admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
fixremcosfix
splunk-security_content/detections/endpoint
T
History
Bhavin Patel 4c73ac74ea Branch was auto-updated.
2021-09-27 11:01:55 -07:00
..
7zip_commandline_to_smb_share_path.yml
updating docs and package bits [ci skip]
2021-08-20 22:22:11 +00:00
access_lsass_memory_for_dump_creation.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
account_discovery_with_net_app.yml
Added detection testing service results inAccount Discovery With Net App
2021-09-16 16:02:23 +00:00
add_defaultuser_and_password_in_registry.yml
updating docs and package bits [ci skip]
2021-09-09 19:07:07 +00:00
adsisearcher_account_discovery.yml
minor metdata fixes
2021-09-21 11:08:13 -04:00
all_backup_logs_for_host.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
allow_file_and_printing_sharing_in_firewall.yml
Added detection testing service results inAllow File And Printing Sharing In Firewall
2021-09-21 19:29:11 +00:00
allow_inbound_traffic_by_firewall_rule_registry.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
allow_inbound_traffic_in_firewall_rule.yml
updating docs and package bits [ci skip]
2021-08-20 22:22:11 +00:00
allow_network_discovery_in_firewall.yml
Added detection testing service results inAllow Network Discovery In Firewall
2021-09-21 19:41:07 +00:00
allow_operation_with_consent_admin.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
anomalous_usage_of_7zip.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
any_powershell_downloadfile.yml
Added detection testing service results inAny Powershell DownloadFile
2021-09-21 19:31:26 +00:00
any_powershell_downloadstring.yml
Added detection testing service results inAny Powershell DownloadString
2021-09-21 19:28:58 +00:00
attacker_tools_on_endpoint.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
attempt_to_add_certificate_to_untrusted_store.yml
updates
2021-09-16 09:42:56 -06:00
attempt_to_stop_security_service.yml
Added detection testing service results inAttempt To Stop Security Service
2021-09-21 19:28:19 +00:00
attempted_credential_dump_from_registry_via_reg_exe.yml
Added detection testing service results inAttempted Credential Dump From Registry via Reg exe
2021-09-16 16:07:36 +00:00
auto_admin_logon_registry_entry.yml
updating docs and package bits [ci skip]
2021-09-09 19:07:07 +00:00
baseline_of_command_line_length___mltk.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
batch_file_write_to_system32.yml
Added detection testing service results inBatch File Write to System32
2021-09-21 19:27:07 +00:00
bcdedit_command_back_to_normal_mode_boot.yml
updating docs and package bits [ci skip]
2021-09-09 19:07:07 +00:00
bcdedit_failure_recovery_modification.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
bits_job_persistence.yml
Added detection testing service results inBITS Job Persistence
2021-09-16 16:41:29 +00:00
bitsadmin_download_file.yml
Added detection testing service results inBITSAdmin Download File
2021-09-16 16:45:19 +00:00
certutil_download_with_urlcache_and_split_arguments.yml
Added detection testing service results inCertUtil Download With URLCache and Split Arguments
2021-09-21 19:43:19 +00:00
certutil_download_with_verifyctl_and_split_arguments.yml
Added detection testing service results inCertUtil Download With VerifyCtl and Split Arguments
2021-09-21 19:28:43 +00:00
certutil_exe_certificate_extraction.yml
updating docs and package bits [ci skip]
2021-08-27 21:52:55 +00:00
certutil_with_decode_argument.yml
Added detection testing service results inCertUtil With Decode Argument
2021-09-21 19:24:28 +00:00
change_to_safe_mode_with_network_config.yml
updating docs and package bits [ci skip]
2021-09-09 19:07:07 +00:00
chcp_command_execution.yml
rename
2021-08-18 13:49:15 -07:00
check_elevated_cmd_using_whoami.yml
Added detection testing service results inCheck Elevated CMD using whoami
2021-09-16 15:17:07 +00:00
clear_unallocated_sector_using_cipher_app.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
clop_common_exec_parameter.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
clop_ransomware_known_service_name.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
cmd_echo_pipe___escalation.yml
macro'd reg cmd
2021-08-17 12:09:31 -06:00
cmdline_tool_not_executed_in_cmd_shell.yml
Added detection testing service results inCmdline Tool Not Executed In CMD Shell
2021-09-16 15:43:53 +00:00
cmlua_or_cmstplua_uac_bypass.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
cobalt_strike_named_pipes.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
common_ransomware_extensions.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
common_ransomware_notes.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
conti_common_exec_parameter.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
control_loading_from_world_writable_directory.yml
updating docs and package bits [ci skip]
2021-09-09 19:07:07 +00:00
count_of_assets_by_category.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
create_local_admin_accounts_using_net_exe.yml
Update create_local_admin_accounts_using_net_exe.yml
2021-09-17 05:46:53 -06:00
create_or_delete_windows_shares_using_net_exe.yml
Added detection testing service results inCreate or delete windows shares using net exe
2021-09-16 16:52:59 +00:00
create_remote_thread_in_shell_application.yml
rename
2021-08-18 13:49:15 -07:00
create_remote_thread_into_lsass.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
create_service_in_suspicious_file_path.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
creation_of_lsass_dump_with_taskmgr.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
creation_of_shadow_copy_with_wmic_and_powershell.yml
Added detection testing service results inCreation of Shadow Copy with wmic and powershell
2021-09-16 16:57:25 +00:00
creation_of_shadow_copy.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
credential_dumping_via_copy_command_from_shadow_copy.yml
Added detection testing service results inCredential Dumping via Copy Command from Shadow Copy
2021-09-16 17:07:21 +00:00
credential_dumping_via_symlink_to_shadow_copy.yml
Added detection testing service results inCredential Dumping via Symlink to Shadow Copy
2021-09-16 17:08:15 +00:00
delete_shadowcopy_with_powershell.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
deleting_of_net_users.yml
macro'd net
2021-08-17 13:56:57 -06:00
