pyth0n1c 8b675ad971 More detections have been updated. there are still a few with extra whitespace that must be taken care of

2024-09-24 17:04:43 -07:00

..

abnormally_high_aws_instances_launched_by_user___mltk.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

abnormally_high_aws_instances_launched_by_user.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

abnormally_high_aws_instances_terminated_by_user___mltk.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

abnormally_high_aws_instances_terminated_by_user.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

asl_aws_createaccesskey.yml

Release Branch - ESCU v4.32.0

2024-05-22 16:47:39 +00:00

asl_aws_excessive_security_scanning.yml

Missed version and date updates

2024-08-16 08:41:51 -05:00

asl_aws_password_policy_changes.yml

Release Branch - ESCU v4.32.0

2024-05-22 16:47:39 +00:00

aws_cloud_provisioning_from_previously_unseen_city.yml

second pass at fixing whitespace and related update fields

2024-09-24 16:53:25 -07:00

aws_cloud_provisioning_from_previously_unseen_country.yml

second pass at fixing whitespace and related update fields

2024-09-24 16:53:25 -07:00

aws_cloud_provisioning_from_previously_unseen_ip_address.yml

second pass at fixing whitespace and related update fields

2024-09-24 16:53:25 -07:00

aws_cloud_provisioning_from_previously_unseen_region.yml

TR-3867

2024-08-29 08:26:56 -05:00

aws_eks_kubernetes_cluster_sensitive_object_access.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

clients_connecting_to_multiple_dns_servers.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

cloud_network_access_control_list_deleted.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

correlation_by_repository_and_risk.yml

Release v4.24.0

2024-02-14 23:54:00 +00:00

correlation_by_user_and_risk.yml

Release v4.24.0

2024-02-14 23:54:00 +00:00

detect_activity_related_to_pass_the_hash_attacks.yml

No More Haag-gling with BlackSuit: A Tailored Analytic Story

2024-08-26 13:27:08 -06:00

detect_api_activity_from_users_without_mfa.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

detect_aws_api_activities_from_unapproved_accounts.yml

TR-3867

2024-08-29 08:26:56 -05:00

detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml

Missed version and date updates

2024-08-16 08:41:51 -05:00

detect_long_dns_txt_record_response.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

detect_mimikatz_using_loaded_images.yml

Improved data sources

2024-07-17 14:41:50 +02:00

detect_mimikatz_via_powershell_and_eventcode_4703.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

detect_new_api_calls_from_user_roles.yml

Missed a date & version bump

2024-08-19 12:00:27 -05:00

detect_new_user_aws_console_login.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

detect_spike_in_aws_api_activity.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

detect_spike_in_network_acl_activity.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

detect_spike_in_security_group_activity.yml

Missed version and date updates

2024-08-16 08:41:51 -05:00

detect_usb_device_insertion.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

detect_web_traffic_to_dynamic_domain_providers.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

detection_of_dns_tunnels.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

dns_query_requests_resolved_by_unauthorized_dns_servers.yml

Missed version and date updates

2024-08-16 08:41:51 -05:00

dns_record_changed.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

dump_lsass_via_procdump_rename.yml

missed deprecated

2024-08-19 10:31:55 -05:00

ec2_instance_modified_with_previously_unseen_user.yml

Missed version and date updates

2024-08-16 08:41:51 -05:00

ec2_instance_started_in_previously_unseen_region.yml

Missed version and date updates

2024-08-16 08:41:51 -05:00

ec2_instance_started_with_previously_unseen_ami.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

ec2_instance_started_with_previously_unseen_instance_type.yml

Missed version and date updates

2024-08-16 08:41:51 -05:00

ec2_instance_started_with_previously_unseen_user.yml

Missed version and date updates

2024-08-16 08:41:51 -05:00

execution_of_file_with_spaces_before_extension.yml

Missed version and date updates

2024-08-16 08:41:51 -05:00

extended_period_without_successful_netbackup_backups.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

first_time_seen_command_line_argument.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

gcp_detect_accounts_with_high_risk_roles_by_project.yml

missed deprecated

2024-08-19 10:31:55 -05:00

gcp_detect_high_risk_permissions_by_resource_and_account.yml

Missed version and date updates

2024-08-16 08:41:51 -05:00

gcp_detect_oauth_token_abuse.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

gcp_kubernetes_cluster_scan_detection.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

