admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
gitlab_release_v4.27.21
splunk-security_content/detections/endpoint
T
History
Bhavin Patel 7283ba3723 ESCU Release Branch v4.27.0
2024-03-20 20:01:18 +00:00
..
3cx_supply_chain_attack_network_indicators.yml
bug fix validation
2023-04-28 13:53:52 +02:00
7zip_commandline_to_smb_share_path.yml
Getting develop branch ready in gitlab
2023-10-23 22:55:52 +00:00
access_lsass_memory_for_dump_creation.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
account_discovery_with_net_app.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
active_directory_lateral_movement_identified.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
active_directory_privilege_escalation_identified.yml
updates
2023-05-23 17:26:18 -04:00
active_setup_registry_autostart.yml
Merge branch 'develop' into observable_cloud
2023-08-17 17:58:05 -07:00
add_defaultuser_and_password_in_registry.yml
a to c fixes
2023-07-28 12:12:36 -05:00
add_or_set_windows_defender_exclusion.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
adsisearcher_account_discovery.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
allow_file_and_printing_sharing_in_firewall.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
allow_inbound_traffic_by_firewall_rule_registry.yml
Release v4.15.0
2023-11-01 19:24:56 +00:00
allow_inbound_traffic_in_firewall_rule.yml
a to c fixes
2023-07-28 12:12:36 -05:00
allow_network_discovery_in_firewall.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
allow_operation_with_consent_admin.yml
a to c fixes
2023-07-28 12:12:36 -05:00
anomalous_usage_of_7zip.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
any_powershell_downloadfile.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
any_powershell_downloadstring.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
attacker_tools_on_endpoint.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
attempt_to_add_certificate_to_untrusted_store.yml
updated descriptions
2023-10-13 13:26:36 -07:00
attempt_to_stop_security_service.yml
updated with proper format
2023-10-13 13:32:37 -07:00
attempted_credential_dump_from_registry_via_reg_exe.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
auto_admin_logon_registry_entry.yml
a to c fixes
2023-07-28 12:12:36 -05:00
batch_file_write_to_system32.yml
one more PR
2023-05-01 12:41:25 -07:00
bcdedit_command_back_to_normal_mode_boot.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
bcdedit_failure_recovery_modification.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
bits_job_persistence.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
bitsadmin_download_file.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
certutil_download_with_urlcache_and_split_arguments.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
certutil_download_with_verifyctl_and_split_arguments.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
certutil_exe_certificate_extraction.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
certutil_with_decode_argument.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
change_default_file_association.yml
data_destruction_wiper_story
2023-04-14 10:50:14 +02:00
change_to_safe_mode_with_network_config.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
chcp_command_execution.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
check_elevated_cmd_using_whoami.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
child_processes_of_spoolsv_exe.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
clear_unallocated_sector_using_cipher_app.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
clop_common_exec_parameter.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
clop_ransomware_known_service_name.yml
a to c fixes
2023-07-28 12:12:36 -05:00
cmd_carry_out_string_command_parameter.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
cmd_echo_pipe___escalation.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
cmdline_tool_not_executed_in_cmd_shell.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
cmlua_or_cmstplua_uac_bypass.yml
updated with proper format
2023-10-13 13:32:37 -07:00
cobalt_strike_named_pipes.yml
Update cobalt_strike_named_pipes.yml
2023-09-28 10:53:01 -07:00
common_ransomware_extensions.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
common_ransomware_notes.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
connectwise_screenconnect_path_traversal_windows_sacl.yml
ESCU 4.25.0 Release branch
2024-02-22 17:14:23 +00:00
connectwise_screenconnect_path_traversal.yml
ESCU 4.25.0 Release branch
2024-02-22 17:14:23 +00:00
conti_common_exec_parameter.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
control_loading_from_world_writable_directory.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
create_local_admin_accounts_using_net_exe.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
create_or_delete_windows_shares_using_net_exe.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
create_remote_thread_in_shell_application.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
create_remote_thread_into_lsass.yml
updated with proper format
2023-10-13 13:32:37 -07:00
creation_of_lsass_dump_with_taskmgr.yml
Merge branch 'develop' into sysmon_fix
2023-09-20 16:22:08 -07:00
creation_of_shadow_copy_with_wmic_and_powershell.yml
updated with proper format
2023-10-13 13:32:37 -07:00
creation_of_shadow_copy.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
credential_dumping_via_copy_command_from_shadow_copy.yml
updated descriptions
2023-10-13 13:26:36 -07:00
credential_dumping_via_symlink_to_shadow_copy.yml
updated with proper format
2023-10-13 13:32:37 -07:00
csc_net_on_the_fly_compilation.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
curl_download_and_bash_execution.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
delete_shadowcopy_with_powershell.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
deleting_of_net_users.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
deleting_shadow_copies.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
detect_azurehound_command_line_arguments.yml
ESCU Release Branch v4.27.0
2024-03-20 20:01:18 +00:00
detect_azurehound_file_modifications.yml
ESCU Release Branch v4.27.0
2024-03-20 20:01:18 +00:00
detect_baron_samedit_cve_2021_3156_segfault.yml
updated with proper format
2023-10-13 13:32:37 -07:00
detect_baron_samedit_cve_2021_3156_via_osquery.yml
updated with proper format
2023-10-13 13:32:37 -07:00
detect_baron_samedit_cve_2021_3156.yml
updated with proper format
2023-10-13 13:32:37 -07:00
detect_certify_command_line_arguments.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
detect_certify_with_powershell_script_block_logging.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
detect_certipy_file_modifications.yml
update for data
2023-10-06 13:10:30 -07:00
detect_computer_changed_with_anonymous_account.yml
merged with develop
2023-03-03 12:40:16 +01:00
detect_copy_of_shadowcopy_with_script_block_logging.yml
fixed obs stuff
2023-08-21 12:28:13 -07:00
detect_credential_dumping_through_lsass_access.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
detect_empire_with_powershell_script_block_logging.yml
data_destruction_wiper_story
2023-04-14 10:50:14 +02:00
detect_excessive_account_lockouts_from_endpoint.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
detect_excessive_user_account_lockouts.yml
second set of fixes
2023-09-22 15:47:54 -07:00
detect_exchange_web_shell.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
detect_html_help_renamed.yml
second set of fixes
2023-09-22 15:47:54 -07:00
detect_html_help_spawn_child_process.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
detect_html_help_url_in_command_line.yml
Merge pull request #2851 from splunk/TR-2409
2023-09-15 14:35:58 -07:00
detect_html_help_using_infotech_storage_handlers.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
detect_mimikatz_with_powershell_script_block_logging.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
detect_mshta_inline_hta_execution.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
detect_mshta_renamed.yml
second set of fixes
2023-09-22 15:47:54 -07:00
detect_mshta_url_in_command_line.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
detect_new_local_admin_account.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
detect_outlook_exe_writing_a_zip_file.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
detect_path_interception_by_creation_of_program_exe.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
detect_processes_used_for_system_network_configuration_discovery.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
detect_prohibited_applications_spawning_cmd_exe.yml
second set of fixes
2023-09-22 15:47:54 -07:00
detect_psexec_with_accepteula_flag.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
detect_rare_executables.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
detect_rclone_command_line_usage.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
detect_regasm_spawning_a_process.yml
ESCU 4.25.0 Release branch
2024-02-22 17:14:23 +00:00
detect_regasm_with_network_connection.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
detect_regasm_with_no_command_line_arguments.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
detect_regsvcs_spawning_a_process.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
detect_regsvcs_with_network_connection.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
detect_regsvcs_with_no_command_line_arguments.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
detect_regsvr32_application_control_bypass.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
detect_remote_access_software_usage_file.yml
ESCU v4.26.0 Release branch
2024-03-06 19:30:20 +00:00
detect_remote_access_software_usage_fileinfo.yml
ESCU v4.26.0 Release branch
2024-03-06 19:30:20 +00:00
detect_remote_access_software_usage_process.yml
ESCU v4.26.0 Release branch
2024-03-06 19:30:20 +00:00
detect_renamed_7_zip.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
detect_renamed_psexec.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
detect_renamed_rclone.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
detect_renamed_winrar.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
detect_rtlo_in_file_name.yml
yaml fix
2023-06-12 14:23:18 -07:00
detect_rtlo_in_process.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
detect_rundll32_application_control_bypass___advpack.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
detect_rundll32_application_control_bypass___setupapi.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
detect_rundll32_application_control_bypass___syssetup.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
detect_rundll32_inline_hta_execution.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
detect_sharphound_command_line_arguments.yml
ESCU Release Branch v4.27.0
2024-03-20 20:01:18 +00:00
detect_sharphound_file_modifications.yml
ESCU Release Branch v4.27.0
2024-03-20 20:01:18 +00:00
detect_sharphound_usage.yml
ESCU Release Branch v4.27.0
2024-03-20 20:01:18 +00:00
detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
detect_use_of_cmd_exe_to_launch_script_interpreters.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
detect_webshell_exploit_behavior.yml
Release branch v4.16.0
2023-11-16 20:33:10 +00:00
detect_wmi_event_subscription_persistence.yml
Merge branch 'develop' into sysmon_fix
2023-09-20 16:22:08 -07:00
detection_of_tools_built_by_nirsoft.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
disable_amsi_through_registry.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
disable_defender_antivirus_registry.yml
fixed obs stuff
2023-08-21 12:28:13 -07:00
disable_defender_blockatfirstseen_feature.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
disable_defender_enhanced_notification.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
disable_defender_mpengine_registry.yml
fixed obs stuff
2023-08-21 12:28:13 -07:00
disable_defender_spynet_reporting.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
disable_defender_submit_samples_consent_feature.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
disable_etw_through_registry.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
disable_logs_using_wevtutil.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
disable_registry_tool.yml
njrat2
