splunk-security_content

7zip_commandline_to_smb_share_path.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

access_lsass_memory_for_dump_creation.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

account_discovery_with_net_app.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

active_setup_registry_autostart.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

add_defaultuser_and_password_in_registry.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

add_or_set_windows_defender_exclusion.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

adsisearcher_account_discovery.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

all_backup_logs_for_host.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

allow_file_and_printing_sharing_in_firewall.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

allow_inbound_traffic_by_firewall_rule_registry.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

allow_inbound_traffic_in_firewall_rule.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

allow_network_discovery_in_firewall.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

allow_operation_with_consent_admin.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

anomalous_usage_of_7zip.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

any_powershell_downloadfile.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

any_powershell_downloadstring.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

attacker_tools_on_endpoint.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

attempt_to_add_certificate_to_untrusted_store.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

attempt_to_stop_security_service.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

attempted_credential_dump_from_registry_via_reg_exe.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

auto_admin_logon_registry_entry.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

baseline_of_command_line_length___mltk.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

batch_file_write_to_system32.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

bcdedit_command_back_to_normal_mode_boot.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

bcdedit_failure_recovery_modification.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

bits_job_persistence.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

bitsadmin_download_file.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

certutil_download_with_urlcache_and_split_arguments.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

certutil_download_with_verifyctl_and_split_arguments.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

certutil_exe_certificate_extraction.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

certutil_with_decode_argument.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

change_default_file_association.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

change_to_safe_mode_with_network_config.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

chcp_command_execution.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

check_elevated_cmd_using_whoami.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

clear_unallocated_sector_using_cipher_app.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

clop_common_exec_parameter.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

clop_ransomware_known_service_name.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

cmd_carry_out_string_command_parameter.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

cmd_echo_pipe___escalation.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

cmdline_tool_not_executed_in_cmd_shell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

cmlua_or_cmstplua_uac_bypass.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

cobalt_strike_named_pipes.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

common_ransomware_extensions.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

common_ransomware_notes.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

conti_common_exec_parameter.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

control_loading_from_world_writable_directory.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

count_of_assets_by_category.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

create_local_admin_accounts_using_net_exe.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

create_or_delete_windows_shares_using_net_exe.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

create_remote_thread_in_shell_application.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

create_remote_thread_into_lsass.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

creation_of_lsass_dump_with_taskmgr.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

creation_of_shadow_copy_with_wmic_and_powershell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

creation_of_shadow_copy.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

credential_dumping_via_copy_command_from_shadow_copy.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

credential_dumping_via_symlink_to_shadow_copy.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

csc_net_on_the_fly_compilation.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

curl_download_and_bash_execution.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

delete_shadowcopy_with_powershell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

deleting_of_net_users.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

deleting_shadow_copies.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_activity_related_to_pass_the_hash_attacks.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

detect_azurehound_command_line_arguments.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_azurehound_file_modifications.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

detect_copy_of_shadowcopy_with_script_block_logging.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

detect_credential_dumping_through_lsass_access.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

detect_empire_with_powershell_script_block_logging.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

detect_excessive_account_lockouts_from_endpoint.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

detect_excessive_user_account_lockouts.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

detect_exchange_web_shell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_html_help_renamed.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_html_help_spawn_child_process.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_html_help_url_in_command_line.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_html_help_using_infotech_storage_handlers.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_mimikatz_using_loaded_images.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_mimikatz_with_powershell_script_block_logging.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

detect_mshta_inline_hta_execution.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_mshta_renamed.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_mshta_url_in_command_line.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_new_local_admin_account.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

