mvelazco 19bd2fd736 updating sysmon macro

2021-12-13 18:00:14 -05:00

..

aws_cloudwatchlogs_eks.yml

new generate script

2020-05-06 17:42:38 +02:00

aws_config.yml

converted response_task to investigations

2021-07-26 13:39:17 +02:00

aws_description.yml

converted response_task to investigations

2021-07-26 13:39:17 +02:00

aws_ecr_users.yml

container upload aws ecr

2021-08-19 15:51:17 +02:00

aws_s3_accesslogs.yml

new generate script

2020-05-06 17:42:38 +02:00

aws_securityhub_finding.yml

rename

2021-01-26 19:28:03 -08:00

aws_securityhub_firehose.yml

converted response_task to investigations

2021-07-26 13:39:17 +02:00

brand_abuse_dns.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

brand_abuse_email.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

brand_abuse_web.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

circleci.yml

circle ci detecction

2021-09-01 17:54:38 +02:00

cisco_networks.yml

Adding macros

2020-08-12 09:17:32 +02:00

cloud_api_calls_from_previously_unseen_user_roles_activity_window.yml

single and double quote order issue

2020-09-23 17:32:52 -05:00

cloudtrail.yml

new generate script

2020-05-06 17:42:38 +02:00

cloudwatch_eks.yml

validate script

2020-04-30 16:52:38 +02:00

cloudwatch_vpc.yml

validate script

2020-04-30 16:52:38 +02:00

cloudwatchlogs_vpcflow.yml

new generate script

2020-05-06 17:42:38 +02:00

dynamic_dns_providers.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

dynamic_dns_web_traffic.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

ec2_modification_api_calls.yml

Removed a few API calls that are not really modifications

2020-08-18 13:47:04 -05:00

evilginx_phishlets_0365.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_amazon.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_aws.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_facebook.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_github.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_google.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_outlook.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

exchange.yml

fixes

2021-09-01 16:58:23 -06:00

f5_bigip_rogue.yml

ymls and updates

2020-08-04 14:04:38 -07:00

filter_rare_process_allow_list.yml

Changed the language in some of the descriptions

2021-01-21 23:53:47 -06:00

github_known_users.yml

github detection

2021-09-01 13:56:23 +02:00

github.yml

dev_git

2021-08-27 13:28:06 +02:00

google_gcp_pubnet_message.yml

validate script

2020-04-30 16:52:38 +02:00

google_gcp_pubsub_message.yml

new generate script

2020-05-06 17:42:38 +02:00

gsuite_calendar.yml

search update

2021-11-02 18:03:21 -07:00

gsuite_drive.yml

dev_ops_uc

2021-08-18 15:58:35 +02:00

gsuite_gmail.yml

dev_ops_uc

2021-08-18 15:58:35 +02:00

is_windows_system_file.yml

updating files as per Dons feedback

2020-02-04 09:15:39 -08:00

kube_objects_events.yml

k8s scanner

2021-08-25 10:49:51 +02:00

kubernetes_azure.yml

updating files to make sure validate passes

2020-06-03 13:10:30 -07:00

kubernetes_container_controller.yml

new detection

2021-08-23 10:17:40 +02:00

linux_hosts.yml

duplicating files and experimental

2021-01-28 17:35:25 -08:00

linux_shells.yml

java Shells

2021-12-13 11:54:59 -07:00

netbackup.yml

new generate script

2020-05-06 17:42:38 +02:00

network_acl_events.yml

naming updates, jinja macros updates

2019-12-16 13:05:17 -08:00

notable.yml

converted response_task to investigations

2021-07-26 13:39:17 +02:00

o365_management_activity.yml

changes

2020-12-15 12:27:16 +01:00

okta.yml

new generate script

2020-05-06 17:42:38 +02:00

osquery_process.yml

duplicating files and experimental

2021-01-28 17:35:25 -08:00

powershell.yml

PowerShell 4104 copy of Security HIVES

2021-07-21 13:57:10 -06:00

previously_seen_cloud_api_calls_per_user_role_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_cloud_compute_creations_by_user_search_window_begin_offset.yml

Macro fixes

2020-09-23 17:22:02 -05:00

previously_seen_cloud_compute_image_search_window_begin_offset.yml

Macro fixes

2020-09-23 17:22:02 -05:00

previously_seen_cloud_compute_images_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_cloud_compute_instance_type_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_cloud_compute_instance_types_search_window_begin_offset.yml

Macro fixes

2020-09-23 17:22:02 -05:00

previously_seen_cloud_instance_modifications_by_user_search_window_begin_offset.yml

Macro fixes

2020-09-23 17:22:02 -05:00

previously_seen_cloud_provisioning_activity_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_cloud_region_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_cloud_regions_search_window_begin_offset.yml