2023-09-21 10:56:06 +02:00
disable_schedule_task.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
disable_security_logs_using_minint_registry.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
disable_show_hidden_files.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
disable_uac_remote_restriction.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
disable_windows_app_hotkeys.yml
updated with proper format
2023-10-13 13:32:37 -07:00
disable_windows_behavior_monitoring.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
disable_windows_smartscreen_protection.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
disabled_kerberos_pre_authentication_discovery_with_get_aduser.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
disabled_kerberos_pre_authentication_discovery_with_powerview.yml
fix another 30 yamls
2023-08-21 13:13:21 -07:00
disabling_cmd_application.yml
njrat2
2023-09-21 10:56:06 +02:00
disabling_controlpanel.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
disabling_defender_services.yml
fix another 30 yamls
2023-08-21 13:13:21 -07:00
disabling_firewall_with_netsh.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
disabling_folderoptions_windows_feature.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
disabling_net_user_account.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
disabling_norun_windows_app.yml
fix another 30 yamls
2023-08-21 13:13:21 -07:00
disabling_remote_user_account_control.yml
merged with develop
2023-03-03 12:40:16 +01:00
disabling_systemrestore_in_registry.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
disabling_task_manager.yml
njrat2
2023-09-21 10:56:06 +02:00
disabling_windows_local_security_authority_defences_via_registry.yml
ESCU Release Branch v4.27.0
2024-03-20 20:01:18 +00:00
dllhost_with_no_command_line_arguments_with_network.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
dns_exfiltration_using_nslookup_app.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
domain_account_discovery_with_dsquery.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
domain_account_discovery_with_net_app.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
domain_account_discovery_with_wmic.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
domain_controller_discovery_with_nltest.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
domain_controller_discovery_with_wmic.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
domain_group_discovery_with_adsisearcher.yml
fix another 30 yamls
2023-08-21 13:13:21 -07:00
domain_group_discovery_with_dsquery.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
domain_group_discovery_with_net.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
domain_group_discovery_with_wmic.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
download_files_using_telegram.yml
ESCU 4.25.0 Release branch
2024-02-22 17:14:23 +00:00
drop_icedid_license_dat.yml
Merge branch 'release_v4.13.0' into sysmon_fix
2023-09-28 12:38:50 -07:00
dsquery_domain_discovery.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
dump_lsass_via_comsvcs_dll.yml
updated descriptions
2023-10-13 13:26:36 -07:00
dump_lsass_via_procdump.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
elevated_group_discovery_with_net.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
elevated_group_discovery_with_powerview.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
elevated_group_discovery_with_wmic.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
enable_rdp_in_other_port_number.yml
fix another 30 yamls
2023-08-21 13:13:21 -07:00
enable_wdigest_uselogoncredential_registry.yml
fix another 30 yamls
2023-08-21 13:13:21 -07:00
enumerate_users_local_group_using_telegram.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
esentutl_sam_copy.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
etw_registry_disabled.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
eventvwr_uac_bypass.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
excel_spawning_powershell.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
excel_spawning_windows_script_host.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
excessive_attempt_to_disable_services.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
excessive_distinct_processes_from_windows_temp.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
excessive_file_deletion_in_windefender_folder.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
excessive_number_of_service_control_start_as_disabled.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
excessive_number_of_taskhost_processes.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
excessive_service_stop_attempt.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
excessive_usage_of_cacls_app.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
excessive_usage_of_net_app.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
excessive_usage_of_nslookup_app.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
excessive_usage_of_sc_service_utility.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
excessive_usage_of_taskkill.yml
Merge branch 'develop' into njrat
2023-09-27 14:35:11 -07:00
exchange_powershell_abuse_via_ssrf.yml
blackbyte_campaign
2023-07-10 12:55:29 +02:00
exchange_powershell_module_usage.yml
fix another 30 yamls
2023-08-21 13:13:21 -07:00
executable_file_written_in_administrative_smb_share.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
executables_or_script_creation_in_suspicious_path.yml
ESCU 4.25.0 Release branch
2024-02-22 17:14:23 +00:00
execute_javascript_with_jscript_com_clsid.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
execution_of_file_with_multiple_extensions.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
extraction_of_registry_hives.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
file_with_samsam_extension.yml
updated with proper format
2023-10-13 13:32:37 -07:00
firewall_allowed_program_enable.yml
Release v4.15.0
2023-11-01 19:24:56 +00:00
first_time_seen_child_process_of_zoom.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
first_time_seen_running_windows_service.yml
merged with develop
2023-03-03 12:40:16 +01:00
fodhelper_uac_bypass.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
fsutil_zeroing_file.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
Update get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
2023-09-28 11:08:30 -07:00
get_addefaultdomainpasswordpolicy_with_powershell.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
get_aduser_with_powershell_script_block.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
get_aduser_with_powershell.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
get_aduserresultantpasswordpolicy_with_powershell_script_block.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
get_aduserresultantpasswordpolicy_with_powershell.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
get_domainpolicy_with_powershell_script_block.yml
merged with develop
2023-03-03 12:40:16 +01:00
get_domainpolicy_with_powershell.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
get_domaintrust_with_powershell_script_block.yml
fix another 30 yamls
2023-08-21 13:13:21 -07:00
get_domaintrust_with_powershell.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
get_domainuser_with_powershell_script_block.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
get_domainuser_with_powershell.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
get_foresttrust_with_powershell_script_block.yml
fix another 30 yamls
2023-08-21 13:13:21 -07:00
get_foresttrust_with_powershell.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
get_wmiobject_group_discovery_with_script_block_logging.yml
second set of fixes
2023-09-22 15:47:54 -07:00
get_wmiobject_group_discovery.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
getadcomputer_with_powershell_script_block.yml
merged with develop
2023-03-03 12:40:16 +01:00
getadcomputer_with_powershell.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
getadgroup_with_powershell_script_block.yml
second set of fixes
2023-09-22 15:47:54 -07:00
getadgroup_with_powershell.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
getcurrent_user_with_powershell_script_block.yml
second set of fixes
2023-09-22 15:47:54 -07:00
getcurrent_user_with_powershell.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
getdomaincomputer_with_powershell_script_block.yml
merged with develop
2023-03-03 12:40:16 +01:00
getdomaincomputer_with_powershell.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
getdomaincontroller_with_powershell_script_block.yml
merged with develop
2023-03-03 12:40:16 +01:00
getdomaincontroller_with_powershell.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
getdomaingroup_with_powershell_script_block.yml
merged with develop
2023-03-03 12:40:16 +01:00
getdomaingroup_with_powershell.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
getlocaluser_with_powershell_script_block.yml
merged with develop
2023-03-03 12:40:16 +01:00
getlocaluser_with_powershell.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
getnettcpconnection_with_powershell_script_block.yml
merged with develop
2023-03-03 12:40:16 +01:00
getnettcpconnection_with_powershell.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
getwmiobject_ds_computer_with_powershell_script_block.yml
merged with develop
2023-03-03 12:40:16 +01:00
getwmiobject_ds_computer_with_powershell.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
getwmiobject_ds_group_with_powershell_script_block.yml
Update getwmiobject_ds_group_with_powershell_script_block.yml
2023-08-21 16:43:00 -07:00
getwmiobject_ds_group_with_powershell.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
getwmiobject_ds_user_with_powershell_script_block.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
getwmiobject_ds_user_with_powershell.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
getwmiobject_user_account_with_powershell_script_block.yml
Merge branch 'develop' into winter_vivern_analytics
2023-04-13 19:02:00 +02:00
getwmiobject_user_account_with_powershell.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
gpupdate_with_no_command_line_arguments_with_network.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
headless_browser_mockbin_or_mocky_request.yml
fixes
2023-09-11 13:56:10 -06:00
headless_browser_usage.yml
fixes
2023-09-11 13:56:10 -06:00
hide_user_account_from_sign_in_screen.yml
fix another 30 yamls
2023-08-21 13:13:21 -07:00
hiding_files_and_directories_with_attrib_exe.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
high_frequency_copy_of_files_in_network_share.yml
merged with develop
2023-03-03 12:40:16 +01:00
high_process_termination_frequency.yml
ESCU 4.25.0 Release branch
2024-02-22 17:14:23 +00:00
hunting_3cxdesktopapp_software.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
icacls_deny_command.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
icacls_grant_command.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
icedid_exfiltrated_archived_file_creation.yml
Fixed a handful of issues with observables and messages and spacing in content.
2023-10-23 19:49:17 +00:00
impacket_lateral_movement_commandline_parameters.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
impacket_lateral_movement_smbexec_commandline_parameters.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
impacket_lateral_movement_wmiexec_commandline_parameters.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
interactive_session_on_remote_endpoint_with_powershell.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
java_class_file_download_by_java_user_agent.yml
merged with develop
2023-03-03 12:40:16 +01:00
java_writing_jsp_file.yml
Release branch v4.16.0
2023-11-16 20:33:10 +00:00
jscript_execution_using_cscript_app.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
kerberoasting_spn_request_with_rc4_encryption.yml
data_destruction_wiper_story
2023-04-14 10:50:14 +02:00
kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml
fix another 30 yamls
2023-08-21 13:13:21 -07:00
kerberos_pre_authentication_flag_disabled_with_powershell.yml
fix another 30 yamls
2023-08-21 13:13:21 -07:00
kerberos_service_ticket_request_using_rc4_encryption.yml
second set of fixes
2023-09-22 15:47:54 -07:00
kerberos_tgt_request_using_rc4_encryption.yml
Fixed a handful of issues with observables and messages and spacing in content.