detect_path_interception_by_creation_of_program_exe.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_processes_used_for_system_network_configuration_discovery.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_prohibited_applications_spawning_cmd_exe.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_psexec_with_accepteula_flag.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_rclone_command_line_usage.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_regasm_spawning_a_process.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_regasm_with_network_connection.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_regasm_with_no_command_line_arguments.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_regsvcs_spawning_a_process.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_regsvcs_with_network_connection.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_regsvcs_with_no_command_line_arguments.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_regsvr32_application_control_bypass.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_renamed_7_zip.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_renamed_psexec.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_renamed_rclone.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_renamed_winrar.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_rundll32_application_control_bypass___advpack.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_rundll32_application_control_bypass___setupapi.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_rundll32_application_control_bypass___syssetup.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_rundll32_inline_hta_execution.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_sharphound_command_line_arguments.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_sharphound_file_modifications.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

detect_sharphound_usage.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_use_of_cmd_exe_to_launch_script_interpreters.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

detect_wmi_event_subscription_persistence.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

disable_amsi_through_registry.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

disable_defender_antivirus_registry.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

disable_defender_blockatfirstseen_feature.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

disable_defender_enhanced_notification.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

disable_defender_mpengine_registry.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

disable_defender_spynet_reporting.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

disable_defender_submit_samples_consent_feature.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

disable_etw_through_registry.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

disable_logs_using_wevtutil.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

disable_registry_tool.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

disable_schedule_task.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

disable_security_logs_using_minint_registry.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

disable_show_hidden_files.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

disable_uac_remote_restriction.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

disable_windows_app_hotkeys.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

disable_windows_behavior_monitoring.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

disable_windows_smartscreen_protection.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

disabled_kerberos_pre_authentication_discovery_with_powerview.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

disabling_cmd_application.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

disabling_controlpanel.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

disabling_defender_services.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

disabling_firewall_with_netsh.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

disabling_folderoptions_windows_feature.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

disabling_net_user_account.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

disabling_norun_windows_app.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

disabling_remote_user_account_control.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

disabling_systemrestore_in_registry.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

disabling_task_manager.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

dllhost_with_no_command_line_arguments_with_network.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

dns_exfiltration_using_nslookup_app.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

domain_account_discovery_with_dsquery.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

domain_account_discovery_with_net_app.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

domain_account_discovery_with_wmic.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

domain_controller_discovery_with_nltest.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

domain_controller_discovery_with_wmic.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

domain_group_discovery_with_adsisearcher.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

domain_group_discovery_with_dsquery.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

domain_group_discovery_with_net.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

domain_group_discovery_with_wmic.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

download_files_using_telegram.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

drop_icedid_license_dat.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

dsquery_domain_discovery.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

dump_lsass_via_comsvcs_dll.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

dump_lsass_via_procdump.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

elevated_group_discovery_with_net.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

elevated_group_discovery_with_powerview.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

elevated_group_discovery_with_wmic.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

enable_rdp_in_other_port_number.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

enable_wdigest_uselogoncredential_registry.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

enumerate_users_local_group_using_telegram.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

esentutl_sam_copy.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

etw_registry_disabled.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

eventvwr_uac_bypass.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

excel_spawning_powershell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

excel_spawning_windows_script_host.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

excessive_attempt_to_disable_services.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

excessive_file_deletion_in_windefender_folder.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

excessive_number_of_service_control_start_as_disabled.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

excessive_number_of_taskhost_processes.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

excessive_service_stop_attempt.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

excessive_usage_of_cacls_app.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

excessive_usage_of_net_app.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

excessive_usage_of_nslookup_app.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

excessive_usage_of_sc_service_utility.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

excessive_usage_of_taskkill.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

executable_file_written_in_administrative_smb_share.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

executables_or_script_creation_in_suspicious_path.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

execute_javascript_with_jscript_com_clsid.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

execution_of_file_with_multiple_extensions.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

extraction_of_registry_hives.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

file_with_samsam_extension.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

firewall_allowed_program_enable.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

fodhelper_uac_bypass.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

fsutil_zeroing_file.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

get_addefaultdomainpasswordpolicy_with_powershell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

get_aduser_with_powershell_script_block.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

get_aduser_with_powershell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

get_aduserresultantpasswordpolicy_with_powershell_script_block.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

get_aduserresultantpasswordpolicy_with_powershell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