deleting_shadow_copies.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
detect_activity_related_to_pass_the_hash_attacks.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
detect_azurehound_command_line_arguments.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
detect_azurehound_file_modifications.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
detect_computer_changed_with_anonymous_account.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
detect_copy_of_shadowcopy_with_script_block_logging.yml
Added detection testing service results inDetect Copy of ShadowCopy with Script Block Logging
2021-09-02 20:24:20 +00:00
detect_credential_dumping_through_lsass_access.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
detect_empire_with_powershell_script_block_logging.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
detect_excessive_account_lockouts_from_endpoint.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
detect_excessive_user_account_lockouts.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
detect_exchange_web_shell.yml
updating docs and package bits [ci skip]
2021-09-09 19:07:07 +00:00
detect_html_help_renamed.yml
updates
2021-09-16 09:42:56 -06:00
detect_html_help_spawn_child_process.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
detect_html_help_url_in_command_line.yml
hh, mshta, and psexec
2021-09-16 11:13:15 -06:00
detect_html_help_using_infotech_storage_handlers.yml
hh, mshta, and psexec
2021-09-16 11:13:15 -06:00
detect_mimikatz_using_loaded_images.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
detect_mimikatz_with_powershell_script_block_logging.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
detect_mshta_inline_hta_execution.yml
hh, mshta, and psexec
2021-09-16 11:13:15 -06:00
detect_mshta_renamed.yml
updates
2021-09-16 09:42:56 -06:00
detect_mshta_url_in_command_line.yml
hh, mshta, and psexec
2021-09-16 11:13:15 -06:00
detect_new_local_admin_account.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
detect_path_interception_by_creation_of_program_exe.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
detect_processes_used_for_system_network_configuration_discovery.yml
Branch was auto-updated.
2021-07-28 19:22:22 +00:00
detect_prohibited_applications_spawning_cmd_exe.yml
macro'd reg cmd
2021-08-17 12:09:31 -06:00
detect_psexec_with_accepteula_flag.yml
Added detection testing service results inDetect PsExec With accepteula Flag
2021-09-16 18:19:16 +00:00
detect_rclone_command_line_usage.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
detect_regasm_spawning_a_process.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
detect_regasm_with_network_connection.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
detect_regasm_with_no_command_line_arguments.yml
regsvcs regasm
2021-09-20 11:02:20 -06:00
detect_regsvcs_spawning_a_process.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
detect_regsvcs_with_network_connection.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
detect_regsvcs_with_no_command_line_arguments.yml
Added detection testing service results inDetect regsvcs with no Command Line Arguments
2021-09-20 17:21:26 +00:00
detect_regsvr32_application_control_bypass.yml
macro'd regsvr32
2021-08-17 13:27:48 -06:00
detect_remcos_control_panel_license_dns_query.yml
fixes
2021-09-24 15:50:05 -07:00
detect_renamed_7_zip.yml
Added detection testing service results inDetect Renamed 7-Zip
2021-09-20 18:57:34 +00:00
detect_renamed_psexec.yml
Added detection testing service results inDetect Renamed PSExec
2021-09-20 18:57:27 +00:00
detect_renamed_rclone.yml
Added detection testing service results inDetect Renamed RClone
2021-09-20 18:59:08 +00:00
detect_renamed_winrar.yml
fixes
2021-09-16 11:36:51 -06:00
detect_rundll32_application_control_bypass___advpack.yml
macrod rundll32
2021-08-17 13:21:24 -06:00
detect_rundll32_application_control_bypass___setupapi.yml
macrod rundll32
2021-08-17 13:21:24 -06:00
detect_rundll32_application_control_bypass___syssetup.yml
macrod rundll32
2021-08-17 13:21:24 -06:00
detect_rundll32_inline_hta_execution.yml
macrod rundll32
2021-08-17 13:21:24 -06:00
detect_sharphound_command_line_arguments.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
detect_sharphound_file_modifications.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
detect_sharphound_usage.yml
removing originalfilename artifacts
2021-09-20 12:37:32 -06:00
detect_use_of_cmd_exe_to_launch_script_interpreters.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
detect_wmi_event_subscription_persistence.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
disable_amsi_through_registry.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
disable_etw_through_registry.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
disable_logs_using_wevtutil.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
disable_registry_tool.yml
add observable and clean up
2021-08-31 11:06:47 -07:00
disable_show_hidden_files.yml
add observable and clean up
2021-08-31 11:06:47 -07:00
disable_windows_app_hotkeys.yml
add observable and clean up
2021-08-31 11:06:47 -07:00
disable_windows_behavior_monitoring.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
disable_windows_smartscreen_protection.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
disabling_cmd_application.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
disabling_controlpanel.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
disabling_firewall_with_netsh.yml
macro'd netsh
2021-08-17 15:14:35 -06:00
disabling_folderoptions_windows_feature.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
disabling_net_user_account.yml
macro'd net
2021-08-17 13:56:57 -06:00
disabling_norun_windows_app.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
disabling_remote_user_account_control.yml
remcos_agent
2021-09-24 09:20:07 +02:00
disabling_systemrestore_in_registry.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
disabling_task_manager.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
dllhost_with_no_command_line_arguments_with_network.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
dns_exfiltration_using_nslookup_app.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
domain_account_discovery_with_dsquery.yml
minor metdata fixes
2021-09-21 11:08:13 -04:00
domain_account_discovery_with_net_app.yml
Branch was auto-updated.
