admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
334fb25cd0c856eb674f2ad495daaeade5e92efa
splunk-security_content/tests/endpoint
T
History
Jose Enrique Hernandez 930a6db140 Merge pull request #1901 from splunk/AD_Privilege_Escalation_CVE-2021-42278
2021-12-21 14:21:54 -05:00
..
7zip_commandline_to_smb_share_path.test.yml
conti_leak
2021-08-17 17:51:41 +02:00
access_lsass_memory_for_dump_creation.test.yml
new detection testing
2021-06-15 10:24:53 +02:00
account_discovery_with_net_app.test.yml
new detection testing
2021-06-01 13:37:06 +02:00
active_setup_registry_autostart.test.yml
privilege_escalation_persistence
2021-09-29 15:21:03 +02:00
add_defaultuser_and_password_in_registry.test.yml
blackmatter_ransomware
2021-09-06 16:49:58 +02:00
add_or_set_windows_defender_exclusion.test.yml
remcos_evasion
2021-11-25 12:27:39 +01:00
adsisearcher_account_discovery.test.yml
AD_Discovery_TR-789_2
2021-08-25 11:00:06 +02:00
allow_file_and_printing_sharing_in_firewall.test.yml
rttp3
2021-06-23 12:58:56 +02:00
allow_inbound_traffic_by_firewall_rule_registry.test.yml
casper1
2021-05-26 13:33:47 +02:00
allow_inbound_traffic_in_firewall_rule.test.yml
casper1
2021-05-26 13:33:47 +02:00
allow_network_discovery_in_firewall.test.yml
ransom_ttp_p2
2021-06-23 12:38:49 +02:00
allow_operation_with_consent_admin.test.yml
Delete allow_operation_with_consent_admin.test.yml
2021-06-16 10:22:00 +02:00
anomalous_usage_of_7zip.test.yml
Anomalous Usage of 7z
2021-04-22 13:27:47 -06:00
any_powershell_downloadfile.test.yml
powershell
2021-03-02 09:43:31 -07:00
any_powershell_downloadstring.test.yml
Update any_powershell_downloadstring.test.yml
2021-03-02 15:02:51 -07:00
attacker_tools_on_endpoint.test.yml
bug fix test file
2021-07-14 17:05:49 +02:00
attempt_to_add_certificate_to_untrusted_store.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
attempt_to_stop_security_service.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
attempted_credential_dump_from_registry_via_reg_exe.test.yml
test branch
2021-03-01 10:36:14 +01:00
auto_admin_logon_registry_entry.test.yml
blackmatter_ransomware
2021-09-06 16:49:58 +02:00
batch_file_write_to_system32.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
bcdedit_command_back_to_normal_mode_boot.test.yml
blackMatter_ransomware
2021-09-07 13:24:13 +02:00
bcdedit_failure_recovery_modification.test.yml
Update bcdedit_failure_recovery_modification.test.yml
2021-01-11 13:57:05 -07:00
bits_job_persistence.test.yml
T1197 BITS Jobs
2021-03-30 14:49:44 -06:00
bitsadmin_download_file.test.yml
T1197 BITS Jobs
2021-03-30 14:49:44 -06:00
certutil_download_with_urlcache_and_split_arguments.test.yml
Update Certutil
2021-03-24 15:15:47 -06:00
certutil_download_with_verifyctl_and_split_arguments.test.yml
Update Certutil
2021-03-24 15:15:47 -06:00
certutil_exe_certificate_extraction.test.yml
change time
2021-02-11 09:02:22 -08:00
certutil_with_decode_argument.test.yml
Create certutil_with_decode_argument.yml
2021-03-25 11:18:36 -06:00
change_default_file_association.test.yml
privilege_esc_persistence
2021-09-28 15:20:25 +02:00
change_to_safe_mode_with_network_config.test.yml
blackMatter_ransomware
2021-09-07 13:24:13 +02:00
chcp_command_execution.test.yml
icedid
2021-08-05 13:36:35 +02:00
check_elevated_cmd_using_whoami.test.yml
fin7
2021-09-16 15:54:32 +02:00
clear_unallocated_sector_using_cipher_app.test.yml