2023-10-23 19:49:17 +00:00
kerberos_user_enumeration.yml
merged with develop
2023-03-03 12:40:16 +01:00
known_services_killed_by_ransomware.yml
merged with develop
2023-03-03 12:40:16 +01:00
linux_account_manipulation_of_ssh_config_and_keys.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
linux_add_files_in_known_crontab_directories.yml
descriptions
2023-06-20 13:06:48 -06:00
linux_add_user_account.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_adding_crontab_using_list_parameter.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_apt_get_privilege_escalation.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_apt_privilege_escalation.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_at_allow_config_file_creation.yml
new_line_backslash
2023-06-22 16:14:18 -07:00
linux_at_application_execution.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_awk_privilege_escalation.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_busybox_privilege_escalation.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_c89_privilege_escalation.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_c99_privilege_escalation.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_change_file_owner_to_root.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_clipboard_data_copy.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_common_process_for_elevation_control.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_composer_privilege_escalation.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_cpulimit_privilege_escalation.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_csvtool_privilege_escalation.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_curl_upload_file.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_data_destruction_command.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_dd_file_overwrite.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_decode_base64_to_shell.yml
updated with proper format
2023-10-13 13:32:37 -07:00
linux_deleting_critical_directory_using_rm_command.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_deletion_of_cron_jobs.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
linux_deletion_of_init_daemon_script.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
linux_deletion_of_services.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
linux_deletion_of_ssl_certificate.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
linux_disable_services.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_doas_conf_file_creation.yml
merged with develop
2023-03-03 12:40:16 +01:00
linux_doas_tool_execution.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_docker_privilege_escalation.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_edit_cron_table_parameter.yml
ESCU 4.25.0 Release branch
2024-02-22 17:14:23 +00:00
linux_emacs_privilege_escalation.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_file_created_in_kernel_driver_directory.yml
merged with develop
2023-03-03 12:40:16 +01:00
linux_file_creation_in_init_boot_directory.yml
merged with develop
2023-03-03 12:40:16 +01:00
linux_file_creation_in_profile_directory.yml
merged with develop
2023-03-03 12:40:16 +01:00
linux_find_privilege_escalation.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_gdb_privilege_escalation.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_gem_privilege_escalation.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_gnu_awk_privilege_escalation.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_hardware_addition_swapoff.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_high_frequency_of_file_deletion_in_boot_folder.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
linux_high_frequency_of_file_deletion_in_etc_folder.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
linux_impair_defenses_process_kill.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_indicator_removal_clear_cache.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_indicator_removal_service_file_deletion.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_ingress_tool_transfer_hunting.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_ingress_tool_transfer_with_curl.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_insert_kernel_module_using_insmod_utility.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_install_kernel_module_using_modprobe_utility.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_iptables_firewall_modification.yml
ESCU Release Branch v4.27.0
2024-03-20 20:01:18 +00:00
linux_java_spawning_shell.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_kernel_module_enumeration.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_kworker_process_in_writable_process_path.yml
ESCU Release Branch v4.27.0
2024-03-20 20:01:18 +00:00
linux_make_privilege_escalation.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_mysql_privilege_escalation.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_ngrok_reverse_proxy_usage.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_node_privilege_escalation.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_nopasswd_entry_in_sudoers_file.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_obfuscated_files_or_information_base64_decode.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_octave_privilege_escalation.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_openvpn_privilege_escalation.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_persistence_and_privilege_escalation_risk_behavior.yml
merged with develop
2023-03-03 12:40:16 +01:00
linux_php_privilege_escalation.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_pkexec_privilege_escalation.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
linux_possible_access_or_modification_of_sshd_config_file.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_possible_access_to_credential_files.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_possible_access_to_sudoers_file.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_possible_append_command_to_at_allow_config_file.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_possible_append_command_to_profile_config_file.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_possible_cronjob_modification_with_editor.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_possible_ssh_key_file_creation.yml
merged with develop
2023-03-03 12:40:16 +01:00
linux_preload_hijack_library_calls.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_proxy_socks_curl.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_puppet_privilege_escalation.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_rpm_privilege_escalation.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_ruby_privilege_escalation.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_service_file_created_in_systemd_directory.yml
new_line_backslash
2023-06-22 16:14:18 -07:00
linux_service_restarted.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_service_started_or_enabled.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
linux_setuid_using_chmod_utility.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_setuid_using_setcap_utility.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_shred_overwrite_command.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_sqlite3_privilege_escalation.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_ssh_authorized_keys_modification.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_ssh_remote_services_script_execute.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_stdout_redirection_to_dev_null_file.yml
ESCU Release Branch v4.27.0
2024-03-20 20:01:18 +00:00
linux_stop_services.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_sudo_or_su_execution.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_sudoers_tmp_file_creation.yml
merged with develop
2023-03-03 12:40:16 +01:00
linux_system_network_discovery.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_system_reboot_via_system_request_key.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_unix_shell_enable_all_sysrq_functions.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
linux_visudo_utility_execution.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
living_off_the_land.yml
fixes
2023-09-15 13:46:33 -07:00
loading_of_dynwrapx_module.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
local_account_discovery_with_net.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
local_account_discovery_with_wmic.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
log4shell_cve_2021_44228_exploitation.yml
T1133 Tags + description updates
2023-06-01 13:44:32 -06:00
logon_script_event_trigger_execution.yml
data_destruction_wiper_story
2023-04-14 10:50:14 +02:00
lolbas_with_network_traffic.yml
merged with develop
2023-03-03 12:40:16 +01:00
macos___re_opened_applications.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
macos_lolbin.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
macos_plutil.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
mailsniper_invoke_functions.yml
updates to yamls
2023-08-21 13:50:31 -07:00
malicious_inprocserver32_modification.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
malicious_powershell_executed_as_a_service.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
malicious_powershell_process___encoded_command.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
malicious_powershell_process___execution_policy_bypass.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
malicious_powershell_process_with_obfuscation_techniques.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
mimikatz_passtheticket_commandline_parameters.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
mmc_lolbas_execution_process_spawn.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
modification_of_wallpaper.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
modify_acl_permission_to_files_or_folder.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
monitor_registry_keys_for_print_monitors.yml
updates to yamls
2023-08-21 13:50:31 -07:00
ms_exchange_mailbox_replication_service_writing_active_server_pages.yml
blackbyte_campaign
2023-07-10 12:55:29 +02:00
ms_scripting_process_loading_ldap_module.yml
Merge branch 'develop' into sysmon_fix
2023-09-20 16:22:08 -07:00
ms_scripting_process_loading_wmi_module.yml
Merge branch 'develop' into sysmon_fix
2023-09-20 16:22:08 -07:00
msbuild_suspicious_spawned_by_script_process.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
mshta_spawning_rundll32_or_regsvr32_process.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
mshtml_module_load_in_office_product.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
msi_module_loaded_by_non_system_binary.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
msmpeng_application_dll_side_loading.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
net_localgroup_discovery.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
net_profiler_uac_bypass.yml
More observable fixes, including renaming fields
2023-09-29 13:19:47 -07:00
network_connection_discovery_with_arp.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
network_connection_discovery_with_net.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
network_connection_discovery_with_netstat.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
network_discovery_using_route_windows_app.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
network_share_discovery_via_dir_command.yml
More observable fixes, including renaming fields
2023-09-29 13:19:47 -07:00
network_traffic_to_active_directory_web_services_protocol.yml
ESCU Release Branch v4.27.0
2024-03-20 20:01:18 +00:00
nishang_powershelltcponeline.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
nltest_domain_trust_discovery.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
non_chrome_process_accessing_chrome_default_dir.yml
ESCU 4.25.0 Release branch
2024-02-22 17:14:23 +00:00
non_firefox_process_access_firefox_profile_dir.yml
ESCU 4.25.0 Release branch
2024-02-22 17:14:23 +00:00
notepad_with_no_command_line_arguments.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
ntdsutil_export_ntds.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
office_application_drop_executable.yml
Release v4.15.0
2023-11-01 19:24:56 +00:00
office_application_spawn_regsvr32_process.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
office_application_spawn_rundll32_process.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
