d1vious 1e731ee7af modify experimental detections to say not supported

2022-01-03 12:03:34 -05:00

..

active_directory_discovery.md

updating docs and package bits [ci skip]

2021-12-02 18:50:01 +00:00

active_directory_lateral_movement.md

updating docs

2021-12-09 13:51:31 -05:00

active_directory_password_spraying.md

adding cves to docs

2021-10-25 21:05:57 -04:00

apache_struts_vulnerability.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

asset_tracking.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

aws_cross_account_activity.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

aws_iam_privilege_escalation.md

adding cves to docs

2021-10-25 21:05:57 -04:00

aws_network_acl_activity.md

adding cves to docs

2021-10-25 21:05:57 -04:00

aws_privilege_escalation.md

added analytic stories, cleaned up view a bit

2021-09-12 20:39:15 -04:00

aws_security_hub_alerts.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

aws_user_monitoring.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

baron_samedit_cve-2021-3156.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

bits_jobs.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

blackmatter_ransomware.md

adding cves to docs

2021-10-25 21:05:57 -04:00

brand_monitoring.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

clop_ransomware.md

Another playbook

2021-12-14 19:24:32 -06:00

cloud_cryptomining.md

adding cves to docs

2021-10-25 21:05:57 -04:00

cloud_federated_credential_abuse.md

adding cves to docs

2021-10-25 21:05:57 -04:00

cobalt_strike.md

updating docs and package bits [ci skip]

2021-12-02 18:50:01 +00:00

coldroot_macos_rat.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

collection_and_staging.md

adding cves to docs

2021-10-25 21:05:57 -04:00

command_and_control.md

updating docs

2021-12-09 13:51:31 -05:00

container_implantation_monitoring_and_investigation.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

credential_dumping.md

modify experimental detections to say not supported

2022-01-03 12:03:34 -05:00

darkside_ransomware.md

updating docs

2021-12-09 13:51:31 -05:00

data_exfiltration.md

updating docs

2021-12-09 13:51:31 -05:00

data_protection.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

deobfuscate-decode_files_or_information.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

detect_zerologon_attack.md

adding cves to docs

2021-10-25 21:05:57 -04:00

dev_sec_ops.md

adding cves to docs

2021-10-25 21:05:57 -04:00

dhs_report_ta18-074a.md

adding cves to docs

2021-10-25 21:05:57 -04:00

disabling_security_tools.md

adding cves to docs

2021-10-25 21:05:57 -04:00

dns_amplification_attacks.md

adding cves to docs

2021-10-25 21:05:57 -04:00

dns_hijacking.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

domain_trust_discovery.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

dynamic_dns.md

updating docs

2021-12-09 13:51:31 -05:00

emotet_malware__dhs_report_ta18-201a_.md

adding cves to docs

2021-10-25 21:05:57 -04:00

f5_tmui_rce_cve-2020-5902.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

fin7.md

adding cves to docs

2021-10-25 21:05:57 -04:00

gcp_cross_account_activity.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

hafnium_group.md

adding cves to docs

2021-10-25 21:05:57 -04:00

hidden_cobra_malware.md

adding cves to docs

2021-10-25 21:05:57 -04:00

icedid.md

updating docs and package bits [ci skip]

2021-12-02 18:50:01 +00:00

information_sabotage.md

updating docs and package bits [ci skip]

2021-12-02 18:50:01 +00:00

ingress_tool_transfer.md

Another playbook

2021-12-14 19:24:32 -06:00

jboss_vulnerability.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

kubernetes_scanning_activity.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

kubernetes_sensitive_object_access_activity.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

lateral_movement.md

updating docs and package bits [ci skip]

2021-12-02 18:50:01 +00:00

log4shell_cve-2021-44228.md

updating docs

2021-12-14 21:40:19 -05:00

malicious_powershell.md

updating docs

2021-12-09 13:51:31 -05:00

masquerading_-_rename_system_utilities.md

updating docs and package bits [ci skip]

2021-12-02 18:50:01 +00:00

meterpreter.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

microsoft_mshtml_remote_code_execution_cve-2021-40444.md

adding cves to docs

2021-10-25 21:05:57 -04:00

monitor_for_updates.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

netsh_abuse.md

adding cves to docs

2021-10-25 21:05:57 -04:00

nobelium_group.md

updating docs and package bits [ci skip]

