research bot 2783c3fe43 updating docs and package bits [ci skip]

2021-09-09 19:07:07 +00:00

..

.untested

detection/experimental folder for untested detections

2020-11-06 10:37:11 -08:00

child_processes_of_spoolsv_exe.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

detect_baron_samedit_cve_2021_3156_segfault.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

detect_baron_samedit_cve_2021_3156_via_osquery.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

detect_baron_samedit_cve_2021_3156.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

detect_outlook_exe_writing_a_zip_file.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

detect_rare_executables.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

detection_of_tools_built_by_nirsoft.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

exchange_powershell_abuse_via_ssrf.yml

updating docs and package bits [ci skip]

2021-09-09 19:07:07 +00:00

exchange_powershell_module_usage.yml

updating docs and package bits [ci skip]

2021-09-09 19:07:07 +00:00

first_time_seen_running_windows_service.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

macos___re_opened_applications.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

processes_tapping_keyboard_events.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

remote_desktop_process_running_on_system.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

spike_in_file_writes.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

sunburst_correlation_dll_and_network_event.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

suspicious_curl_network_connection.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

suspicious_plistbuddy_usage_via_osquery.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

suspicious_plistbuddy_usage.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

suspicious_sqlite3_lsquarantine_behavior.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

unusually_long_command_line___mltk.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

windows_adfind_exe.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

winrm_spawning_a_process.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

wmi_permanent_event_subscription.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

wmi_temporary_event_subscription.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00