2021-09-21 09:58:14 -07:00
domain_account_discovery_with_wmic.yml
minor metdata fixes
2021-09-21 11:08:13 -04:00
domain_controller_discovery_with_nltest.yml
adding required fields
2021-09-10 13:04:57 -04:00
domain_controller_discovery_with_wmic.yml
adding required fields
2021-09-10 13:04:57 -04:00
domain_group_discovery_with_adsisearcher.yml
adding required fields
2021-09-10 13:17:48 -04:00
domain_group_discovery_with_dsquery.yml
adding required fields
2021-09-10 13:17:48 -04:00
domain_group_discovery_with_net.yml
adding required fields
2021-09-10 13:17:48 -04:00
domain_group_discovery_with_wmic.yml
adding required fields
2021-09-10 13:17:48 -04:00
download_files_using_telegram.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
drop_icedid_license_dat.yml
Merge branch 'develop' into The-Haag-of-The-Storm
2021-09-03 07:10:38 -06:00
dsquery_domain_discovery.yml
May The Haag Be With You
2021-09-14 11:05:59 -06:00
dump_lsass_via_comsvcs_dll.yml
macrod rundll32
2021-08-17 13:21:24 -06:00
dump_lsass_via_procdump.yml
removing originalfilename artifacts
2021-09-20 12:37:32 -06:00
elevated_group_discovery_with_net.yml
adding required fields
2021-09-10 13:17:48 -04:00
elevated_group_discovery_with_powerview.yml
adding required fields
2021-09-10 13:17:48 -04:00
elevated_group_discovery_with_wmic.yml
adding required fields
2021-09-10 13:17:48 -04:00
enable_rdp_in_other_port_number.yml
macrod rundll32
2021-08-17 13:21:24 -06:00
enumerate_users_local_group_using_telegram.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
esentutl_sam_copy.yml
updating docs and package bits [ci skip]
2021-08-27 21:52:55 +00:00
eventvwr_uac_bypass.yml
rename
2021-08-18 13:49:15 -07:00
excel_spawning_powershell.yml
Merge branch 'develop' into The-Haag-of-The-Storm
2021-08-17 11:19:42 -06:00
excel_spawning_windows_script_host.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
excessive_attempt_to_disable_services.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
excessive_number_of_service_control_start_as_disabled.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
excessive_number_of_taskhost_processes.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
excessive_service_stop_attempt.yml
Added detection testing service results inExcessive Service Stop Attempt
2021-09-21 18:25:59 +00:00
excessive_usage_of_cacls_app.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
excessive_usage_of_net_app.yml
Added detection testing service results inExcessive Usage Of Net App
2021-09-21 18:14:10 +00:00
excessive_usage_of_nslookup_app.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
excessive_usage_of_sc_service_utility.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
excessive_usage_of_taskkill.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
executables_or_script_creation_in_suspicious_path.yml
remcos_agent
2021-09-24 09:20:07 +02:00
execute_javascript_with_jscript_com_clsid.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
execution_of_file_with_multiple_extensions.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
extraction_of_registry_hives.yml
Added detection testing service results inExtraction of Registry Hives
2021-09-17 12:32:04 +00:00
file_with_samsam_extension.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
first_time_seen_child_process_of_zoom.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
fodhelper_uac_bypass.yml
rename
2021-08-18 13:49:15 -07:00
fsutil_zeroing_file.yml
updating docs and package bits [ci skip]
2021-08-20 22:22:11 +00:00
get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
minor metdata fixes
2021-09-21 11:08:13 -04:00
get_addefaultdomainpasswordpolicy_with_powershell.yml
minor metdata fixes
2021-09-21 11:08:13 -04:00
get_aduser_with_powershell_script_block.yml
minor metdata fixes
2021-09-21 11:08:13 -04:00
get_aduser_with_powershell.yml
minor metdata fixes
2021-09-21 11:08:13 -04:00
get_aduserresultantpasswordpolicy_with_powershell_script_block.yml
minor metdata fixes
2021-09-21 11:08:13 -04:00
get_aduserresultantpasswordpolicy_with_powershell.yml
minor metdata fixes
2021-09-21 11:08:13 -04:00
get_backup_logs_for_endpoint.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
get_domainpolicy_with_powershell_script_block.yml
minor metdata fixes
2021-09-21 11:08:13 -04:00
get_domainpolicy_with_powershell.yml
minor metdata fixes
2021-09-21 11:08:13 -04:00
get_domaintrust_with_powershell_script_block.yml
Added detection testing service results inGet-DomainTrust with PowerShell Script Block
2021-09-08 02:04:03 +00:00
get_domaintrust_with_powershell.yml
Added detection testing service results inGet-DomainTrust with PowerShell
2021-09-08 02:27:22 +00:00
get_domainuser_with_powershell_script_block.yml
minor metdata fixes
2021-09-21 11:08:13 -04:00
get_domainuser_with_powershell.yml
minor metdata fixes
2021-09-21 11:08:13 -04:00
get_foresttrust_with_powershell_script_block.yml
Added detection testing service results inGet-ForestTrust with PowerShell Script Block
2021-09-07 21:50:40 +00:00
get_foresttrust_with_powershell.yml
Added detection testing service results inGet-ForestTrust with PowerShell
2021-09-08 02:26:36 +00:00
get_logon_rights_modifications_for_endpoint.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
get_logon_rights_modifications_for_user.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
get_notable_history.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
get_parent_process_info.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
get_process_file_activity.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
get_process_info.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
get_process_information_for_port_activity.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
get_process_responsible_for_the_dns_traffic.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
get_sysmon_wmi_activity_for_host.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
get_wmiobject_group_discovery_with_script_block_logging.yml
Added detection testing service results inGet WMIObject Group Discovery with Script Block Logging
2021-09-14 17:55:41 +00:00
get_wmiobject_group_discovery.yml
Added detection testing service results inGet WMIObject Group Discovery