office_document_creating_schedule_task.yml
Merge branch 'develop' into sysmon_fix
2023-09-20 16:22:08 -07:00
office_document_executing_macro_code.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
office_document_spawned_child_process_to_download.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
office_product_spawn_cmd_process.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
office_product_spawning_bitsadmin.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
office_product_spawning_certutil.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
office_product_spawning_mshta.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
office_product_spawning_rundll32_with_no_dll.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
office_product_spawning_windows_script_host.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
office_product_spawning_wmic.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
office_product_writing_cab_or_inf.yml
merged with develop
2023-03-03 12:40:16 +01:00
office_spawning_control.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
outbound_network_connection_from_java_using_default_ports.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
overwriting_accessibility_binaries.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
papercut_ng_suspicious_behavior_debug_log.yml
Merge branch 'develop' into craftycleanup
2023-06-22 14:40:31 -07:00
password_policy_discovery_with_net.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
permission_modification_using_takeown_app.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
petitpotam_network_share_access_request.yml
merged with develop
2023-03-03 12:40:16 +01:00
petitpotam_suspicious_kerberos_tgt_request.yml
merged with develop
2023-03-03 12:40:16 +01:00
ping_sleep_batch_command.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
possible_browser_pass_view_parameter.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
possible_lateral_movement_powershell_spawn.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
potential_password_in_username.yml
merged with develop
2023-03-03 12:40:16 +01:00
potentially_malicious_code_on_commandline.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
powershell_4104_hunting.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
powershell___connect_to_internet_with_hidden_window.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
powershell_com_hijacking_inprocserver32_modification.yml
merged with develop
2023-03-03 12:40:16 +01:00
powershell_creating_thread_mutex.yml
merged with develop
2023-03-03 12:40:16 +01:00
powershell_disable_security_monitoring.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
powershell_domain_enumeration.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
powershell_enable_powershell_remoting.yml
Release branch v4.16.0
2023-11-16 20:33:10 +00:00
powershell_enable_smb1protocol_feature.yml
minor yaml
2023-05-01 12:19:27 -07:00
powershell_execute_com_object.yml
carry over
2023-05-01 12:07:20 -07:00
powershell_fileless_process_injection_via_getprocaddress.yml
carry over
2023-05-01 12:07:20 -07:00
powershell_fileless_script_contains_base64_encoded_content.yml
njrat
2023-09-13 11:25:18 +02:00
powershell_get_localgroup_discovery_with_script_block_logging.yml
More observable fixes, including renaming fields
2023-09-29 13:19:47 -07:00
powershell_get_localgroup_discovery.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
powershell_invoke_cimmethod_cimsession.yml
Release branch v4.16.0
2023-11-16 20:33:10 +00:00
powershell_invoke_wmiexec_usage.yml
Release branch v4.16.0
2023-11-16 20:33:10 +00:00
powershell_load_module_in_meterpreter.yml
merged with develop
2023-03-03 12:40:16 +01:00
powershell_loading_dotnet_into_memory_via_reflection.yml
Update powershell_loading_dotnet_into_memory_via_reflection.yml
2023-04-14 10:36:29 +02:00
powershell_processing_stream_of_data.yml
iceid_dfir_coverage
2023-05-23 15:41:47 +02:00
powershell_remote_services_add_trustedhost.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
powershell_remote_thread_to_known_windows_process.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
powershell_remove_windows_defender_directory.yml
data_destruction_wiper_story
2023-04-14 10:50:14 +02:00
powershell_script_block_with_url_chain.yml
Update powershell_script_block_with_url_chain.yml
2023-08-07 12:06:01 -07:00
powershell_start_bitstransfer.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
powershell_start_or_stop_service.yml
Release branch v4.16.0
2023-11-16 20:33:10 +00:00
powershell_using_memory_as_backing_store.yml
updates to yamls
2023-08-21 13:50:31 -07:00
powershell_webrequest_using_memory_stream.yml
Update powershell_webrequest_using_memory_stream.yml
2023-08-07 12:06:24 -07:00
powershell_windows_defender_exclusion_commands.yml
warzone_rat
2023-07-26 14:53:43 +02:00
prevent_automatic_repair_mode_using_bcdedit.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
print_processor_registry_autostart.yml
data_destruction_wiper_story
2023-04-14 10:50:14 +02:00
print_spooler_adding_a_printer_driver.yml
merged with develop
2023-03-03 12:40:16 +01:00
print_spooler_failed_to_load_a_plug_in.yml
merged with develop
2023-03-03 12:40:16 +01:00
process_creating_lnk_file_in_suspicious_location.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
process_deleting_its_process_file_path.yml
More observable fixes, including renaming fields
2023-09-29 13:19:47 -07:00
process_execution_via_wmi.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
process_kill_base_on_file_path.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
process_writing_dynamicwrapperx.yml
merged with develop
2023-03-03 12:40:16 +01:00
processes_launching_netsh.yml
ESCU 4.25.0 Release branch
2024-02-22 17:14:23 +00:00
processes_tapping_keyboard_events.yml
merged with develop
2023-03-03 12:40:16 +01:00
randomly_generated_scheduled_task_name.yml
Haags are Forever
2023-06-12 15:11:25 -06:00
randomly_generated_windows_service_name.yml
merged with develop
2023-03-03 12:40:16 +01:00
ransomware_notes_bulk_creation.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
recon_avproduct_through_pwh_or_wmi.yml
updates to yamls
2023-08-21 13:50:31 -07:00
recon_using_wmi_class.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
recursive_delete_of_directory_in_batch_cmd.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
reg_exe_manipulating_windows_services_registry_keys.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
registry_keys_for_creating_shim_databases.yml
updates to yamls
2023-08-21 13:50:31 -07:00
registry_keys_used_for_persistence.yml
ESCU 4.25.0 Release branch
2024-02-22 17:14:23 +00:00
registry_keys_used_for_privilege_escalation.yml
updates to yamls
2023-08-21 13:50:31 -07:00
regsvr32_silent_and_install_param_dll_loading.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
regsvr32_with_known_silent_switch_cmdline.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
remcos_client_registry_install_entry.yml
updated with proper format
2023-10-13 13:32:37 -07:00
remcos_rat_file_creation_in_remcos_folder.yml
merged with develop
2023-03-03 12:40:16 +01:00
remote_desktop_process_running_on_system.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
remote_process_instantiation_via_dcom_and_powershell_script_block.yml
carry over
2023-05-01 12:07:20 -07:00
remote_process_instantiation_via_dcom_and_powershell.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
remote_process_instantiation_via_winrm_and_powershell_script_block.yml
merged with develop
2023-03-03 12:40:16 +01:00
remote_process_instantiation_via_winrm_and_powershell.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
remote_process_instantiation_via_winrm_and_winrs.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
remote_process_instantiation_via_wmi_and_powershell_script_block.yml
carry over
2023-05-01 12:07:20 -07:00
remote_process_instantiation_via_wmi_and_powershell.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
remote_process_instantiation_via_wmi.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
remote_system_discovery_with_adsisearcher.yml
merged with develop
2023-03-03 12:40:16 +01:00
remote_system_discovery_with_dsquery.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
remote_system_discovery_with_net.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
remote_system_discovery_with_wmic.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
remote_wmi_command_attempt.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
resize_shadowstorage_volume.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
revil_common_exec_parameter.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
revil_registry_entry.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
rubeus_command_line_parameters.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
rubeus_kerberos_ticket_exports_through_winlogon_access.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
runas_execution_in_commandline.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
rundll32_control_rundll_hunt.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
rundll32_control_rundll_world_writable_directory.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
rundll32_create_remote_thread_to_a_process.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
rundll32_createremotethread_in_browser.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
rundll32_dnsquery.yml
Fixed a handful of issues with observables and messages and spacing in content.
2023-10-23 19:49:17 +00:00
rundll32_lockworkstation.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
rundll32_process_creating_exe_dll_files.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
rundll32_shimcache_flush.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
rundll32_with_no_command_line_arguments_with_network.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
rundll_loading_dll_by_ordinal.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
ryuk_test_files_detected.yml
merged with develop
2023-03-03 12:40:16 +01:00
ryuk_wake_on_lan_command.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
sam_database_file_access_attempt.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
samsam_test_file_write.yml
merged with develop
2023-03-03 12:40:16 +01:00
sc_exe_manipulating_windows_services.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
schcache_change_by_app_connect_and_create_adsi_object.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
schedule_task_with_http_command_arguments.yml
new_line_backslash
2023-06-22 16:14:18 -07:00
schedule_task_with_rundll32_command_trigger.yml
new_line_backslash
2023-06-22 16:14:18 -07:00
scheduled_task_creation_on_remote_endpoint_using_at.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
scheduled_task_deleted_or_created_via_cmd.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
scheduled_task_initiation_on_remote_endpoint.yml
updated with proper format
2023-10-13 13:32:37 -07:00
schtasks_run_task_on_demand.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
schtasks_scheduling_job_on_remote_system.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
schtasks_used_for_forcing_a_reboot.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
screensaver_event_trigger_execution.yml
data_destruction_wiper_story
2023-04-14 10:50:14 +02:00
script_execution_via_wmi.yml
updated with proper format
2023-10-13 13:32:37 -07:00
sdclt_uac_bypass.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
sdelete_application_execution.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
searchprotocolhost_with_no_command_line_with_network.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
secretdumps_offline_ntds_dumping_tool.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
serviceprincipalnames_discovery_with_powershell.yml
updates to yamls
2023-08-21 13:50:31 -07:00
serviceprincipalnames_discovery_with_setspn.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
services_escalate_exe.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
services_lolbas_execution_process_spawn.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
shim_database_file_creation.yml
merged with develop
2023-03-03 12:40:16 +01:00
shim_database_installation_with_suspicious_parameters.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
short_lived_scheduled_task.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
short_lived_windows_accounts.yml
updated with proper format
2023-10-13 13:32:37 -07:00