identify_new_user_accounts.yml

Missed version and date updates

2024-08-16 08:41:51 -05:00

kubernetes_aws_detect_most_active_service_accounts_by_pod.yml

Missed version and date updates

2024-08-16 08:41:51 -05:00

kubernetes_aws_detect_rbac_authorization_by_account.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

kubernetes_aws_detect_sensitive_role_access.yml

second pass at fixing whitespace and related update fields

2024-09-24 16:53:25 -07:00

kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml

Missed version and date updates

2024-08-16 08:41:51 -05:00

kubernetes_azure_active_service_accounts_by_pod_namespace.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

kubernetes_azure_detect_rbac_authorization_by_account.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

kubernetes_azure_detect_sensitive_object_access.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

kubernetes_azure_detect_sensitive_role_access.yml

second pass at fixing whitespace and related update fields

2024-09-24 16:53:25 -07:00

kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

kubernetes_azure_detect_suspicious_kubectl_calls.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

kubernetes_azure_pod_scan_fingerprint.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

kubernetes_azure_scan_fingerprint.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml

Missed version and date updates

2024-08-16 08:41:51 -05:00

kubernetes_gcp_detect_rbac_authorizations_by_account.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

kubernetes_gcp_detect_sensitive_object_access.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

kubernetes_gcp_detect_sensitive_role_access.yml

More detections have been updated. there are still a few with extra whitespace that must be taken care of

2024-09-24 17:04:43 -07:00

kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml

Missed version and date updates

2024-08-16 08:41:51 -05:00

kubernetes_gcp_detect_suspicious_kubectl_calls.yml

Missed version and date updates

2024-08-16 08:41:51 -05:00

monitor_dns_for_brand_abuse.yml

Missed version and date updates

2024-08-16 08:41:51 -05:00

multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

o365_suspicious_admin_email_forwarding.yml

ESCU Release v4.31.0

2024-05-08 16:05:40 +00:00

o365_suspicious_rights_delegation.yml

ESCU Release v4.31.0

2024-05-08 16:05:40 +00:00

o365_suspicious_user_email_forwarding.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

okta_account_locked_out.yml

ESCU Release Branch - v4.30.0

2024-04-17 20:44:56 +00:00

okta_account_lockout_events.yml

ESCU Release Branch - v4.30.0

2024-04-17 20:44:56 +00:00

okta_failed_sso_attempts.yml

Release Branch - ESCU v4.34.0

2024-06-26 14:41:53 +00:00

okta_threatinsight_login_failure_with_high_unknown_users.yml

Missed version and date updates

2024-08-16 08:41:51 -05:00

okta_threatinsight_suspected_passwordspray_attack.yml

Missed version and date updates

2024-08-16 08:41:51 -05:00

okta_two_or_more_rejected_okta_pushes.yml

Missed version and date updates

2024-08-16 08:41:51 -05:00

osquery_pack___coldroot_detection.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

processes_created_by_netsh.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

prohibited_software_on_endpoint.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

reg_exe_used_to_hide_files_directories_via_registry_keys.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

remote_registry_key_modifications.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

scheduled_tasks_used_in_badrabbit_ransomware.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

spectre_and_meltdown_vulnerable_systems.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

suspicious_changes_to_file_associations.yml

Missed version and date updates

2024-08-16 08:41:51 -05:00

suspicious_email___uba_anomaly.yml

Missed version and date updates

2024-08-16 08:41:51 -05:00

suspicious_file_write.yml

Missed version and date updates

2024-08-16 08:41:51 -05:00

suspicious_powershell_command_line_arguments.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

suspicious_rundll32_rename.yml

Improved data sources

2024-07-17 14:41:50 +02:00

suspicious_writes_to_system_volume_information.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

uncommon_processes_on_endpoint.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

unsigned_image_loaded_by_lsass.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

unsuccessful_netbackup_backups.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

web_fraud___account_harvesting.yml

Missed version and date updates

2024-08-16 08:41:51 -05:00

web_fraud___anomalous_user_clickspeed.yml

Missed version and date updates

2024-08-16 08:41:51 -05:00

web_fraud___password_sharing_across_accounts.yml

Deprecated Detections

2024-08-15 15:37:43 -05:00

windows_connhost_exe_started_forcefully.yml

More detections have been updated. there are still a few with extra whitespace that must be taken care of

2024-09-24 17:04:43 -07:00

windows_dll_search_order_hijacking_hunt.yml

Improved data sources

2024-07-17 14:41:50 +02:00

windows_hosts_file_modification.yml

Missed version and date updates

2024-08-16 08:41:51 -05:00