get_backup_logs_for_endpoint.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

get_domainpolicy_with_powershell_script_block.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

get_domainpolicy_with_powershell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

get_domaintrust_with_powershell_script_block.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

get_domaintrust_with_powershell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

get_domainuser_with_powershell_script_block.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

get_domainuser_with_powershell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

get_foresttrust_with_powershell_script_block.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

get_foresttrust_with_powershell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

get_logon_rights_modifications_for_endpoint.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

get_logon_rights_modifications_for_user.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

get_notable_history.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

get_parent_process_info.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

get_process_file_activity.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

get_process_info.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

get_process_information_for_port_activity.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

get_process_responsible_for_the_dns_traffic.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

get_sysmon_wmi_activity_for_host.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

get_wmiobject_group_discovery_with_script_block_logging.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

get_wmiobject_group_discovery.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

getadcomputer_with_powershell_script_block.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

getadcomputer_with_powershell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

getadgroup_with_powershell_script_block.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

getadgroup_with_powershell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

getcurrent_user_with_powershell_script_block.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

getcurrent_user_with_powershell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

getdomaincomputer_with_powershell_script_block.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

getdomaincomputer_with_powershell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

getdomaincontroller_with_powershell_script_block.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

getdomaincontroller_with_powershell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

getdomaingroup_with_powershell_script_block.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

getdomaingroup_with_powershell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

getlocaluser_with_powershell_script_block.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

getlocaluser_with_powershell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

getnettcpconnection_with_powershell_script_block.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

getnettcpconnection_with_powershell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

getwmiobject_ds_computer_with_powershell_script_block.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

getwmiobject_ds_computer_with_powershell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

getwmiobject_ds_group_with_powershell_script_block.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

getwmiobject_ds_group_with_powershell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

getwmiobject_ds_user_with_powershell_script_block.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

getwmiobject_ds_user_with_powershell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

getwmiobject_user_account_with_powershell_script_block.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

getwmiobject_user_account_with_powershell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

gpupdate_with_no_command_line_arguments_with_network.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

hide_user_account_from_sign_in_screen.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

hiding_files_and_directories_with_attrib_exe.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

high_frequency_copy_of_files_in_network_share.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

high_process_termination_frequency.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

hunting_for_log4shell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

icacls_deny_command.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

icacls_grant_command.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

icedid_exfiltrated_archived_file_creation.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

identify_systems_using_remote_desktop.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

impacket_lateral_movement_commandline_parameters.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

interactive_session_on_remote_endpoint_with_powershell.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

investigate_failed_logins_for_multiple_destinations.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

investigate_pass_the_hash_attempts.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

investigate_pass_the_ticket_attempts.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

investigate_previous_unseen_user.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

investigate_successful_remote_desktop_authentications.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

java_class_file_download_by_java_user_agent.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

jscript_execution_using_cscript_app.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

kerberoasting_spn_request_with_rc4_encryption.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

kerberos_pre_authentication_flag_disabled_with_powershell.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

known_services_killed_by_ransomware.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_add_files_in_known_crontab_directories.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_add_user_account.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_at_allow_config_file_creation.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_at_application_execution.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_change_file_owner_to_root.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_common_process_for_elevation_control.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_dd_file_overwrite.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_doas_conf_file_creation.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_doas_tool_execution.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_edit_cron_table_parameter.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_file_created_in_kernel_driver_directory.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_file_creation_in_init_boot_directory.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_file_creation_in_profile_directory.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_insert_kernel_module_using_insmod_utility.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_install_kernel_module_using_modprobe_utility.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_java_spawning_shell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_nopasswd_entry_in_sudoers_file.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_pkexec_privilege_escalation.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_possible_access_or_modification_of_sshd_config_file.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_possible_access_to_credential_files.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_possible_access_to_sudoers_file.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_possible_append_command_to_at_allow_config_file.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_possible_append_command_to_profile_config_file.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_possible_cronjob_modification_with_editor.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_possible_ssh_key_file_creation.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_preload_hijack_library_calls.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_service_file_created_in_systemd_directory.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_service_restarted.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_service_started_or_enabled.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_setuid_using_chmod_utility.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_setuid_using_setcap_utility.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_sudo_or_su_execution.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_sudoers_tmp_file_creation.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_system_network_discovery.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