Delete clear_unallocated_sector_using_cipher_app.test.yml
2021-06-16 10:21:41 +02:00
clop_common_exec_parameter.test.yml
clop_test_file
2021-03-22 11:53:18 +01:00
clop_ransomware_known_service_name.test.yml
clop_test_file
2021-03-22 11:45:21 +01:00
cmd_carry_out_string_command_parameter.test.yml
iceid_ttps
2021-10-21 12:24:22 +02:00
cmd_echo_pipe___escalation.test.yml
Cobalt Jump
2021-05-27 08:22:53 -06:00
cmdline_tool_not_executed_in_cmd_shell.test.yml
fin7
2021-09-16 16:56:51 +02:00
cmlua_or_cmstplua_uac_bypass.test.yml
com_obj
2021-05-13 18:58:14 +02:00
cobalt_strike_named_pipes.test.yml
Named Pipes + update
2021-02-22 15:26:35 -07:00
common_ransomware_extensions.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
common_ransomware_notes.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
conti_common_exec_parameter.test.yml
revil2
2021-06-04 16:41:23 +02:00
control_loading_from_world_writable_directory.test.yml
Control loading the world
2021-09-08 12:34:15 -06:00
create_local_admin_accounts_using_net_exe.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
create_or_delete_windows_shares_using_net_exe.test.yml
new test file
2020-12-09 12:00:49 +01:00
create_remote_thread_in_shell_application.test.yml
icedid
2021-08-05 13:36:35 +02:00
create_remote_thread_into_lsass.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
creation_of_lsass_dump_with_taskmgr.test.yml
Creation of lsass dump with taskmgr
2021-02-03 14:57:59 -07:00
creation_of_shadow_copy_with_wmic_and_powershell.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
creation_of_shadow_copy.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
credential_dumping_via_copy_command_from_shadow_copy.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
credential_dumping_via_symlink_to_shadow_copy.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
csc_net_on_the_fly_compilation.test.yml
ioc_detections
2021-11-17 17:59:06 +01:00
curl_download_and_bash_execution.test.yml
wget curl
2021-12-13 07:11:07 -07:00
delete_shadowcopy_with_powershell.test.yml
revil
2021-06-04 16:07:02 +02:00
deleting_of_net_users.test.yml
xmrig_ir
2021-05-07 13:38:12 +02:00
deleting_shadow_copies.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
detect_activity_related_to_pass_the_hash_attacks.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
detect_azurehound_command_line_arguments.test.yml
AzureHound
2021-06-03 10:40:41 -06:00
detect_azurehound_file_modifications.test.yml
SharpHound
2021-06-03 08:48:19 -06:00
detect_copy_of_shadowcopy_with_script_block_logging.test.yml
Update detect_copy_of_shadowcopy_with_script_block_logging.test.yml
2021-09-02 13:55:21 -06:00
detect_credential_dumping_through_lsass_access.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
detect_empire_with_powershell_script_block_logging.test.yml
PowerShell Script Block Initial Analytics
2021-06-09 14:26:05 -06:00
detect_excessive_account_lockouts_from_endpoint.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
detect_excessive_user_account_lockouts.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
detect_exchange_web_shell.test.yml
Updated Detect Exchange Web Shell
2021-03-18 21:00:09 -06:00
detect_html_help_renamed.test.yml
hh renamed
2021-02-11 15:15:30 -07:00
detect_html_help_spawn_child_process.test.yml
HTML help spawning a child
2021-02-11 14:35:06 -07:00