2021-12-02 18:50:01 +00:00

office_365_detections.md

adding cves to docs

2021-10-25 21:05:57 -04:00

orangeworm_attack_group.md

adding cves to docs

2021-10-25 21:05:57 -04:00

petitpotam_ntlm_relay_on_active_directory_certificate_services.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.md

adding cves to docs

2021-10-25 21:05:57 -04:00

printnightmare_cve-2021-34527.md

adding cves to docs

2021-10-25 21:05:57 -04:00

prohibited_traffic_allowed_or_protocol_mismatch.md

adding cves to docs

2021-10-25 21:05:57 -04:00

proxyshell.md

adding cves to docs

2021-10-25 21:05:57 -04:00

ransomware_cloud.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

ransomware.md

updating docs

2021-12-09 13:51:31 -05:00

remcos.md

updating docs and package bits [ci skip]

2021-12-02 18:50:01 +00:00

revil_ransomware.md

adding cves to docs

2021-10-25 21:05:57 -04:00

router_and_infrastructure_security.md

updating docs and package bits [ci skip]

2021-12-02 18:50:01 +00:00

ryuk_ransomware.md

updating docs

2021-12-09 13:51:31 -05:00

samaccountname_spoofing_and_domain_controller_impersonation.md

modify experimental detections to say not supported

2022-01-03 12:03:34 -05:00

samsam_ransomware.md

adding cves to docs

2021-10-25 21:05:57 -04:00

signed_binary_proxy_execution_installutil.md

updating docs and package bits [ci skip]

2021-12-02 18:50:01 +00:00

silver_sparrow.md

adding cves to docs

2021-10-25 21:05:57 -04:00

spearphishing_attachments.md

updating docs and package bits [ci skip]

2021-11-10 16:16:30 +00:00

sql_injection.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

suspicious_aws_login_activities.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

suspicious_aws_s3_activities.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

suspicious_aws_traffic.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

suspicious_cloud_authentication_activities.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

suspicious_cloud_instance_activities.md

adding cves to docs

2021-10-25 21:05:57 -04:00

suspicious_cloud_provisioning_activities.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

suspicious_cloud_user_activities.md

adding cves to docs

2021-10-25 21:05:57 -04:00

suspicious_command-line_executions.md

fixing bug with dead links

2021-12-15 14:35:04 -05:00

suspicious_compiled_html_activity.md

adding cves to docs

2021-10-25 21:05:57 -04:00

suspicious_dns_traffic.md

updating docs

2021-12-09 13:51:31 -05:00

suspicious_emails.md

adding cves to docs

2021-10-25 21:05:57 -04:00

suspicious_gcp_storage_activities.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

suspicious_mshta_activity.md

updating docs

2021-11-10 14:41:56 -05:00

suspicious_okta_activity.md

adding cves to docs

2021-10-25 21:05:57 -04:00

suspicious_regsvcs_regasm_activity.md

adding cves to docs

2021-10-25 21:05:57 -04:00

suspicious_regsvr32_activity.md

updating docs and package bits [ci skip]

2021-12-02 18:50:01 +00:00

suspicious_rundll32_activity.md

adding cves to docs

2021-10-25 21:05:57 -04:00

suspicious_windows_registry_activities.md

adding cves to docs

2021-10-25 21:05:57 -04:00

suspicious_wmi_use.md

updating docs and package bits [ci skip]

2021-12-02 18:50:01 +00:00

suspicious_zoom_child_processes.md

updating docs

2021-11-10 14:41:56 -05:00

trickbot.md

updating docs and package bits [ci skip]

2021-12-02 18:50:01 +00:00

trusted_developer_utilities_proxy_execution_msbuild.md

adding cves to docs

2021-10-25 21:05:57 -04:00

trusted_developer_utilities_proxy_execution.md

adding cves to docs

2021-10-25 21:05:57 -04:00

unusual_processes.md

updating docs

2021-12-09 13:51:31 -05:00

use_of_cleartext_protocols.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

windows_defense_evasion_tactics.md

updating docs and package bits [ci skip]

2021-12-02 18:50:01 +00:00

windows_discovery_techniques.md

updating docs

2021-12-09 13:51:31 -05:00

windows_dns_sigred_cve-2020-1350.md

fixing up base on feedback

2021-10-11 18:18:23 -04:00

windows_file_extension_and_association_abuse.md

adding cves to docs

2021-10-25 21:05:57 -04:00

windows_log_manipulation.md

updating docs

2021-12-09 13:51:31 -05:00

windows_persistence_techniques.md

updating docs

2021-12-09 13:51:31 -05:00

windows_privilege_escalation.md

updating docs

2021-12-09 13:51:31 -05:00

windows_service_abuse.md

updating docs

2021-12-09 13:51:31 -05:00

xmrig.md

updating docs

2021-12-09 13:51:31 -05:00