silentcleanup_uac_bypass.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
single_letter_process_on_endpoint.yml
updated descriptions
2023-10-13 13:26:36 -07:00
slui_runas_elevated.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
slui_spawning_a_process.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
spike_in_file_writes.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
spoolsv_spawning_rundll32.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
spoolsv_suspicious_loaded_modules.yml
Merge branch 'develop' into sysmon_fix
2023-09-20 16:22:08 -07:00
spoolsv_suspicious_process_access.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
spoolsv_writing_a_dll___sysmon.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
spoolsv_writing_a_dll.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
sqlite_module_in_temp_folder.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
steal_or_forge_authentication_certificates_behavior_identified.yml
Create steal_or_forge_authentication_certificates_behavior_identified.yml
2023-05-01 11:36:38 -06:00
sunburst_correlation_dll_and_network_event.yml
merged with develop
2023-03-03 12:40:16 +01:00
suspicious_computer_account_name_change.yml
changes for sec 4.0
2023-04-24 17:58:57 -04:00
suspicious_copy_on_system32.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
suspicious_curl_network_connection.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
suspicious_dllhost_no_command_line_arguments.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
suspicious_driver_loaded_path.yml
ESCU 4.25.0 Release branch
2024-02-22 17:14:23 +00:00
suspicious_event_log_service_behavior.yml
updating ysmls for risk
2023-08-21 14:19:56 -07:00
suspicious_gpupdate_no_command_line_arguments.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
suspicious_icedid_rundll32_cmdline.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
suspicious_image_creation_in_appdata_folder.yml
updating ysmls for risk
2023-08-21 14:19:56 -07:00
suspicious_kerberos_service_ticket_request.yml
updating ysmls for risk
2023-08-21 14:19:56 -07:00
suspicious_linux_discovery_commands.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
suspicious_microsoft_workflow_compiler_rename.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
suspicious_microsoft_workflow_compiler_usage.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
suspicious_msbuild_path.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
suspicious_msbuild_rename.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
suspicious_msbuild_spawn.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
suspicious_mshta_child_process.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
suspicious_mshta_spawn.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
suspicious_plistbuddy_usage_via_osquery.yml
merged with develop
2023-03-03 12:40:16 +01:00
suspicious_plistbuddy_usage.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
suspicious_process_dns_query_known_abuse_web_services.yml
ESCU 4.25.0 Release branch
2024-02-22 17:14:23 +00:00
suspicious_process_executed_from_container_file_filter.yml
ESCU 4.25.0 Release branch
2024-02-22 17:14:23 +00:00
suspicious_process_file_path.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
suspicious_process_with_discord_dns_query.yml
updates for failued searches
2023-09-19 15:57:43 -07:00
suspicious_reg_exe_process.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
suspicious_regsvr32_register_suspicious_path.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
suspicious_rundll32_dllregisterserver.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
suspicious_rundll32_no_command_line_arguments.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
suspicious_rundll32_plugininit.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
suspicious_rundll32_startw.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
suspicious_scheduled_task_from_public_directory.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
suspicious_searchprotocolhost_no_command_line_arguments.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
suspicious_sqlite3_lsquarantine_behavior.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
suspicious_ticket_granting_ticket_request.yml
changes for sec 4.0
2023-04-24 17:58:57 -04:00
suspicious_wav_file_in_appdata_folder.yml
updating ysmls for risk
2023-08-21 14:19:56 -07:00
suspicious_wevtutil_usage.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
suspicious_writes_to_windows_recycle_bin.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
svchost_lolbas_execution_process_spawn.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
system_info_gathering_using_dxdiag_application.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
system_information_discovery_detection.yml
ESCU Release Branch v4.27.0
2024-03-20 20:01:18 +00:00
system_processes_run_from_unexpected_locations.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
system_user_discovery_with_query.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
system_user_discovery_with_whoami.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
time_provider_persistence_registry.yml
updating ysmls for risk
2023-08-21 14:19:56 -07:00
trickbot_named_pipe.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
uac_bypass_mmc_load_unsigned_dll.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
uac_bypass_with_colorui_com_object.yml
conflicts
2023-09-21 14:00:46 -07:00
uninstall_app_using_msiexec.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
unknown_process_using_the_kerberos_protocol.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
unload_sysmon_filter_driver.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
unloading_amsi_via_reflection.yml
data_destruction_wiper_story
2023-04-14 10:50:14 +02:00
unusual_number_of_computer_service_tickets_requested.yml
Updating text
2023-12-06 19:54:40 +00:00
unusual_number_of_kerberos_service_tickets_requested.yml
merged with develop
2023-03-03 12:40:16 +01:00
unusual_number_of_remote_endpoint_authentication_events.yml
Updating text
2023-12-06 19:54:40 +00:00
unusually_long_command_line___mltk.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
unusually_long_command_line.yml
updated descriptions
2023-10-13 13:26:36 -07:00
user_discovery_with_env_vars_powershell_script_block.yml
More observable fixes, including renaming fields
2023-09-29 13:19:47 -07:00
user_discovery_with_env_vars_powershell.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
usn_journal_deletion.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
vbscript_execution_using_wscript_app.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
verclsid_clsid_execution.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
w3wp_spawning_shell.yml
fixes
2023-10-01 09:42:31 -06:00
wbadmin_delete_system_backups.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
wbemprox_com_object_execution.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
wermgr_process_connecting_to_ip_check_web_services.yml
Merge branch 'develop' into sysmon_fix
2023-09-20 16:22:08 -07:00
wermgr_process_create_executable_file.yml
merged with develop
2023-03-03 12:40:16 +01:00
wermgr_process_spawned_cmd_or_powershell_process.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
wget_download_and_bash_execution.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_abused_web_services.yml
updated with proper format
2023-10-13 13:32:37 -07:00
windows_access_token_manipulation_sedebugprivilege.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_access_token_manipulation_winlogon_duplicate_token_handle.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
windows_access_token_winlogon_duplicate_handle_in_uncommon_path.yml
Merge branch 'develop' into sysmon_fix
2023-09-20 16:22:08 -07:00
windows_account_discovery_for_none_disable_user_account.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
windows_account_discovery_for_sam_account_name.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_account_discovery_with_netuser_preauthnotrequire.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_ad_abnormal_object_access_activity.yml
minor fixes
2023-09-14 15:45:05 -04:00
windows_ad_adminsdholder_acl_modified.yml
merged with develop
2023-03-16 09:44:35 +01:00
windows_ad_cross_domain_sid_history_addition.yml
merged with develop
2023-03-16 09:44:35 +01:00
windows_ad_domain_controller_audit_policy_disabled.yml
updated descriptions
2023-10-13 13:26:36 -07:00
windows_ad_domain_controller_promotion.yml
merged with develop
2023-03-16 09:44:35 +01:00
windows_ad_domain_replication_acl_addition.yml
updated with proper format
2023-10-13 13:32:37 -07:00
windows_ad_dsrm_account_changes.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_ad_dsrm_password_reset.yml
updated all yml, remove kc,nist,cis, updaated with 3.64.0 new content
2023-04-04 17:15:38 -05:00
windows_ad_privileged_account_sid_history_addition.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_ad_privileged_object_access_activity.yml
update score
2023-09-20 09:42:49 -07:00
windows_ad_replication_request_initiated_by_user_account.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
windows_ad_replication_request_initiated_from_unsanctioned_location.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
windows_ad_same_domain_sid_history_addition.yml
merged with develop
2023-03-16 09:44:35 +01:00
windows_ad_serviceprincipalname_added_to_domain_account.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_ad_short_lived_domain_account_serviceprincipalname.yml
updated another 30
2023-08-21 15:12:49 -07:00
windows_ad_short_lived_domain_controller_spn_attribute.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_ad_short_lived_server_object.yml
merged with develop
2023-03-16 09:44:35 +01:00
windows_ad_sid_history_attribute_modified.yml
merged with develop
2023-03-16 09:44:35 +01:00
windows_adfind_exe.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_admin_permission_discovery.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
windows_administrative_shares_accessed_on_multiple_hosts.yml
security_content_improvement_data_src
2023-07-05 12:53:33 +02:00
windows_admon_default_group_policy_object_modified.yml
changes for sec 4.0
2023-04-24 17:58:57 -04:00
windows_admon_group_policy_object_created.yml
changes for sec 4.0
2023-04-24 17:58:57 -04:00
windows_alternate_datastream___base64_content.yml
US-bug-fix
2024-02-15 18:24:15 +00:00
windows_alternate_datastream___executable_content.yml
US-bug-fix
2024-02-15 18:24:15 +00:00
windows_alternate_datastream___process_execution.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_apache_benchmark_binary.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_app_layer_protocol_qakbot_namedpipe.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
windows_app_layer_protocol_wermgr_connect_to_namedpipe.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml
More observable fixes, including renaming fields
2023-09-29 13:19:47 -07:00
windows_archive_collected_data_via_powershell.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_archive_collected_data_via_rar.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_autoit3_execution.yml
Release branch v4.16.0
2023-11-16 20:33:10 +00:00
windows_autostart_execution_lsass_driver_registry_modification.yml
merged with develop
2023-03-03 12:40:16 +01:00
windows_binary_proxy_execution_mavinject_dll_injection.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_boot_or_logon_autostart_execution_in_startup_folder.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
windows_bootloader_inventory.yml
Branch was auto-updated.
2023-05-15 11:25:33 -07:00
windows_bypass_uac_via_pkgmgr_tool.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_cab_file_on_disk.yml
Release branch v4.16.0
2023-11-16 20:33:10 +00:00
windows_cached_domain_credentials_reg_query.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_change_default_file_association_for_no_file_ext.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_clipboard_data_via_get_clipboard.yml
updated another 30
2023-08-21 15:12:49 -07:00
windows_com_hijacking_inprocserver32_modification.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_command_and_scripting_interpreter_hunting_path_traversal.yml
More observable fixes, including renaming fields
2023-09-29 13:19:47 -07:00
windows_command_and_scripting_interpreter_path_traversal_exec.yml
Fix a large number of searches with observable issues. Discuss with team before merging changes.