linux_visudo_utility_execution.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

loading_of_dynwrapx_module.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

local_account_discovery_with_net.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

local_account_discovery_with_wmic.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

log4shell_cve_2021_44228_exploitation.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

logon_script_event_trigger_execution.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

mailsniper_invoke_functions.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

malicious_inprocserver32_modification.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

malicious_powershell_executed_as_a_service.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

malicious_powershell_process___encoded_command.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

malicious_powershell_process___execution_policy_bypass.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

malicious_powershell_process_with_obfuscation_techniques.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

mimikatz_passtheticket_commandline_parameters.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

mmc_exe_lolbas_execution_process_spawn.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

modification_of_wallpaper.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

modify_acl_permission_to_files_or_folder.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

monitor_registry_keys_for_print_monitors.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

monitor_successful_backups.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

monitor_unsuccessful_backups.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ms_scripting_process_loading_ldap_module.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

ms_scripting_process_loading_wmi_module.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

msbuild_suspicious_spawned_by_script_process.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

mshta_spawning_rundll32_or_regsvr32_process.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

mshtml_module_load_in_office_product.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

msi_module_loaded_by_non_system_binary.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

msmpeng_application_dll_side_loading.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

multiple_users_attempting_to_authenticate_using_explicit_credentials.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

multiple_users_failing_to_authenticate_from_host_using_kerberos.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

multiple_users_failing_to_authenticate_from_host_using_ntlm.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

multiple_users_failing_to_authenticate_from_process.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

multiple_users_remotely_failing_to_authenticate_from_host.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

net_localgroup_discovery.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

net_profiler_uac_bypass.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

network_connection_discovery_arp.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

network_connection_discovery_net.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

network_connection_discovery_netstat.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

network_discovery_using_route_windows_app.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

nishang_powershelltcponeline.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

nltest_domain_trust_discovery.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

non_chrome_process_accessing_chrome_default_dir.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

non_firefox_process_access_firefox_profile_dir.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

ntdsutil_export_ntds.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

office_application_drop_executable.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

office_application_spawn_regsvr32_process.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

office_application_spawn_rundll32_process.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

office_document_creating_schedule_task.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

office_document_executing_macro_code.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

office_document_spawned_child_process_to_download.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

office_product_spawn_cmd_process.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

office_product_spawning_bitsadmin.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

office_product_spawning_certutil.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

office_product_spawning_mshta.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

office_product_spawning_rundll32_with_no_dll.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

office_product_spawning_wmic.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

office_product_writing_cab_or_inf.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

office_spawning_control.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

outbound_network_connection_from_java_using_default_ports.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

overwriting_accessibility_binaries.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

password_policy_discovery_with_net.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

permission_modification_using_takeown_app.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

petitpotam_network_share_access_request.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

petitpotam_suspicious_kerberos_tgt_request.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ping_sleep_batch_command.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

possible_browser_pass_view_parameter.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

possible_lateral_movement_powershell_spawn.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

potentially_malicious_code_on_commandline.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

powershell_4104_hunting.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

powershell___connect_to_internet_with_hidden_window.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

powershell_creating_thread_mutex.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

powershell_disable_security_monitoring.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

powershell_domain_enumeration.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

powershell_enable_smb1protocol_feature.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

powershell_execute_com_object.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

powershell_fileless_process_injection_via_getprocaddress.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

powershell_fileless_script_contains_base64_encoded_content.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

powershell_get_localgroup_discovery_with_script_block_logging.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

powershell_get_localgroup_discovery.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

powershell_processing_stream_of_data.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

powershell_remote_thread_to_known_windows_process.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

