:43:09 +01:00
wermgr_process_spawned_cmd_or_powershell_process.yml
Refactored security content
2022-03-09 14:43:09 +01:00
wget_download_and_bash_execution.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_adfind_exe.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_curl_download_to_suspicious_path.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_curl_upload_to_remote_destination.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_defender_exclusion_registry_entry.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_deleted_registry_by_a_non_critical_process_file_path.yml
Update windows_deleted_registry_by_a_non_critical_process_file_path.yml
2022-03-28 17:16:28 +02:00
windows_disable_change_password_through_registry.yml
doublezero
2022-03-28 14:43:30 +02:00
windows_disable_lock_workstation_feature_through_registry.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
windows_disable_logoff_button_through_registry.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
windows_disable_memory_crash_dump.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
windows_disable_notification_center.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
windows_disable_shutdown_button_through_registry.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
windows_disable_windows_group_policy_features_through_registry.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
windows_disableantispyware_reg.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
windows_disabled_users_failing_to_authenticate_kerberos.yml
all the changes again
2022-03-16 13:35:48 -07:00
windows_diskcryptor_usage.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_diskshadow_proxy_execution.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_dism_remove_defender.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_dotnet_binary_in_non_standard_path.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_drivers_loaded_by_signature.yml
Update windows_drivers_loaded_by_signature.yml
2022-04-22 10:32:33 -06:00
windows_event_for_service_disabled.yml
service_name_added
2022-04-04 09:50:56 +02:00
windows_event_log_cleared.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_excessive_disabled_services_event.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_file_without_extension_in_critical_folder.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_get_adcomputer_unconstrained_delegation_discovery.yml
adding extra references
2022-04-01 11:59:20 -04:00
windows_hide_notification_features_through_registry.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
windows_high_file_deletion_frequency.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_hunting_system_account_targeting_lsass.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_indirect_command_execution_via_forfiles.yml
Fixed paths to attack data sets
2022-04-05 13:36:36 -07:00
windows_indirect_command_execution_via_pcalua.yml
Fixed paths to attack data sets
2022-04-05 13:36:36 -07:00
windows_installutil_credential_theft.yml
fixes
2022-03-16 12:40:39 -06:00
windows_installutil_in_non_standard_path.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
windows_installutil_remote_network_connection.yml
fixes
2022-03-16 12:40:39 -06:00
windows_installutil_uninstall_option_with_network.yml
fixes
2022-03-16 12:40:39 -06:00
windows_installutil_uninstall_option.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
windows_installutil_url_in_command_line.yml
Added - Living Off The Land Story
2022-03-15 14:44:54 -06:00
windows_invalid_users_failed_authentication_via_kerberos.yml
all the changes again
2022-03-16 13:35:48 -07:00
windows_iso_lnk_file_creation.yml
Update windows_iso_lnk_file_creation.yml
2022-04-25 13:44:30 -04:00
windows_modify_show_compress_color_and_info_tip_registry.yml
Branch was auto-updated.
2022-03-28 00:31:28 -07:00
windows_nirsoft_advancedrun.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_nirsoft_utilities.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_non_system_account_targeting_lsass.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_possible_credential_dumping.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_powerview_constrained_delegation_discovery.yml
adding extra references
2022-04-01 11:59:20 -04:00
windows_powerview_unconstrained_delegation_discovery.yml
adding extra references
2022-04-01 11:59:20 -04:00
windows_process_with_namedpipe_commandline.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_raccine_scheduled_task_deletion.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_rasautou_dll_execution.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_raw_access_to_disk_volume_partition.yml
fixeddatadestructiontagnewstories
2022-03-25 13:35:13 -07:00
windows_raw_access_to_master_boot_record_drive.yml
fixeddatadestructiontagnewstories
2022-03-25 13:35:13 -07:00
windows_registry_certificate_added.yml
updates and story
2022-04-22 10:21:29 -06:00
windows_registry_delete_task_sd.yml
Update windows_registry_delete_task_sd.yml
2022-04-22 11:37:08 -06:00
windows_registry_modification_for_safe_mode_persistence.yml
Update windows_registry_modification_for_safe_mode_persistence.yml
2022-04-25 13:46:43 -04:00
windows_remote_assistance_spawning_process.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_schtasks_create_run_as_system.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_security_account_manager_stopped.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_service_created_with_suspicious_service_path.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_service_created_within_public_path.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_service_creation_on_remote_endpoint.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_service_creation_using_registry_entry.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
windows_service_initiation_on_remote_endpoint.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_terminating_lsass_process.yml
doublezero
2022-03-28 16:15:41 +02:00
windows_users_authenticate_using_explicit_credentials.yml
all the changes again
2022-03-16 13:35:48 -07:00
windows_wmi_process_call_create.yml
Refactored security content
2022-03-09 14:43:09 +01:00
winevent_scheduled_task_created_to_spawn_shell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
winevent_scheduled_task_created_within_public_path.yml
industroyer2
2022-04-25 09:36:55 +02:00
winevent_windows_task_scheduler_event_action_started.yml
industroyer2
2022-04-25 09:36:55 +02:00
winhlp32_spawning_a_process.yml
Refactored security content
2022-03-09 14:43:09 +01:00
winword_spawning_cmd.yml
Refactored security content
2022-03-09 14:43:09 +01:00
winword_spawning_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
winword_spawning_windows_script_host.yml
Refactored security content
2022-03-09 14:43:09 +01:00
wmi_permanent_event_subscription___sysmon.yml
Refactored security content
2022-03-09 14:43:09 +01:00
wmi_recon_running_process_or_services.yml
powershelldetectionstaghermetic
2022-03-31 15:29:51 -07:00
wmic_group_discovery.yml
Refactored security content
2022-03-09 14:43:09 +01:00
wmic_noninteractive_app_uninstallation.yml
Refactored security content
2022-03-09 14:43:09 +01:00
wmic_xsl_execution_via_url.yml
Refactored security content
2022-03-09 14:43:09 +01:00
wmiprsve_exe_lolbas_execution_process_spawn.yml
Refactored security content
2022-03-09 14:43:09 +01:00
wscript_or_cscript_suspicious_child_process.yml
Refactored security content
2022-03-09 14:43:09 +01:00
wsmprovhost_exe_lolbas_execution_process_spawn.yml
Refactored security content
2022-03-09 14:43:09 +01:00
wsreset_uac_bypass.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
xmrig_driver_loaded.yml
Refactored security content
2022-03-09 14:43:09 +01:00
xsl_script_execution_with_wmic.yml
Refactored security content
2022-03-09 14:43:09 +01:00