2023-09-22 17:10:03 -07:00
windows_command_shell_dcrat_forkbomb_payload.yml
updated with proper format
2023-10-13 13:32:37 -07:00
windows_command_shell_fetch_env_variables.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_common_abused_cmd_shell_risk_behavior.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_computer_account_created_by_computer_account.yml
merged with develop
2023-03-03 12:40:16 +01:00
windows_computer_account_requesting_kerberos_ticket.yml
merged with develop
2023-03-03 12:40:16 +01:00
windows_computer_account_with_spn.yml
merged with develop
2023-03-03 12:40:16 +01:00
windows_conhost_with_headless_argument.yml
Release branch v4.16.0
2023-11-16 20:33:10 +00:00
windows_create_local_account.yml
merged with develop
2023-03-03 12:40:16 +01:00
windows_credential_access_from_browser_password_store.yml
ESCU Release Branch v4.27.0
2024-03-20 20:01:18 +00:00
windows_credential_dumping_lsass_memory_createdump.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
windows_credentials_from_password_stores_chrome_extension_access.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
windows_credentials_from_password_stores_chrome_localstate_access.yml
ESCU 4.25.0 Release branch
2024-02-22 17:14:23 +00:00
windows_credentials_from_password_stores_chrome_login_data_access.yml
ESCU 4.25.0 Release branch
2024-02-22 17:14:23 +00:00
windows_credentials_from_password_stores_creation.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_credentials_from_password_stores_deletion.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_credentials_from_password_stores_query.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_credentials_in_registry_reg_query.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_curl_download_to_suspicious_path.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
windows_curl_upload_to_remote_destination.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_data_destruction_recursive_exec_files_deletion.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
windows_defacement_modify_transcodedwallpaper_file.yml
merged with develop
2023-03-03 12:40:16 +01:00
windows_default_group_policy_object_modified_with_gpme.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_default_group_policy_object_modified.yml
security_content_improvement_data_src
2023-07-05 12:53:33 +02:00
windows_defender_asr_audit_events.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_defender_asr_block_events.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_defender_asr_registry_modification.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_defender_asr_rule_disabled.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_defender_asr_rules_stacking.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_defender_exclusion_registry_entry.yml
updated another 30
2023-08-21 15:12:49 -07:00
windows_delete_or_modify_system_firewall.yml
Update windows_delete_or_modify_system_firewall.yml
2023-09-27 15:37:28 -07:00
windows_deleted_registry_by_a_non_critical_process_file_path.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_disable_change_password_through_registry.yml
updated another 30
2023-08-21 15:12:49 -07:00
windows_disable_lock_workstation_feature_through_registry.yml
updated another 30
2023-08-21 15:12:49 -07:00
windows_disable_logoff_button_through_registry.yml
updated another 30
2023-08-21 15:12:49 -07:00
windows_disable_memory_crash_dump.yml
updated another 30
2023-08-21 15:12:49 -07:00
windows_disable_notification_center.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_disable_or_modify_tools_via_taskkill.yml
Update windows_disable_or_modify_tools_via_taskkill.yml
2023-09-27 15:38:24 -07:00
windows_disable_shutdown_button_through_registry.yml
updated another 30
2023-08-21 15:12:49 -07:00
windows_disable_windows_event_logging_disable_http_logging.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_disable_windows_group_policy_features_through_registry.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_disableantispyware_registry.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_diskcryptor_usage.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_diskshadow_proxy_execution.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_dism_remove_defender.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_dll_search_order_hijacking_hunt_with_sysmon.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_dll_search_order_hijacking_hunt.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_dll_search_order_hijacking_with_iscsicpl.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_dll_side_loading_in_calc.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
windows_dll_side_loading_process_child_of_calc.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_dns_gather_network_info.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_dnsadmins_new_member_added.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_domain_account_discovery_via_get_netcomputer.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_domain_admin_impersonation_indicator.yml
update source
2023-10-12 11:15:44 -07:00
windows_dotnet_binary_in_non_standard_path.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
windows_driver_inventory.yml
merged with develop
2023-03-03 12:40:16 +01:00
windows_driver_load_non_standard_path.yml
updated another 30
2023-08-21 15:12:49 -07:00
windows_drivers_loaded_by_signature.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
windows_enable_win32_scheduledjob_via_registry.yml
Release branch v4.16.0
2023-11-16 20:33:10 +00:00
windows_event_for_service_disabled.yml
do_not_step_on_the_redline
2023-04-25 16:47:38 +02:00
windows_event_log_cleared.yml
merged with develop
2023-03-03 12:40:16 +01:00
windows_event_triggered_image_file_execution_options_injection.yml
merged with develop
2023-03-03 12:40:16 +01:00
windows_excessive_disabled_services_event.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
windows_executable_in_loaded_modules.yml
updating sutffff
2023-09-27 15:51:03 -07:00
windows_execute_arbitrary_commands_with_msdt.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_exfiltration_over_c2_via_invoke_restmethod.yml
fixup to match 4.0
2023-04-13 11:16:43 -07:00
windows_exfiltration_over_c2_via_powershell_uploadstring.yml
fixup to match 4.0
2023-04-13 11:16:43 -07:00
windows_export_certificate.yml
merged with develop
2023-03-03 12:40:16 +01:00
windows_file_share_discovery_with_powerview.yml
changes for sec 4.0
2023-04-24 17:58:57 -04:00
windows_file_transfer_protocol_in_non_common_process_path.yml
ESCU 4.25.0 Release branch
2024-02-22 17:14:23 +00:00
windows_file_without_extension_in_critical_folder.yml
data_destruction_wiper_story
2023-04-14 10:50:14 +02:00
windows_fileless_storage_via_registry.yml
Update windows_fileless_storage_via_registry.yml
2023-09-19 11:38:39 +02:00
windows_files_and_dirs_access_rights_modification_via_icacls.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_find_domain_organizational_units_with_getdomainou.yml
spl fixes
2023-09-14 14:02:06 -07:00
windows_find_interesting_acl_with_findinterestingdomainacl.yml
spl fixes
2023-09-14 14:02:06 -07:00
windows_findstr_gpp_discovery.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_forest_discovery_with_getforestdomain.yml
spl fixes
2023-09-14 14:02:06 -07:00
windows_gather_victim_host_information_camera.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_gather_victim_identity_sam_info.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
windows_gather_victim_network_info_through_ip_check_web_services.yml
ESCU 4.25.0 Release branch
2024-02-22 17:14:23 +00:00
windows_get_adcomputer_unconstrained_delegation_discovery.yml
merged with develop
2023-03-03 12:40:16 +01:00
windows_get_local_admin_with_findlocaladminaccess.yml
spl fixes
2023-09-14 14:02:06 -07:00
windows_group_policy_object_created.yml
security_content_improvement_data_src
2023-07-05 12:53:33 +02:00
windows_hidden_schedule_task_settings.yml
new_line_backslash
2023-06-22 16:14:18 -07:00
windows_hide_notification_features_through_registry.yml
updated another 30
2023-08-21 15:12:49 -07:00
windows_high_file_deletion_frequency.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
windows_hijack_execution_flow_version_dll_side_load.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
windows_hunting_system_account_targeting_lsass.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_identify_protocol_handlers.yml
More observable fixes, including renaming fields
2023-09-29 13:19:47 -07:00
windows_iis_components_add_new_module.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
windows_iis_components_get_webglobalmodule_module_query.yml
fixes
2023-10-01 09:42:31 -06:00
windows_iis_components_module_failed_to_load.yml
merged with develop
2023-03-03 12:40:16 +01:00
windows_iis_components_new_module_added.yml
merged with develop
2023-03-03 12:40:16 +01:00
windows_impair_defense_add_xml_applocker_rules.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_impair_defense_change_win_defender_health_check_intervals.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
windows_impair_defense_change_win_defender_quick_scan_interval.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
windows_impair_defense_change_win_defender_throttle_rate.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
windows_impair_defense_change_win_defender_tracing_level.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
windows_impair_defense_configure_app_install_control.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
windows_impair_defense_define_win_defender_threat_action.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
windows_impair_defense_delete_win_defender_context_menu.yml
merged with develop
2023-03-03 12:40:16 +01:00
windows_impair_defense_delete_win_defender_profile_registry.yml
merged with develop
2023-03-03 12:40:16 +01:00
windows_impair_defense_deny_security_software_with_applocker.yml
merged with develop
2023-03-03 12:40:16 +01:00
windows_impair_defense_disable_controlled_folder_access.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
windows_impair_defense_disable_defender_firewall_and_network.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
windows_impair_defense_disable_defender_protocol_recognition.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
windows_impair_defense_disable_pua_protection.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
windows_impair_defense_disable_realtime_signature_delivery.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
windows_impair_defense_disable_web_evaluation.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
windows_impair_defense_disable_win_defender_app_guard.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
windows_impair_defense_disable_win_defender_compute_file_hashes.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
windows_impair_defense_disable_win_defender_gen_reports.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
windows_impair_defense_disable_win_defender_network_protection.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
windows_impair_defense_disable_win_defender_report_infection.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