powershell_remove_windows_defender_directory.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

powershell_start_bitstransfer.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

powershell_using_memory_as_backing_store.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

powershell_windows_defender_exclusion_commands.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

prevent_automatic_repair_mode_using_bcdedit.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

previously_seen_command_line_arguments.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

previously_seen_running_windows_services_update.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

previously_seen_running_windows_services.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

previously_seen_zoom_child_processes_initial.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

previously_seen_zoom_child_processes_update.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

print_spooler_adding_a_printer_driver.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

print_spooler_failed_to_load_a_plug_in.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

process_creating_lnk_file_in_suspicious_location.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

process_deleting_its_process_file_path.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

process_execution_via_wmi.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

process_kill_base_on_file_path.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

process_writing_dynamicwrapperx.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

processes_launching_netsh.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

ransomware_notes_bulk_creation.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

recon_avproduct_through_pwh_or_wmi.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

recon_using_wmi_class.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

recursive_delete_of_directory_in_batch_cmd.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

reg_exe_manipulating_windows_services_registry_keys.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

registry_keys_for_creating_shim_databases.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

registry_keys_used_for_persistence.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

registry_keys_used_for_privilege_escalation.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

regsvr32_silent_and_install_param_dll_loading.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

regsvr32_with_known_silent_switch_cmdline.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

remcos_client_registry_install_entry.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

remcos_rat_file_creation_in_remcos_folder.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

remote_process_instantiation_via_dcom_and_powershell_script_block.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

remote_process_instantiation_via_dcom_and_powershell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

remote_process_instantiation_via_winrm_and_powershell_script_block.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

remote_process_instantiation_via_winrm_and_powershell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

remote_process_instantiation_via_winrm_and_winrs.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

remote_process_instantiation_via_wmi_and_powershell_script_block.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

remote_process_instantiation_via_wmi_and_powershell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

remote_process_instantiation_via_wmi.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

remote_system_discovery_with_adsisearcher.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

remote_system_discovery_with_dsquery.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

remote_system_discovery_with_net.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

remote_system_discovery_with_wmic.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

remote_wmi_command_attempt.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

resize_shadowstorage_volume.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

revil_common_exec_parameter.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

revil_registry_entry.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

rubeus_command_line_parameters.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

rubeus_kerberos_ticket_exports_through_winlogon_access.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

runas_execution_in_commandline.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

rundll32_control_rundll_hunt.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

rundll32_control_rundll_world_writable_directory.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

rundll32_create_remote_thread_to_a_process.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

rundll32_createremotethread_in_browser.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

rundll32_dnsquery.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

rundll32_lockworkstation.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

rundll32_process_creating_exe_dll_files.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

rundll32_shimcache_flush.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

rundll32_with_no_command_line_arguments_with_network.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

rundll_loading_dll_by_ordinal.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

ryuk_test_files_detected.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

ryuk_wake_on_lan_command.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

sam_database_file_access_attempt.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

samsam_test_file_write.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

sc_exe_manipulating_windows_services.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

schcache_change_by_app_connect_and_create_adsi_object.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

schedule_task_with_http_command_arguments.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

schedule_task_with_rundll32_command_trigger.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

scheduled_task_creation_on_remote_endpoint_using_at.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

scheduled_task_deleted_or_created_via_cmd.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

scheduled_task_initiation_on_remote_endpoint.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

schtasks_run_task_on_demand.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

schtasks_scheduling_job_on_remote_system.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

schtasks_used_for_forcing_a_reboot.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

screensaver_event_trigger_execution.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

script_execution_via_wmi.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

sdclt_uac_bypass.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

sdelete_application_execution.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

searchprotocolhost_with_no_command_line_with_network.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

secretdumps_offline_ntds_dumping_tool.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

serviceprincipalnames_discovery_with_powershell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

serviceprincipalnames_discovery_with_setspn.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

services_escalate_exe.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

services_exe_lolbas_execution_process_spawn.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

shim_database_file_creation.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