2021-09-14 17:52:46 +00:00
getadcomputer_with_powershell_script_block.yml
adding required fields
2021-09-10 13:04:57 -04:00
getadcomputer_with_powershell.yml
adding required fields
2021-09-10 13:04:57 -04:00
getadgroup_with_powershell_script_block.yml
adding required fields
2021-09-10 13:17:48 -04:00
getadgroup_with_powershell.yml
adding required fields
2021-09-10 13:17:48 -04:00
getcurrent_user_with_powershell_script_block.yml
fixing message field
2021-09-14 11:54:58 -04:00
getcurrent_user_with_powershell.yml
fixing message field
2021-09-14 11:54:58 -04:00
getdomaincomputer_with_powershell_script_block.yml
adding required fields
2021-09-10 13:04:57 -04:00
getdomaincomputer_with_powershell.yml
adding required fields
2021-09-10 13:04:57 -04:00
getdomaincontroller_with_powershell_script_block.yml
adding required fields
2021-09-10 13:04:57 -04:00
getdomaincontroller_with_powershell.yml
adding required fields
2021-09-10 13:04:57 -04:00
getdomaingroup_with_powershell_script_block.yml
Merge branch 'AD_Discovery_TR-789_6' of github.com:splunk/security_content into AD_Discovery_TR-789_6
2021-09-10 13:31:21 -04:00
getdomaingroup_with_powershell.yml
adding required fields
2021-09-10 13:17:48 -04:00
getlocaluser_with_powershell_script_block.yml
updating docs and package bits [ci skip]
2021-09-09 19:07:07 +00:00
getlocaluser_with_powershell.yml
updating docs and package bits [ci skip]
2021-09-09 19:07:07 +00:00
getnettcpconnection_with_powershell_script_block.yml
Merge branch 'AD_Discovery_TR-789_8' of github.com:splunk/security_content into AD_Discovery_TR-789_8
2021-09-10 13:50:54 -04:00
getnettcpconnection_with_powershell.yml
updating required fields
2021-09-10 13:50:29 -04:00
getwmiobject_ds_computer_with_powershell_script_block.yml
adding required fields
2021-09-10 13:04:57 -04:00
getwmiobject_ds_computer_with_powershell.yml
adding required fields
2021-09-10 13:04:57 -04:00
getwmiobject_ds_group_with_powershell_script_block.yml
Merge branch 'AD_Discovery_TR-789_6' of github.com:splunk/security_content into AD_Discovery_TR-789_6
2021-09-10 13:31:21 -04:00
getwmiobject_ds_group_with_powershell.yml
Merge branch 'AD_Discovery_TR-789_6' of github.com:splunk/security_content into AD_Discovery_TR-789_6
2021-09-10 13:31:21 -04:00
getwmiobject_ds_user_with_powershell_script_block.yml
minor metdata fixes
2021-09-21 11:08:13 -04:00
getwmiobject_ds_user_with_powershell.yml
minor metdata fixes
2021-09-21 11:08:13 -04:00
getwmiobject_user_account_with_powershell_script_block.yml
updating docs and package bits [ci skip]
2021-09-09 19:07:07 +00:00
getwmiobject_user_account_with_powershell.yml
updating docs and package bits [ci skip]
2021-09-09 19:07:07 +00:00
gpupdate_with_no_command_line_arguments_with_network.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
hide_user_account_from_sign_in_screen.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
hiding_files_and_directories_with_attrib_exe.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
high_file_deletion_frequency.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
high_process_termination_frequency.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
icacls_deny_command.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
icacls_grant_command.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
icedid_exfiltrated_archived_file_creation.yml
rename
2021-08-18 13:49:15 -07:00
identify_systems_using_remote_desktop.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
investigate_failed_logins_for_multiple_destinations.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
investigate_pass_the_hash_attempts.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
investigate_pass_the_ticket_attempts.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
investigate_previous_unseen_user.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
investigate_successful_remote_desktop_authentications.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
jscript_execution_using_cscript_app.yml
Added detection testing service results inJscript Execution Using Cscript App
2021-09-15 13:59:55 +00:00
kerberoasting_spn_request_with_rc4_encryption.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
known_services_killed_by_ransomware.yml
updating docs and package bits [ci skip]
2021-09-09 19:07:07 +00:00
local_account_discovery_with_net.yml
updates
2021-09-17 05:56:19 -06:00
local_account_discovery_with_wmic.yml
Merge branch 'develop' into The-Haag-of-The-Storm
2021-09-17 05:52:44 -06:00
mailsniper_invoke_functions.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
malicious_powershell_executed_as_a_service.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
malicious_powershell_process___connect_to_internet_with_hidden_window.yml
Added detection testing service results inMalicious PowerShell Process - Connect To Internet With Hidden Window
2021-09-21 19:53:32 +00:00
malicious_powershell_process___encoded_command.yml
Added detection testing service results inMalicious PowerShell Process - Encoded Command
2021-09-21 19:56:36 +00:00
malicious_powershell_process___execution_policy_bypass.yml
Added detection testing service results inMalicious PowerShell Process - Execution Policy Bypass
2021-09-21 19:58:12 +00:00
malicious_powershell_process_with_obfuscation_techniques.yml
Added detection testing service results inMalicious PowerShell Process With Obfuscation Techniques
2021-09-21 19:59:40 +00:00
modification_of_wallpaper.yml
blackmatter_ransomware
2021-09-06 16:49:58 +02:00
modify_acl_permission_to_files_or_folder.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
monitor_registry_keys_for_print_monitors.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
monitor_successful_backups.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
monitor_unsuccessful_backups.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ms_scripting_process_loading_ldap_module.yml
Added detection testing service results inMS Scripting Process Loading Ldap Module
2021-09-20 13:42:55 +00:00
ms_scripting_process_loading_wmi_module.yml
Added detection testing service results inMS Scripting Process Loading WMI Module
2021-09-20 13:41:30 +00:00
mshta_spawning_rundll32_or_regsvr32_process.yml