detect_html_help_url_in_command_line.test.yml
T1218.001 remote CHM
2021-02-11 14:21:07 -07:00
detect_html_help_using_infotech_storage_handlers.test.yml
InfoTech Storage Handlers
2021-02-11 15:03:13 -07:00
detect_mimikatz_using_loaded_images.test.yml
Detect Mimikatz Using Loaded Images
2021-03-05 13:10:59 -07:00
detect_mimikatz_with_powershell_script_block_logging.test.yml
PowerShell Script Block Initial Analytics
2021-06-09 14:26:05 -06:00
detect_mshta_inline_hta_execution.test.yml
The Unbroken Haag
2021-12-06 11:57:20 -07:00
detect_mshta_renamed.test.yml
Create detect_mshta_renamed.test.yml
2021-03-08 16:27:06 -07:00
detect_mshta_url_in_command_line.test.yml
MSHTA
2021-01-20 12:00:25 -07:00
detect_new_local_admin_account.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
detect_path_interception_by_creation_of_program_exe.test.yml
_timeupdate
2021-02-17 10:09:38 -08:00
detect_processes_used_for_system_network_configuration_discovery.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
detect_prohibited_applications_spawning_cmd_exe.test.yml
The Unbroken Haag
2021-12-06 11:57:20 -07:00
detect_psexec_with_accepteula_flag.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
detect_rclone_command_line_usage.test.yml
fail
2021-05-13 20:32:25 +02:00
detect_regasm_spawning_a_process.test.yml
test files
2021-02-12 12:10:53 -07:00
detect_regasm_with_network_connection.test.yml
regasm-regsvcs-network
2021-02-16 07:16:05 -07:00
detect_regasm_with_no_command_line_arguments.test.yml
regasm no cl arguments
2021-02-16 11:22:07 -07:00
detect_regsvcs_spawning_a_process.test.yml
test files
2021-02-12 12:10:53 -07:00
detect_regsvcs_with_network_connection.test.yml
regasm-regsvcs-network
2021-02-16 07:16:05 -07:00
detect_regsvcs_with_no_command_line_arguments.test.yml
Update detect_regsvcs_with_no_command_line_arguments.test.yml
2021-02-16 11:56:19 -07:00
detect_regsvr32_application_control_bypass.test.yml
Regsvr32 Story and Analytics
2021-01-29 10:58:53 -07:00
detect_renamed_7_zip.test.yml
7zip and rar
2021-06-03 09:41:39 -06:00
detect_renamed_psexec.test.yml
psexec renamed
2021-06-03 09:17:31 -06:00
detect_renamed_rclone.test.yml
fail
2021-05-13 20:32:25 +02:00
detect_renamed_winrar.test.yml
7zip and rar
2021-06-03 09:41:39 -06:00
detect_rundll32_application_control_bypass___advpack.test.yml
rundll32 advpack and rename
2021-02-04 14:38:54 -07:00
detect_rundll32_application_control_bypass___setupapi.test.yml
rundll32 syssetup, setupapi
2021-02-05 07:27:02 -07:00
detect_rundll32_application_control_bypass___syssetup.test.yml
rundll32 syssetup, setupapi
2021-02-05 07:27:02 -07:00
detect_rundll32_inline_hta_execution.test.yml
rundll32 inline hta
2021-01-20 10:48:25 -07:00
detect_sharphound_command_line_arguments.test.yml
SharpHound
2021-06-03 08:48:19 -06:00
detect_sharphound_file_modifications.test.yml
SharpHound
2021-06-03 08:48:19 -06:00
detect_sharphound_usage.test.yml
SharpHound
2021-06-03 08:48:19 -06:00
detect_use_of_cmd_exe_to_launch_script_interpreters.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
detect_wmi_event_subscription_persistence.test.yml
Updates
2021-06-18 10:34:25 -06:00
disable_amsi_through_registry.test.yml
ransom_ttp_p2
2021-06-23 12:38:49 +02:00
disable_defender_antivirus_registry.test.yml
iceid_ttps
2021-10-18 17:11:53 +02:00
disable_defender_blockatfirstseen_feature.test.yml
iceid_ttps
2021-10-18 16:56:46 +02:00