windows_impair_defense_disable_win_defender_scan_on_update.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
windows_impair_defense_disable_win_defender_signature_retirement.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
windows_impair_defense_overide_win_defender_phishing_filter.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
windows_impair_defense_override_smartscreen_prompt.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
windows_impair_defense_set_win_defender_smart_screen_level_to_warn.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
windows_impair_defenses_disable_hvci.yml
bug fix validation
2023-04-28 13:53:52 +02:00
windows_impair_defenses_disable_win_defender_auto_logging.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_indicator_removal_via_rmdir.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_indirect_command_execution_via_forfiles.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_indirect_command_execution_via_pcalua.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_indirect_command_execution_via_series_of_forfiles.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_information_discovery_fsutil.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_ingress_tool_transfer_using_explorer.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_input_capture_using_credential_ui_dll.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
windows_installutil_credential_theft.yml
Merge branch 'develop' into sysmon_fix
2023-09-20 16:22:08 -07:00
windows_installutil_in_non_standard_path.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
windows_installutil_remote_network_connection.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_installutil_uninstall_option_with_network.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
windows_installutil_uninstall_option.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_installutil_url_in_command_line.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_iso_lnk_file_creation.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
windows_java_spawning_shells.yml
Release branch v4.16.0
2023-11-16 20:33:10 +00:00
windows_kerberos_local_successful_logon.yml
merged with develop
2023-03-03 12:40:16 +01:00
windows_known_abused_dll_created.yml
ESCU Release Branch v4.27.0
2024-03-20 20:01:18 +00:00
windows_known_graphicalproton_loaded_modules.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_krbrelayup_service_creation.yml
updated another 30
2023-08-21 15:12:49 -07:00
windows_large_number_of_computer_service_tickets_requested.yml
changes for sec 4.0
2023-04-24 17:58:57 -04:00
windows_lateral_tool_transfer_remcom.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_ldifde_directory_object_behavior.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_linked_policies_in_adsi_discovery.yml
More observable fixes, including renaming fields
2023-09-29 13:19:47 -07:00
windows_local_administrator_credential_stuffing.yml
risk fixes
2023-05-01 15:40:15 -07:00
windows_lsa_secrets_nolmhash_registry.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_mail_protocol_in_non_common_process_path.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
windows_mark_of_the_web_bypass.yml
updating moar
2023-09-19 15:26:01 -07:00
windows_masquerading_explorer_as_child_process.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_masquerading_msdtc_process.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_mimikatz_binary_execution.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_mimikatz_crypto_export_file_extensions.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_modify_registry_authenticationleveloverride.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_modify_registry_auto_minor_updates.yml
minor fixes
2023-05-02 12:45:47 -07:00
windows_modify_registry_auto_update_notif.yml
Update windows_modify_registry_auto_update_notif.yml
2023-05-15 12:16:21 +02:00
windows_modify_registry_default_icon_setting.yml
Release branch v4.16.0
2023-11-16 20:33:10 +00:00
windows_modify_registry_disable_restricted_admin.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_modify_registry_disable_toast_notifications.yml
merged with develop
2023-03-03 12:40:16 +01:00
windows_modify_registry_disable_win_defender_raw_write_notif.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_modify_registry_disable_windefender_notifications.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_modify_registry_disable_windows_security_center_notif.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_modify_registry_disableremotedesktopantialias.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_modify_registry_disablesecuritysettings.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_modify_registry_disabling_wer_settings.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_modify_registry_disallow_windows_app.yml
merged with develop
2023-03-03 12:40:16 +01:00
windows_modify_registry_do_not_connect_to_win_update.yml
Update windows_modify_registry_do_not_connect_to_win_update.yml
2023-05-15 12:16:52 +02:00
windows_modify_registry_dontshowui.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_modify_registry_enablelinkedconnections.yml
Risk objects require fields be present
2023-07-18 12:10:59 -05:00
windows_modify_registry_longpathsenabled.yml
Risk objects require fields be present
2023-07-18 12:10:59 -05:00
windows_modify_registry_maxconnectionperserver.yml
warzone_rat2
2023-07-27 11:48:49 +02:00
windows_modify_registry_no_auto_reboot_with_logon_user.yml
Update windows_modify_registry_no_auto_reboot_with_logon_user.yml
2023-05-15 12:17:10 +02:00
windows_modify_registry_no_auto_update.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_modify_registry_nochangingwallpaper.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_modify_registry_proxyenable.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_modify_registry_proxyserver.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_modify_registry_qakbot_binary_data_registry.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_modify_registry_reg_restore.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_modify_registry_regedit_silent_reg_import.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_modify_registry_risk_behavior.yml
updated another 30
2023-08-21 15:12:49 -07:00
windows_modify_registry_suppress_win_defender_notif.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_modify_registry_tamper_protection.yml
Update windows_modify_registry_tamper_protection.yml
2023-05-15 12:17:44 +02:00
windows_modify_registry_updateserviceurlalternate.yml
minor fixes
2023-05-02 12:45:47 -07:00
windows_modify_registry_usewuserver.yml
Update windows_modify_registry_usewuserver.yml
2023-05-02 18:10:27 +02:00
windows_modify_registry_with_md5_reg_key_name.yml
Update windows_modify_registry_with_md5_reg_key_name.yml
2023-09-27 15:40:05 -07:00
windows_modify_registry_wuserver.yml
minor fixes
2023-05-02 12:45:47 -07:00
windows_modify_registry_wustatusserver.yml
Update windows_modify_registry_wustatusserver.yml
2023-05-02 18:09:53 +02:00
windows_modify_show_compress_color_and_info_tip_registry.yml
updated another 30
2023-08-21 15:12:49 -07:00
windows_modify_system_firewall_with_notable_process_path.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
windows_mof_event_triggered_execution_via_wmi.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
windows_moveit_transfer_writing_aspx.yml
updated with proper format
2023-10-13 13:32:37 -07:00
windows_msexchange_management_mailbox_cmdlet_usage.yml
blackbyte_campaign
2023-07-10 12:55:29 +02:00
windows_mshta_execution_in_registry.yml
updated another 30
2023-08-21 15:12:49 -07:00
windows_msiexec_dllregisterserver.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_msiexec_hidewindow_rundll32_execution.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
windows_msiexec_remote_download.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_msiexec_spawn_discovery_command.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_msiexec_spawn_windbg.yml
Release branch v4.16.0
2023-11-16 20:33:10 +00:00
windows_msiexec_unregister_dllregisterserver.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_msiexec_with_network_connections.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
windows_multi_hop_proxy_tor_website_query.yml
updates for failued searches
2023-09-19 15:57:43 -07:00
windows_multiple_account_passwords_changed.yml
ESCU v4.26.0 Release branch
2024-03-06 19:30:20 +00:00
windows_multiple_accounts_deleted.yml
ESCU v4.26.0 Release branch
2024-03-06 19:30:20 +00:00
windows_multiple_accounts_disabled.yml
ESCU v4.26.0 Release branch
2024-03-06 19:30:20 +00:00
windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml
password spray
2023-05-25 06:35:11 -06:00
windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml
password spray
2023-05-25 06:35:11 -06:00
windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml
password spray
2023-05-25 06:35:11 -06:00
windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml
password spray
2023-05-25 06:35:11 -06:00
windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml
password spray
2023-05-25 06:35:11 -06:00
windows_multiple_users_failed_to_authenticate_from_process.yml
updated another 30
2023-08-21 15:12:49 -07:00
windows_multiple_users_failed_to_authenticate_using_kerberos.yml
password spray
2023-05-25 06:35:11 -06:00
windows_multiple_users_remotely_failed_to_authenticate_from_host.yml
updated another 30
2023-08-21 15:12:49 -07:00
windows_ngrok_reverse_proxy_usage.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_nirsoft_advancedrun.yml
Merge branch 'release_v4.12.0' into Edit_How_To_Implement
2023-09-15 12:52:51 -07:00
windows_nirsoft_utilities.yml
More observable fixes, including renaming fields
2023-09-29 13:19:47 -07:00
windows_non_discord_app_access_discord_leveldb.yml
ESCU 4.25.0 Release branch
2024-02-22 17:14:23 +00:00
windows_non_system_account_targeting_lsass.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_odbcconf_hunting.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_odbcconf_load_dll.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_odbcconf_load_response_file.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_office_product_spawning_msdt.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_papercut_ng_spawn_shell.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_parent_pid_spoofing_with_explorer.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_password_managers_discovery.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_phishing_pdf_file_executes_url_link.yml
ESCU 4.25.0 Release branch
2024-02-22 17:14:23 +00:00
windows_phishing_recent_iso_exec_registry.yml
warzone_rat
2023-07-26 14:53:43 +02:00
windows_possible_credential_dumping.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_post_exploitation_risk_behavior.yml
updating the remainder of yamls
2023-08-21 15:58:35 -07:00
windows_powershell_add_module_to_global_assembly_cache.yml
merged with develop
2023-03-03 12:40:16 +01:00
windows_powershell_cryptography_namespace.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_powershell_disable_http_logging.yml
merged with develop
2023-03-03 12:40:16 +01:00
windows_powershell_export_certificate.yml
Add missing tests to detections.