Added detection testing service results inMshta spawning Rundll32 OR Regsvr32 Process
2021-09-21 17:54:31 +00:00
mshtml_module_load_in_office_product.yml
updating docs and package bits [ci skip]
2021-09-09 19:07:07 +00:00
msmpeng_application_dll_side_loading.yml
add analytic types to detections
2021-07-19 17:12:54 +02:00
multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
multiple_users_attempting_to_authenticate_using_explicit_credentials.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
multiple_users_failing_to_authenticate_from_host_using_kerberos.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
multiple_users_failing_to_authenticate_from_host_using_ntlm.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
multiple_users_failing_to_authenticate_from_process.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
multiple_users_remotely_failing_to_authenticate_from_host.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
net_localgroup_discovery.yml
Added detection testing service results inNet Localgroup Discovery
2021-09-14 18:02:07 +00:00
net_profiler_uac_bypass.yml
Merge branch 'develop' into analytic_types
2021-08-10 11:02:18 +02:00
network_connection_discovery_arp.yml
Added detection testing service results inNetwork Connection Discovery With Arp
2021-09-10 18:09:54 +00:00
network_connection_discovery_net.yml
Merge branch 'AD_Discovery_TR-789_8' of github.com:splunk/security_content into AD_Discovery_TR-789_8
2021-09-10 13:50:54 -04:00
network_connection_discovery_netstat.yml
Merge branch 'AD_Discovery_TR-789_8' of github.com:splunk/security_content into AD_Discovery_TR-789_8
2021-09-10 13:50:54 -04:00
nishang_powershelltcponeline.yml
Added detection testing service results inNishang PowershellTCPOneLine
2021-09-21 17:55:07 +00:00
nltest_domain_trust_discovery.yml
May The Haag Be With You
2021-09-14 11:05:59 -06:00
non_chrome_process_accessing_chrome_default_dir.yml
Added detection testing service results inNon Chrome Process Accessing Chrome Default Dir
2021-09-16 10:03:01 +00:00
non_firefox_process_access_firefox_profile_dir.yml
Added detection testing service results inNon Firefox Process Access Firefox Profile Dir
2021-09-15 16:00:56 +00:00
ntdsutil_export_ntds.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
office_application_drop_executable.yml
Added detection testing service results inOffice Application Drop Executable
2021-09-16 14:48:10 +00:00
office_application_spawn_regsvr32_process.yml
Added detection testing service results inOffice Application Spawn Regsvr32 process
2021-09-21 17:55:16 +00:00
office_application_spawn_rundll32_process.yml
Added detection testing service results inOffice Application Spawn rundll32 process
2021-09-21 17:55:10 +00:00
office_document_creating_schedule_task.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
office_document_executing_macro_code.yml
rename
2021-08-18 13:49:15 -07:00
office_document_spawned_child_process_to_download.yml
Added detection testing service results inOffice Document Spawned Child Process To Download
2021-09-20 18:21:07 +00:00
office_product_spawn_cmd_process.yml
Added detection testing service results inOffice Product Spawn CMD Process
2021-09-21 17:54:56 +00:00
office_product_spawning_bitsadmin.yml
Added detection testing service results inOffice Product Spawning BITSAdmin
2021-09-21 17:39:18 +00:00
office_product_spawning_certutil.yml
Added detection testing service results inOffice Product Spawning CertUtil
2021-09-21 17:38:23 +00:00
office_product_spawning_mshta.yml
Added detection testing service results inOffice Product Spawning MSHTA
2021-09-21 18:24:38 +00:00
office_product_spawning_rundll32_with_no_dll.yml
Added detection testing service results inOffice Product Spawning Rundll32 with no DLL
2021-09-21 17:39:03 +00:00
office_product_spawning_wmic.yml
Added detection testing service results inOffice Product Spawning Wmic
2021-09-21 17:38:24 +00:00
office_product_writing_cab_or_inf.yml
Added detection testing service results inOffice Product Writing cab or inf
2021-09-10 18:18:08 +00:00
office_spawning_control.yml
updating docs and package bits [ci skip]
2021-09-09 19:07:07 +00:00
overwriting_accessibility_binaries.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
password_policy_discovery_with_net.yml
small
2021-09-21 09:46:17 -07:00
permission_modification_using_takeown_app.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
petitpotam_network_share_access_request.yml
updating docs and package bits [ci skip]
2021-09-09 19:07:07 +00:00
petitpotam_suspicious_kerberos_tgt_request.yml
updating docs and package bits [ci skip]
2021-09-09 19:07:07 +00:00
powershell_4104_hunting.yml
updating docs and package bits [ci skip]
2021-08-27 21:52:55 +00:00
powershell_creating_thread_mutex.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
powershell_disable_security_monitoring.yml
Added detection testing service results inPowershell Disable Security Monitoring
2021-09-21 18:10:11 +00:00
powershell_domain_enumeration.yml
Added detection testing service results inPowerShell Domain Enumeration
2021-09-08 13:24:33 +00:00
powershell_enable_smb1protocol_feature.yml
add analytic types to detections
2021-07-19 17:12:54 +02:00
powershell_execute_com_object.yml
updating docs and package bits [ci skip]
2021-08-20 22:22:11 +00:00
powershell_fileless_process_injection_via_getprocaddress.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
powershell_fileless_script_contains_base64_encoded_content.yml
AD_Discovery_TR-789_3
2021-09-02 09:38:51 -06:00
powershell_get_localgroup_discovery_with_script_block_logging.yml
Added detection testing service results inPowershell Get LocalGroup Discovery with Script Block Logging
2021-09-14 18:14:29 +00:00
powershell_get_localgroup_discovery.yml
Added detection testing service results inPowerShell Get LocalGroup Discovery
2021-09-14 18:46:53 +00:00
powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
powershell_processing_stream_of_data.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
powershell_remote_thread_to_known_windows_process.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
powershell_start_bitstransfer.yml
Added detection testing service results inPowerShell Start-BitsTransfer
2021-09-21 17:38:44 +00:00