shim_database_installation_with_suspicious_parameters.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

short_lived_scheduled_task.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

short_lived_windows_accounts.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

silentcleanup_uac_bypass.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

single_letter_process_on_endpoint.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

slui_runas_elevated.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

slui_spawning_a_process.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

spoolsv_spawning_rundll32.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

spoolsv_suspicious_loaded_modules.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

spoolsv_suspicious_process_access.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

spoolsv_writing_a_dll___sysmon.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

spoolsv_writing_a_dll.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

sqlite_module_in_temp_folder.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

ssa___anomalous_usage_of_archive_tools.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___attempt_to_delete_services.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___attempt_to_disable_services.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___attempted_credential_dump_from_registry_via_reg_exe.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___bcdedit_failure_recovery_modification.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___clear_unallocated_sector_using_cipher_app.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___delete_a_net_user.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___deny_permission_using_cacls_utility.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___detect_dump_lsass_memory_using_comsvcs.yml

…

ssa___detect_rclone_command_line_usage.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___disable_net_user_account.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___dns_exfiltration_using_nslookup_app.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___fsutil_zeroing_file.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___grant_permission_using_cacls_utility.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___hiding_files_and_directories_with_attrib_exe.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___modify_acls_permission_of_files_or_folders.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___prohibited_apps_spawning_cmdprompt.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___resize_shadowstorage_volume.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___sdelete_application_execution.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___system_process_running_from_unexpected_location.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___unusual_lolbas_in_short_period_of_time.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___wbadmin_delete_system_backups.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___wevtutil_usage_to_clear_logs.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___wevtutil_usage_to_disable_logs.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___windows_bits_job_persistence.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___windows_bitsadmin_download_file.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___windows_certutil_decode_file.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___windows_certutil_urlcache_download.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___windows_certutil_verifyctl_download.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___windows_curl_upload_to_remote_destination.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___windows_diskshadow_proxy_execution.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___windows_eventvwr_uac_bypass.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___windows_mshta_child_process.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___windows_mshta_command_line_url.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___windows_mshta_inline_hta_execution.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___windows_powershell_connect_to_internet_with_hidden_window.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___windows_powershell_downloadfile.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___windows_powershell_start_bitstransfer.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___windows_rasautou_dll_execution.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

ssa___windows_rundll32_inline_hta_execution.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

start_up_during_safe_mode_boot.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_computer_account_name_change.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_copy_on_system32.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_dllhost_no_command_line_arguments.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_driver_loaded_path.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_event_log_service_behavior.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

suspicious_gpupdate_no_command_line_arguments.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_icedid_rundll32_cmdline.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_image_creation_in_appdata_folder.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

suspicious_kerberos_service_ticket_request.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_linux_discovery_commands.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_microsoft_workflow_compiler_rename.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_microsoft_workflow_compiler_usage.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_msbuild_path.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_msbuild_rename.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_msbuild_spawn.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_mshta_child_process.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_mshta_spawn.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_process_dns_query_known_abuse_web_services.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_process_file_path.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_process_with_discord_dns_query.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_reg_exe_process.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_regsvr32_register_suspicious_path.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_rundll32_dllregisterserver.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_rundll32_plugininit.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_rundll32_startw.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_rundll32_with_no_command_line_arguments.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_scheduled_task_from_public_directory.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_searchprotocolhost_no_command_line_arguments.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_ticket_granting_ticket_request.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_wav_file_in_appdata_folder.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

suspicious_wevtutil_usage.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

suspicious_writes_to_windows_recycle_bin.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

svchost_exe_lolbas_execution_process_spawn.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

system_info_gathering_using_dxdiag_application.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

system_information_discovery_detection.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

system_processes_run_from_unexpected_locations.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

system_user_discovery_with_query.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

system_user_discovery_with_whoami.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

systems_ready_for_spectre_meltdown_windows_patch.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

time_provider_persistence_registry.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

trickbot_named_pipe.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

uac_bypass_mmc_load_unsigned_dll.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

