mhaag-spl dc319b6eda Spearphishing Attachments detections

2021-04-21 10:16:49 -06:00

..

.untested

detection/experimental folder for untested detections

2020-11-06 10:37:11 -08:00

child_processes_of_spoolsv_exe.yml

WIP

2021-03-10 14:44:44 +01:00

detect_baron_samedit_cve_2021_3156_segfault.yml

WIP

2021-03-10 14:44:44 +01:00

detect_baron_samedit_cve_2021_3156_via_osquery.yml

WIP

2021-03-10 14:44:44 +01:00

detect_baron_samedit_cve_2021_3156.yml

WIP

2021-03-10 14:44:44 +01:00

detect_outlook_exe_writing_a_zip_file.yml

Spearphishing Attachments detections

2021-04-21 10:16:49 -06:00

detect_rare_executables.yml

fixed merging issues

2021-03-11 19:03:54 +01:00

detection_of_tools_built_by_nirsoft.yml

WIP

2021-03-10 14:44:44 +01:00

first_time_seen_running_windows_service.yml

add required fields and check

2021-03-11 09:11:48 +01:00

macos___re_opened_applications.yml

WIP

2021-03-10 14:44:44 +01:00

processes_tapping_keyboard_events.yml

WIP

2021-03-10 14:44:44 +01:00

remote_desktop_process_running_on_system.yml

WIP

2021-03-10 14:44:44 +01:00

spike_in_file_writes.yml

WIP

2021-03-10 14:44:44 +01:00

sunburst_correlation_dll_and_network_event.yml

add required fields and check

2021-03-11 09:11:48 +01:00

suspicious_curl_network_connection.yml

Update Certutil

2021-03-24 15:15:47 -06:00

suspicious_plistbuddy_usage_via_osquery.yml

add required fields

2021-03-11 09:32:33 +01:00

suspicious_plistbuddy_usage.yml

add required fields

2021-03-11 09:32:33 +01:00

suspicious_sqlite3_lsquarantine_behavior.yml

add required fields

2021-03-11 09:32:33 +01:00

unusually_long_command_line___mltk.yml

fixed merging issues

2021-03-11 19:03:54 +01:00

windows_adfind_exe.yml

Domain Trust Discovery

2021-03-31 13:24:32 -06:00

wmi_permanent_event_subscription.yml

WIP

2021-03-10 14:44:44 +01:00

wmi_temporary_event_subscription.yml

WIP

2021-03-10 14:44:44 +01:00