powershell_using_memory_as_backing_store.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
prevent_automatic_repair_mode_using_bcdedit.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
previously_seen_command_line_arguments.yml
updating docs and package bits [ci skip]
2021-08-20 22:22:11 +00:00
previously_seen_running_windows_services_update.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
previously_seen_running_windows_services.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
previously_seen_zoom_child_processes_initial.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
previously_seen_zoom_child_processes_update.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
print_spooler_adding_a_printer_driver.yml
add analytic types to detections
2021-07-19 17:12:54 +02:00
print_spooler_failed_to_load_a_plug_in.yml
add analytic types to detections
2021-07-19 17:12:54 +02:00
process_creating_lnk_file_in_suspicious_location.yml
updating docs and package bits [ci skip]
2021-09-09 19:07:07 +00:00
process_deleting_its_process_file_path.yml
remcos_agent
2021-09-24 09:20:07 +02:00
process_execution_via_wmi.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
process_kill_base_on_file_path.yml
Added detection testing service results inProcess Kill Base On File Path
2021-09-21 17:08:44 +00:00
processes_launching_netsh.yml
Added detection testing service results inProcesses created by netsh
2021-09-16 18:42:10 +00:00
ransomware_notes_bulk_creation.yml
blackmatter_ransomware
2021-09-06 16:49:58 +02:00
recon_avproduct_through_pwh_or_wmi.yml
run generate again
2021-08-16 15:57:44 -07:00
recon_using_wmi_class.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
recursive_delete_of_directory_in_batch_cmd.yml
Added detection testing service results inRecursive Delete of Directory In Batch CMD
2021-09-21 17:07:50 +00:00
reg_exe_manipulating_windows_services_registry_keys.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
registry_keys_for_creating_shim_databases.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
registry_keys_used_for_persistence.yml
remcos_agent
2021-09-24 09:20:07 +02:00
registry_keys_used_for_privilege_escalation.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
remcos_c2_install_process.yml
fixes
2021-09-24 15:50:05 -07:00
remcos_client_registry_install_entry.yml
bhavinfix
2021-09-24 16:32:26 -07:00
remcos_rat_file_creation_in_remcos_folder.yml
Added detection testing service results inRemcos RAT File Creation in Remcos Folder
2021-09-23 08:09:43 +00:00
remote_process_instantiation_via_wmi.yml
Added detection testing service results inRemote Process Instantiation via WMI
2021-09-21 17:02:26 +00:00
remote_system_discovery_with_adsisearcher.yml
adding required fields
2021-09-10 13:04:57 -04:00
remote_system_discovery_with_dsquery.yml
adding required fields
2021-09-10 13:04:57 -04:00
remote_system_discovery_with_net.yml
adding required fields
2021-09-10 13:04:57 -04:00
remote_system_discovery_with_wmic.yml
adding required fields
2021-09-10 13:04:57 -04:00
remote_wmi_command_attempt.yml
Added detection testing service results inRemote WMI Command Attempt
2021-09-21 15:58:53 +00:00
resize_shadowstorage_volume.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
revil_common_exec_parameter.yml
run generate again
2021-08-16 15:57:44 -07:00
revil_registry_entry.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
rundll32_control_rundll_hunt.yml
updating docs and package bits [ci skip]
2021-09-09 19:07:07 +00:00
rundll32_control_rundll_world_writable_directory.yml
updating docs and package bits [ci skip]
2021-09-09 19:07:07 +00:00
rundll32_create_remote_thread_to_a_process.yml
Merge branch 'develop' into The-Haag-of-The-Storm
2021-09-03 07:10:38 -06:00
rundll32_createremotethread_in_browser.yml
rename
2021-08-18 13:49:15 -07:00
rundll32_dnsquery.yml
rename
2021-08-18 13:49:15 -07:00
rundll32_lockworkstation.yml
updating docs and package bits [ci skip]
2021-08-20 22:22:11 +00:00
rundll32_process_creating_exe_dll_files.yml
rename
2021-08-18 13:49:15 -07:00
rundll32_with_no_command_line_arguments_with_network.yml
macrod rundll32
2021-08-17 13:21:24 -06:00
rundll_loading_dll_by_ordinal.yml
Added detection testing service results inRunDLL Loading DLL By Ordinal
2021-09-21 15:48:33 +00:00
ryuk_test_files_detected.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
ryuk_wake_on_lan_command.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
sam_database_file_access_attempt.yml
Merge branch 'develop' into analytic_types
2021-08-10 11:02:18 +02:00
samsam_test_file_write.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
sc_exe_manipulating_windows_services.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
schcache_change_by_app_connect_and_create_adsi_object.yml
updating docs and package bits [ci skip]
2021-09-09 19:07:07 +00:00
schedule_task_with_http_command_arguments.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
schedule_task_with_rundll32_command_trigger.yml
rename
2021-08-18 13:49:15 -07:00
scheduled_task_deleted_or_created_via_cmd.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
schtasks_run_task_on_demand.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
schtasks_scheduling_job_on_remote_system.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
schtasks_used_for_forcing_a_reboot.yml
Update schtasks_used_for_forcing_a_reboot.yml
2021-09-21 09:24:42 -06:00
script_execution_via_wmi.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
sdclt_uac_bypass.yml
Merge branch 'develop' into analytic_types
2021-08-10 11:02:18 +02:00
searchprotocolhost_with_no_command_line_with_network.yml
Revert "Update searchprotocolhost_with_no_command_line_with_network.yml"
2021-09-22 14:11:27 -06:00
secretdumps_offline_ntds_dumping_tool.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
services_escalate_exe.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
shim_database_file_creation.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
shim_database_installation_with_suspicious_parameters.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
short_lived_windows_accounts.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
silentcleanup_uac_bypass.yml