uac_bypass_with_colorui_com_object.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

unified_messaging_service_spawning_a_process.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

uninstall_app_using_msiexec.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

unload_sysmon_filter_driver.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

unloading_amsi_via_reflection.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

unusual_number_of_kerberos_service_tickets_requested.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

user_discocvery_with_env_vars_powershell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

user_discovery_with_env_vars_powershell_script_block.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

usn_journal_deletion.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

vbscript_execution_using_wscript_app.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

verclsid_clsid_execution.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

w3wp_spawning_shell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

wbadmin_delete_system_backups.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

wbemprox_com_object_execution.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

wermgr_process_connecting_to_ip_check_web_services.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

wermgr_process_create_executable_file.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

wermgr_process_spawned_cmd_or_powershell_process.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

wget_download_and_bash_execution.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

windows_adfind_exe.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

windows_curl_download_to_suspicious_path.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

windows_curl_upload_to_remote_destination.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

windows_defender_exclusion_registry_entry.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

windows_disable_memory_crash_dump.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

windows_disableantispyware_reg.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

windows_diskcryptor_usage.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

windows_diskshadow_proxy_execution.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

windows_dism_remove_defender.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

windows_dotnet_binary_in_non_standard_path.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

windows_event_for_service_disabled.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

windows_event_log_cleared.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

windows_excessive_disabled_services_event.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

windows_file_without_extension_in_critical_folder.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

windows_high_file_deletion_frequency.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

windows_hunting_system_account_targeting_lsass.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

windows_installutil_credential_theft.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

windows_installutil_in_non_standard_path.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

windows_installutil_remote_network_connection.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

windows_installutil_uninstall_option_with_network.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

windows_installutil_uninstall_option.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

windows_installutil_url_in_command_line.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

windows_modify_show_compress_color_and_info_tip_registry.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

windows_nirsoft_advancedrun.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

windows_nirsoft_utilities.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

windows_non_system_account_targeting_lsass.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

windows_possible_credential_dumping.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

windows_process_with_namedpipe_commandline.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

windows_raccine_scheduled_task_deletion.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

windows_rasautou_dll_execution.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

windows_raw_access_to_disk_volume_partition.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

windows_raw_access_to_master_boot_record_drive.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

windows_remote_assistance_spawning_process.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

windows_schtasks_create_run_as_system.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

windows_security_account_manager_stopped.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

windows_service_created_with_suspicious_service_path.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

windows_service_created_within_public_path.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

windows_service_creation_on_remote_endpoint.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

windows_service_creation_using_registry_entry.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

windows_service_initiation_on_remote_endpoint.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

windows_updates_install_failures.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

windows_updates_install_successes.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

windows_wmi_process_call_create.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

winevent_scheduled_task_created_to_spawn_shell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

winevent_scheduled_task_created_within_public_path.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

winevent_windows_task_scheduler_event_action_started.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

winhlp32_spawning_a_process.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

winword_spawning_cmd.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

winword_spawning_powershell.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

winword_spawning_windows_script_host.yml

Updated detection files with recommended TA list.

2022-03-10 11:46:19 +05:50

wmi_permanent_event_subscription___sysmon.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

wmi_recon_running_process_or_services.yml

Revert "Refactored security content"

2022-03-04 15:13:04 -05:00

wmic_group_discovery.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

wmic_noninteractive_app_uninstallation.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

wmic_xsl_execution_via_url.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

wmiprsve_exe_lolbas_execution_process_spawn.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

wscript_or_cscript_suspicious_child_process.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

wsmprovhost_exe_lolbas_execution_process_spawn.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

wsreset_uac_bypass.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

xmrig_driver_loaded.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00

xsl_script_execution_with_wmic.yml

Ran enrichment tool to update all DataModel and required_fields parts of yml files with most recent and correct codebase. More specifically, ran this tool after correcting some searches with only included a Model, not Model.Submodel declaration in their search.

2022-03-09 14:35:48 -08:00