2023-07-31 16:27:16 -07:00
windows_powershell_export_pfxcertificate.yml
dataset link updates
2023-03-29 19:25:15 -05:00
windows_powershell_get_ciminstance_remote_computer.yml
Release branch v4.16.0
2023-11-16 20:33:10 +00:00
windows_powershell_iis_components_webglobalmodule_usage.yml
merged with develop
2023-03-03 12:40:16 +01:00
windows_powershell_import_applocker_policy.yml
updating the remainder of yamls
2023-08-21 15:58:35 -07:00
windows_powershell_remotesigned_file.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_powershell_scheduletask.yml
new line errror
2023-06-27 16:12:35 -07:00
windows_powershell_wmi_win32_scheduledjob.yml
updating the remainder of yamls
2023-08-21 15:58:35 -07:00
windows_powersploit_gpp_discovery.yml
fixing test metadata
2023-04-24 18:36:35 -04:00
windows_powerview_ad_access_control_list_enumeration.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
windows_powerview_constrained_delegation_discovery.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_powerview_kerberos_service_ticket_request.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
windows_powerview_spn_discovery.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_powerview_unconstrained_delegation_discovery.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_private_keys_discovery.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_privilege_escalation_suspicious_process_elevation.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
windows_privilege_escalation_system_process_without_system_parent.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
windows_privilege_escalation_user_process_spawn_system_process.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
windows_process_commandline_discovery.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_process_injection_in_non_service_searchindexer.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
windows_process_injection_into_notepad.yml
fixes
2023-08-21 18:02:33 -07:00
windows_process_injection_of_wermgr_to_known_browser.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
windows_process_injection_remote_thread.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
windows_process_injection_wermgr_child_process.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_process_injection_with_public_source_path.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
windows_process_with_namedpipe_commandline.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_processes_killed_by_industroyer2_malware.yml
data_destruction_wiper_story
2023-04-14 10:50:14 +02:00
windows_protocol_tunneling_with_plink.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_proxy_via_netsh.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_proxy_via_registry.yml
volt_typhoon_2
2023-05-25 15:42:09 +02:00
windows_query_registry_browser_list_application.yml
minor fixes
2023-05-02 12:55:11 -07:00
windows_query_registry_reg_save.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_query_registry_uninstall_program_list.yml
minor fixes
2023-05-02 12:55:11 -07:00
windows_raccine_scheduled_task_deletion.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_rapid_authentication_on_multiple_hosts.yml
risk fixes
2023-05-01 15:40:15 -07:00
windows_rasautou_dll_execution.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_raw_access_to_disk_volume_partition.yml
Merge branch 'develop' into njrat
2023-09-27 14:35:11 -07:00
windows_raw_access_to_master_boot_record_drive.yml
Minor search fixes for
2023-09-29 14:17:05 -07:00
windows_rdp_connection_successful.yml
blackbyte_campaign
2023-07-10 12:55:29 +02:00
windows_registry_bootexecute_modification.yml
fix for bootexecute
2023-05-16 10:17:41 -06:00
windows_registry_certificate_added.yml
fixed required fields
2023-05-04 10:49:10 -06:00
windows_registry_delete_task_sd.yml
new_line_backslash
2023-06-22 16:14:18 -07:00
windows_registry_modification_for_safe_mode_persistence.yml
fixed required fields
2023-05-04 10:49:10 -06:00
windows_registry_payload_injection.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
windows_registry_sip_provider_modification.yml
Create windows_registry_sip_provider_modification.yml
2023-10-10 14:27:49 -06:00
windows_regsvr32_renamed_binary.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_remote_access_software_brc4_loaded_dll.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
windows_remote_access_software_hunt.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_remote_access_software_rms_registry.yml
merged with develop
2023-03-03 12:40:16 +01:00
windows_remote_assistance_spawning_process.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_remote_create_service.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_remote_service_rdpwinst_tool_execution.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_remote_services_allow_rdp_in_firewall.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_remote_services_allow_remote_assistance.yml
merged with develop
2023-03-03 12:40:16 +01:00
windows_remote_services_rdp_enable.yml
merged with develop
2023-03-03 12:40:16 +01:00
windows_replication_through_removable_media.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
windows_root_domain_linked_policies_discovery.yml
Minor search fixes for
2023-09-29 14:17:05 -07:00
windows_rundll32_apply_user_settings_changes.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_rundll32_webdav_request.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_rundll32_webdav_with_network_connection.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
windows_scheduled_task_created_via_xml.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
windows_scheduled_task_service_spawned_shell.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
windows_scheduled_task_with_highest_privileges.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_schtasks_create_run_as_system.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_screen_capture_via_powershell.yml
fixup to match 4.0
2023-04-13 11:16:43 -07:00
windows_security_account_manager_stopped.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
windows_security_support_provider_reg_query.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_server_software_component_gacutil_install_to_gac.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_service_create_kernel_mode_driver.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_service_create_remcomsvc.yml
Release branch v4.16.0
2023-11-16 20:33:10 +00:00
windows_service_create_sliverc2.yml
updating the remainder of yamls
2023-08-21 15:58:35 -07:00
windows_service_create_with_tscon.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_service_created_with_suspicious_service_path.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_service_created_within_public_path.yml
last of snake
2023-05-15 13:19:56 -06:00
windows_service_creation_on_remote_endpoint.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_service_creation_using_registry_entry.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_service_deletion_in_registry.yml
Release v4.15.0
2023-11-01 19:24:56 +00:00
windows_service_initiation_on_remote_endpoint.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_service_stop_by_deletion.yml
Fix a large number of searches with observable issues. Discuss with team before merging changes.
2023-09-22 17:10:03 -07:00
windows_service_stop_via_net__and_sc_application.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_service_stop_win_updates.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_sip_provider_inventory.yml
macros error
2023-10-13 11:55:25 -07:00
windows_sip_winverifytrust_failed_trust_validation.yml
Trust this
2023-10-10 16:26:22 -06:00
windows_snake_malware_file_modification_crmlog.yml
Update windows_snake_malware_file_modification_crmlog.yml
2023-05-15 15:22:22 -07:00
windows_snake_malware_kernel_driver_comadmin.yml
Atomic GUIDs
2023-05-15 09:17:57 -06:00
windows_snake_malware_registry_modification_wav_openwithprogids.yml
Atomic GUIDs
2023-05-15 09:17:57 -06:00
windows_snake_malware_service_create.yml
updating the remainder of yamls
2023-08-21 15:58:35 -07:00
windows_soaphound_binary_execution.yml
ESCU Release Branch v4.27.0
2024-03-20 20:01:18 +00:00
windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml
updates for failued searches
2023-09-19 15:57:43 -07:00
windows_spearphishing_attachment_onenote_spawn_mshta.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_special_privileged_logon_on_multiple_hosts.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_sql_spawning_certutil.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_steal_authentication_certificates___esc1_abuse.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_steal_authentication_certificates___esc1_authentication.yml
updating files and metadata
2023-10-06 10:15:47 -07:00
windows_steal_authentication_certificates_certificate_issued.yml
security_content_improvement_data_src
2023-07-05 12:53:33 +02:00
windows_steal_authentication_certificates_certificate_request.yml
security_content_improvement_data_src
2023-07-05 12:53:33 +02:00
windows_steal_authentication_certificates_certutil_backup.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_steal_authentication_certificates_cryptoapi.yml
merged with develop
2023-03-03 12:40:16 +01:00
windows_steal_authentication_certificates_cs_backup.yml
security_content_improvement_data_src
2023-07-05 12:53:33 +02:00
windows_steal_authentication_certificates_export_certificate.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_steal_authentication_certificates_export_pfxcertificate.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_steal_or_forge_kerberos_tickets_klist.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_suspect_process_with_authentication_traffic.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_system_discovery_using_ldap_nslookup.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_system_discovery_using_qwinsta.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_system_file_on_disk.yml
merged with develop
2023-03-03 12:40:16 +01:00
windows_system_logoff_commandline.yml
Merge branch 'develop' into njrat
2023-09-27 14:35:11 -07:00
windows_system_network_config_discovery_display_dns.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_system_network_connections_discovery_netsh.yml
ESCU 4.25.0 Release branch
2024-02-22 17:14:23 +00:00
windows_system_reboot_commandline.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_system_script_proxy_execution_syncappvpublishingserver.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_system_shutdown_commandline.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
windows_system_time_discovery_w32tm_delay.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_system_user_discovery_via_quser.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_system_user_privilege_discovery.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
windows_terminating_lsass_process.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
windows_time_based_evasion_via_choice_exec.yml
ESCU 4.25.0 Release branch
2024-02-22 17:14:23 +00:00
windows_time_based_evasion.yml
updating sutffff
2023-09-27 15:51:03 -07:00
windows_uac_bypass_suspicious_child_process.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
windows_uac_bypass_suspicious_escalation_behavior.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
windows_unsecured_outlook_credentials_access_in_registry.yml
ESCU 4.25.0 Release branch
2024-02-22 17:14:23 +00:00
windows_unsigned_dll_side_loading.yml
Branch was auto-updated.
2023-09-27 15:21:04 -07:00
windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.yml
password spray
2023-05-25 06:35:11 -06:00
windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml
password spray
2023-05-25 06:35:11 -06:00
windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml
More observable fixes, including renaming fields
2023-09-29 13:19:47 -07:00
windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml
password spray
2023-05-25 06:35:11 -06:00
windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml
password spray
2023-05-25 06:35:11 -06:00
windows_unusual_count_of_users_failed_to_authenticate_from_process.yml
password spray
2023-05-25 06:35:11 -06:00
windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml
password spray
2023-05-25 06:35:11 -06:00
windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml
password spray
2023-05-25 06:35:11 -06:00
windows_user_execution_malicious_url_shortcut_file.yml
ESCU 4.25.0 Release branch
2024-02-22 17:14:23 +00:00
windows_valid_account_with_never_expires_password.yml
Fix a large number of searches with observable issues. Discuss with team before merging changes.
2023-09-22 17:10:03 -07:00
windows_vulnerable_3cx_software.yml
Update windows_vulnerable_3cx_software.yml
2023-09-28 10:58:04 -07:00
windows_vulnerable_driver_loaded.yml
blackbyte_campaign
2023-07-10 12:55:29 +02:00
windows_windbg_spawning_autoit3.yml
Release branch v4.16.0
2023-11-16 20:33:10 +00:00
windows_winlogon_with_public_network_connection.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
windows_wmi_impersonate_token.yml
More observable fixes, including renaming fields
2023-09-29 13:19:47 -07:00
windows_wmi_process_and_service_list.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_wmi_process_call_create.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
winevent_scheduled_task_created_to_spawn_shell.yml
Windows Error Reporting Service Elevation of Privilege Vulnerability
2023-08-24 11:20:18 -06:00
winevent_scheduled_task_created_within_public_path.yml
ESCU 4.25.0 Release branch
2024-02-22 17:14:23 +00:00
winevent_windows_task_scheduler_event_action_started.yml
fix merge conflicts
2023-06-23 16:20:54 +02:00
winhlp32_spawning_a_process.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
winrar_spawning_shell_application.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
winrm_spawning_a_process.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
winword_spawning_cmd.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
winword_spawning_powershell.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
winword_spawning_windows_script_host.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
wmi_permanent_event_subscription___sysmon.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
wmi_permanent_event_subscription.yml
updated descriptions
2023-10-13 13:26:36 -07:00
wmi_recon_running_process_or_services.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
wmi_temporary_event_subscription.yml
updated with proper format
2023-10-13 13:32:37 -07:00
wmic_group_discovery.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
wmic_noninteractive_app_uninstallation.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
wmic_xsl_execution_via_url.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
wmiprsve_lolbas_execution_process_spawn.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
wscript_or_cscript_suspicious_child_process.yml
Merge branch 'develop' into njrat
2023-09-27 14:35:11 -07:00
wsmprovhost_lolbas_execution_process_spawn.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
wsreset_uac_bypass.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
xmrig_driver_loaded.yml
testing a change for sysmon
2023-09-19 15:17:24 -07:00
xsl_script_execution_with_wmic.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00