Merge branch 'develop' into analytic_types
2021-08-10 11:02:18 +02:00
single_letter_process_on_endpoint.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
slui_runas_elevated.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
slui_spawning_a_process.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
spoolsv_spawning_rundll32.yml
macrod rundll32
2021-08-17 13:21:24 -06:00
spoolsv_suspicious_loaded_modules.yml
add analytic types to detections
2021-07-19 17:12:54 +02:00
spoolsv_suspicious_process_access.yml
add analytic types to detections
2021-07-19 17:12:54 +02:00
spoolsv_writing_a_dll___sysmon.yml
add analytic types to detections
2021-07-19 17:12:54 +02:00
spoolsv_writing_a_dll.yml
add analytic types to detections
2021-07-19 17:12:54 +02:00
sqlite_module_in_temp_folder.yml
rename
2021-08-18 13:49:15 -07:00
ssa___applying_stolen_credentials_via_mimikatz_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___applying_stolen_credentials_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___assess_credential_strength_via_dsinternals_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___attempt_to_delete_services.yml
run generate again
2021-08-16 15:57:44 -07:00
ssa___attempt_to_disable_services.yml
run generate again
2021-08-16 15:57:44 -07:00
ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___credential_extraction_dsinternals_conversion_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___credential_extraction_dsinternals_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___credential_extraction_fgdump_cachedump_s_option.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___credential_extraction_fgdump_cachedump_v_option.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___credential_extraction_getaddbaccount_from_dump.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___credential_extraction_lazagne_command_options.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___credential_extraction_mimikatz_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___credential_extraction_ms_debuggers_kernel_peek.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___credential_extraction_ms_debuggers_z_option.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___credential_extraction_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___delete_a_net_user.yml
run generate again
2021-08-16 15:57:44 -07:00
ssa___deny_permission_using_cacls_utility.yml
run generate again
2021-08-16 15:57:44 -07:00
ssa___detect_dump_lsass_memory_using_comsvcs.yml
Update ssa___detect_dump_lsass_memory_using_comsvcs.yml
2021-09-21 11:35:19 -04:00
ssa___detect_kerberoasting.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___detect_pass_hash.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___disable_net_user_account.yml
run generate again
2021-08-16 15:57:44 -07:00
ssa___first_time_seen_cmd_line.yml
run generate again
2021-08-16 15:57:44 -07:00
ssa___grant_permission_using_cacls_utility.yml
run generate again
2021-08-16 15:57:44 -07:00
ssa___illegal_access_user_content_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___illegal_account_creation_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___illegal_log_deletion_via_mimikatz_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___illegal_service_and_process_control_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___modify_acls_permission_of_files_or_folders.yml
run generate again
2021-08-16 15:57:44 -07:00
ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___prohibited_apps_spawning_cmdprompt.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___ptt_pth_kerb_ntlm_dest_device.yml
Fixing a problem with time being in milliseconds vs seconds - setting observation confirence interval back to 30 min
2021-09-24 11:19:38 -07:00
ssa___ptt_pth_kerb_ntlm_origin_device.yml
Fixing a problem with time being in milliseconds vs seconds - setting observation confirence interval back to 30 min
2021-09-24 11:19:38 -07:00
ssa___rare_parent_process_relationship_lolbas.yml
run generate again
2021-08-16 15:57:44 -07:00
ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___recon_and_use_computers_via_mimikatz_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___recon_and_use_shares_via_mimikatz_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___recon_and_use_shares_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___recon_connectivity_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___recon_defensive_tools_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___recon_processes_and_services_via_mimikatz_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___resize_shadowstorage_volume.yml
run generate again
2021-08-16 15:57:44 -07:00
ssa___setting_credentials_via_dsinternals_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___setting_credentials_via_mimikatz_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___setting_credentials_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
ssa___system_process_running_unexpected_location.yml
run generate again
2021-08-16 15:57:44 -07:00
ssa___unusual_lolbas_in_short_period_of_time.yml
Adding some basic body info for unusual lolbas count
2021-09-24 15:23:43 -05:00
ssa___unusually_long_command_line.yml
run generate again
2021-08-16 15:57:44 -07:00
ssa___wevtutil_usage_to_clear_logs.yml
run generate again
2021-08-16 15:57:44 -07:00
ssa___wevtutil_usage_to_disable_logs.yml
run generate again
2021-08-16 15:57:44 -07:00
start_up_during_safe_mode_boot.yml
updating docs and package bits [ci skip]
2021-09-09 19:07:07 +00:00
suspicious_dllhost_no_command_line_arguments.yml
removing originalfilename artifacts
2021-09-20 12:37:32 -06:00
suspicious_driver_loaded_path.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
suspicious_event_log_service_behavior.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
suspicious_gpupdate_no_command_line_arguments.yml
Added detection testing service results inSuspicious GPUpdate no Command Line Arguments
2021-09-20 17:54:58 +00:00
suspicious_icedid_regsvr32_cmdline.yml
Merge branch 'develop' into The-Haag-of-The-Storm
2021-09-03 07:10:38 -06:00
suspicious_icedid_rundll32_cmdline.yml
Merge branch 'develop' into The-Haag-of-The-Storm
2021-09-03 07:10:38 -06:00