Macro fixes

2020-09-23 17:22:02 -05:00

previously_seen_windows_services_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_windows_services_window.yml

bug fix

2021-02-03 15:44:56 +01:00

previously_seen_zoom_child_processes_forget_window.yml

macro fixes

2020-09-23 17:16:35 -05:00

previously_seen_zoom_child_processes_window.yml

Macro fixes

2020-09-23 17:22:02 -05:00

previously_unseen_cloud_provisioning_activity_window.yml

Macro fixes

2020-09-23 17:22:02 -05:00

printservice.yml

Added a Macro

2021-07-01 12:11:49 -06:00

process_bitsadmin.yml

macro'd bitsadmin

2021-08-17 15:20:40 -06:00

process_certutil.yml

macro'd certutil

2021-08-17 15:00:51 -06:00

process_cmd.yml

macro'd wmic

2021-08-17 11:44:30 -06:00

process_copy.yml

privilege_escalation_persistence

2021-10-05 11:56:48 +02:00

process_csc.yml

ioc_detections

2021-11-17 16:09:42 +01:00

process_curl.yml

fixes

2021-10-20 07:08:14 -06:00

process_dllhost.yml

macros

2021-08-18 09:50:08 -06:00

process_dsquery.yml

macros

2021-08-18 09:50:08 -06:00

process_dxdiag.yml

more_ioc_detections

2021-11-19 12:01:45 +01:00

process_esentutl.yml

Update process_esentutl.yml

2021-08-18 11:14:13 -06:00

process_fodhelper.yml

macros

2021-08-18 09:50:08 -06:00

process_gpupdate.yml

macros

2021-08-18 09:50:08 -06:00

process_hh.yml

macro'd hh

2021-08-17 14:29:16 -06:00

process_installutil.yml

InstallUTIL 🍺

2021-11-12 13:05:19 -07:00

process_microsoftworkflowcompiler.yml

macros

2021-08-18 09:50:08 -06:00

process_msbuild.yml

msbuild and microsoftworkflowcompiler

2021-08-19 06:57:11 -06:00

process_mshta.yml

macro'd mshta

2021-08-17 13:38:11 -06:00

process_net.yml

macro'd net

2021-08-17 13:56:57 -06:00

process_netsh.yml

macro'd netsh

2021-08-17 15:14:35 -06:00

process_nltest.yml

macros

2021-08-18 09:50:08 -06:00

process_ntdsutil.yml

macros

2021-08-18 09:50:08 -06:00

process_powershell.yml

Macro'd powershell

2021-08-17 11:15:36 -06:00

process_procdump.yml

no longer need sysmon procdump - updated superior procdump

2021-09-16 12:06:20 -06:00

process_psexec.yml

hh, mshta, and psexec

2021-09-16 11:13:15 -06:00

process_rclone.yml

rookie mistake

2021-11-30 05:34:29 -07:00

process_reg.yml

macro'd reg cmd

2021-08-17 12:09:31 -06:00

process_regasm.yml

macros

2021-08-18 09:50:08 -06:00

process_regsvcs.yml

macros

2021-08-18 09:50:08 -06:00

process_regsvr32.yml

macro'd regsvr32

2021-08-17 13:27:48 -06:00

process_route.yml

ioc_detections

2021-11-17 16:09:42 +01:00

process_runas.yml

ioc_detections

2021-11-17 16:09:42 +01:00

process_rundll32.yml

macrod rundll32

2021-08-17 13:21:24 -06:00

process_schtasks.yml

macros

2021-08-18 09:50:08 -06:00

process_sdelete.yml

privilege_escalation_persistence

2021-10-06 11:15:47 +02:00

process_setspn.yml

HaagRoast

2021-10-15 12:31:33 -06:00

process_verclsid.yml

privilege_escalation_persistence

2021-09-29 10:42:05 +02:00

process_vssadmin.yml

macros

2021-08-18 09:50:08 -06:00

process_wbadmin.yml

macros

2021-08-18 09:50:08 -06:00

process_wmic.yml

Macro'd powershell

2021-08-17 11:15:36 -06:00

prohibited_apps_launching_cmd.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

prohibited_softwares.yml

fix_bugs

2020-12-11 10:51:02 +01:00

ransomware_extensions.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

ransomware_notes.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

remove_valid_domains.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

s3_accesslogs.yml

validate script

2020-04-30 16:52:38 +02:00

security_content_ctime.yml

Present times in ISO8601 instead of US style

2020-08-12 23:45:53 +02:00

security_content_summariesonly.yml

this should be false

2020-06-09 17:58:39 -04:00

security_group_api_calls.yml

naming updates, jinja macros updates

2019-12-16 13:05:17 -08:00

signals.yml

updated detections

2021-09-06 14:49:19 +02:00

stream_dns.yml

porting ymls into a newe PR

2020-08-04 12:55:12 -07:00

stream_http.yml

new generate script

2020-05-06 17:42:38 +02:00

stream_tcp.yml

porting ymls into a newe PR

2020-08-04 12:55:12 -07:00

suspicious_email_attachments.yml

naming updates, jinja macros updates

2019-12-16 13:05:17 -08:00

suspicious_writes.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

sysmon.yml

updating sysmon macro

2021-12-13 18:00:14 -05:00

system_network_configuration_discovery_tools.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

uncommon_processes.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

windows_shells.yml

Update windows_shells.yml

2021-12-13 14:37:40 -07:00

wineventlog_security.yml

new generate script

2020-05-06 17:42:38 +02:00

wineventlog_system.yml

new generate script

2020-05-06 17:42:38 +02:00

wineventlog_task_scheduler.yml

Update wineventlog_task_scheduler.yml

2021-11-09 13:42:23 -07:00

wmi.yml

new generate script

2020-05-06 17:42:38 +02:00

zeek_rpc.yml

adding macros

2020-09-18 17:36:46 -04:00

zeek_ssl.yml

mods

2020-11-06 11:08:38 +11:00