suspicious_image_creation_in_appdata_folder.yml
Added detection testing service results inSuspicious Image Creation In Appdata Folder
2021-09-23 08:07:07 +00:00
suspicious_microsoft_workflow_compiler_rename.yml
mwc hunting and rundll32 fix
2021-09-20 11:39:40 -06:00
suspicious_microsoft_workflow_compiler_usage.yml
Updated URLs and fixes
2021-08-20 11:53:42 -06:00
suspicious_msbuild_path.yml
msbuild and microsoftworkflowcompiler
2021-08-19 06:57:11 -06:00
suspicious_msbuild_rename.yml
msbuild and microsoftworkflowcompiler
2021-08-19 06:57:11 -06:00
suspicious_msbuild_spawn.yml
msbuild and microsoftworkflowcompiler
2021-08-19 06:57:11 -06:00
suspicious_mshta_child_process.yml
add analytic types to detections
2021-07-19 17:12:54 +02:00
suspicious_mshta_spawn.yml
macro'd mshta
2021-08-17 13:38:11 -06:00
suspicious_process_file_path.yml
remcos_agent
2021-09-24 09:20:07 +02:00
suspicious_reg_exe_process.yml
updating docs and package bits [ci skip]
2021-08-27 21:52:55 +00:00
suspicious_regsvr32_register_suspicious_path.yml
Added detection testing service results inDetect regsvr32 Registering DLLs from non-standard paths
2021-09-21 15:45:08 +00:00
suspicious_rundll32_dllregisterserver.yml
Added detection testing service results inSuspicious Rundll32 dllregisterserver
2021-09-21 15:44:56 +00:00
suspicious_rundll32_plugininit.yml
Added detection testing service results inSuspicious Rundll32 PluginInit
2021-09-21 15:45:21 +00:00
suspicious_rundll32_rename.yml
Added detection testing service results inDetect Renamed rundll32.exe Rename
2021-09-21 15:40:28 +00:00
suspicious_rundll32_startw.yml
macrod rundll32
2021-08-17 13:21:24 -06:00
suspicious_rundll32_with_no_command_line_arguments.yml
Added detection testing service results inSuspicious Rundll32 with no Command Line Arguments
2021-09-20 17:58:12 +00:00
suspicious_scheduled_task_from_public_directory.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
suspicious_searchprotocolhost_no_command_line_arguments.yml
Added detection testing service results inSuspicious SearchProtocolHost no Command Line Arguments
2021-09-20 18:05:05 +00:00
suspicious_wav_file_in_appdata_folder.yml
Added detection testing service results inSuspicious WAV file in Appdata Folder
2021-09-22 16:01:40 +00:00
suspicious_wevtutil_usage.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
suspicious_writes_to_windows_recycle_bin.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
system_information_discovery_detection.yml
updating docs and package bits [ci skip]
2021-09-09 19:07:07 +00:00
system_processes_run_from_unexpected_locations.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
system_user_discovery_with_query.yml
fixing message field
2021-09-14 11:54:58 -04:00
system_user_discovery_with_whoami.yml
fixing message field
2021-09-14 11:54:58 -04:00
systems_ready_for_spectre_meltdown_windows_patch.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
trickbot_named_pipe.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
uac_bypass_mmc_load_unsigned_dll.yml
Merge branch 'develop' into analytic_types
2021-08-10 11:02:18 +02:00
uac_bypass_with_colorui_com_object.yml
updating docs and package bits [ci skip]
2021-08-20 22:22:11 +00:00
unified_messaging_service_spawning_a_process.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
uninstall_app_using_msiexec.yml
updating docs and package bits [ci skip]
2021-08-20 22:22:11 +00:00
unload_sysmon_filter_driver.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
unloading_amsi_via_reflection.yml
AD_Discovery_TR-789_3
2021-09-02 09:38:51 -06:00
unusually_long_command_line.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
user_discocvery_with_env_vars_powershell.yml
fixing message field
2021-09-14 11:54:58 -04:00
user_discovery_with_env_vars_powershell_script_block.yml
fixing message field
2021-09-14 11:54:58 -04:00
usn_journal_deletion.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
w3wp_spawning_shell.yml
Added detection testing service results inW3WP Spawning Shell
2021-09-21 14:52:47 +00:00
wbadmin_delete_system_backups.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
wbemprox_com_object_execution.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
wermgr_process_connecting_to_ip_check_web_services.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
wermgr_process_create_executable_file.yml
Revert "Update wermgr_process_create_executable_file.yml"
2021-09-21 09:13:07 -06:00
wermgr_process_spawned_cmd_or_powershell_process.yml
Added detection testing service results inWermgr Process Spawned CMD Or Powershell Process
2021-09-21 14:43:46 +00:00
windows_disableantispyware_reg.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
windows_event_log_cleared.yml
Revert "Update windows_event_log_cleared.yml"
2021-09-21 09:15:56 -06:00
windows_security_account_manager_stopped.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
windows_updates_install_failures.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
windows_updates_install_successes.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
winevent_scheduled_task_created_to_spawn_shell.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
winevent_scheduled_task_created_within_public_path.yml
rename
2021-08-18 13:49:15 -07:00
winword_spawning_cmd.yml
Added detection testing service results inWinword Spawning Cmd
2021-09-21 14:32:55 +00:00
winword_spawning_powershell.yml
Added detection testing service results inWinword Spawning PowerShell
2021-09-21 14:35:04 +00:00
winword_spawning_windows_script_host.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
wmi_permanent_event_subscription___sysmon.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
wmi_recon_running_process_or_services.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
wmic_group_discovery.yml
minor metdata fixes
2021-09-21 11:08:13 -04:00
write_executable_in_smb_share.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
wsreset_uac_bypass.yml
Merge branch 'develop' into analytic_types
2021-08-10 11:02:18 +02:00
xmrig_driver_loaded.yml
resolved merge conflicts
2021-07-21 09:22:09 +02:00
xsl_script_execution_with_wmic.yml
Added detection testing service results inXSL Script Execution With WMIC
2021-09-15 12:43:04 +00:00