disable_defender_enhanced_notification.test.yml
iceid_ttps
2021-10-18 16:56:46 +02:00
disable_defender_mpengine_registry.test.yml
iceid_ttps
2021-10-18 17:11:53 +02:00
disable_defender_spynet_reporting.test.yml
iceid_ttps
2021-10-18 16:56:46 +02:00
disable_defender_submit_samples_consent_feature.test.yml
iceid_ttps
2021-10-18 16:56:46 +02:00
disable_etw_through_registry.test.yml
ransom_ttp_p2
2021-06-23 12:38:49 +02:00
disable_logs_using_wevtutil.test.yml
Delete disable_logs_using_wevtutil.test.yml
2021-06-16 10:13:51 +02:00
disable_registry_tool.test.yml
def_evasion_detections
2021-03-31 15:00:36 +02:00
disable_schedule_task.test.yml
iceid_ttps
2021-10-18 16:56:46 +02:00
disable_security_logs_using_minint_registry.test.yml
privilege_escalation_persistence
2021-10-05 11:56:48 +02:00
disable_show_hidden_files.test.yml
def_evasion_detections
2021-03-31 15:00:36 +02:00
disable_uac_remote_restriction.test.yml
privilege_escalation_persistence
2021-09-30 10:29:01 +02:00
disable_windows_app_hotkeys.test.yml
xmrig5
2021-05-07 16:34:15 +02:00
disable_windows_behavior_monitoring.test.yml
def_evasion_detections
2021-03-31 15:00:36 +02:00
disable_windows_smartscreen_protection.test.yml
def_evasion_detections
2021-03-31 15:00:36 +02:00
disabling_cmd_application.test.yml
def_evasion_detections
2021-03-31 15:00:36 +02:00
disabling_controlpanel.test.yml
def_evasion_detections
2021-03-31 15:00:36 +02:00
disabling_defender_services.test.yml
iceid_ttps
2021-10-20 11:38:22 +02:00
disabling_firewall_with_netsh.test.yml
def_evasion_detections
2021-03-31 15:00:36 +02:00
disabling_folderoptions_windows_feature.test.yml
def_evasion_detections
2021-03-31 15:00:36 +02:00
disabling_net_user_account.test.yml
xmrig_ir
2021-05-07 13:38:12 +02:00
disabling_norun_windows_app.test.yml
def_evasion_detections
2021-03-31 15:00:36 +02:00
disabling_remote_user_account_control.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
disabling_systemrestore_in_registry.test.yml
def_evasion_detections
2021-03-31 15:00:36 +02:00
disabling_task_manager.test.yml
def_evasion_detections
2021-03-31 15:00:36 +02:00
dllhost_with_no_command_line_arguments_with_network.test.yml
dllhost test again
2021-04-21 11:55:18 -06:00
dns_exfiltration_using_nslookup_app.test.yml
net_exfil
2021-04-22 15:37:09 +02:00
domain_account_discovery_with_dsquery.test.yml
AD_Discovery_TR-789_2
2021-08-25 11:00:06 +02:00
domain_account_discovery_with_net_app.test.yml
AD_Discovery_TR-789_2
2021-08-25 11:00:06 +02:00
domain_account_discovery_with_wmic.test.yml
AD_Discovery_TR-789_2
2021-08-25 11:00:06 +02:00
domain_controller_discovery_with_nltest.test.yml
adding 5 detections
2021-09-01 13:05:51 -04:00
domain_controller_discovery_with_wmic.test.yml
adding 5 detections
2021-09-01 13:05:51 -04:00
domain_group_discovery_with_adsisearcher.test.yml
adding 3 detections
2021-08-27 11:54:37 -04:00
domain_group_discovery_with_dsquery.test.yml
adding an extra detections
2021-09-01 16:24:04 -04:00
domain_group_discovery_with_net.test.yml
adding first four
2021-08-26 15:45:47 -04:00
domain_group_discovery_with_wmic.test.yml
adding first four
2021-08-26 15:45:47 -04:00
download_files_using_telegram.test.yml
xmrig_ir
2021-05-07 13:38:12 +02:00
drop_icedid_license_dat.test.yml
icedid
2021-08-05 13:42:29 +02:00
dsquery_domain_discovery.test.yml
Possible DSQuery fix
2021-03-31 14:09:38 -06:00
dump_lsass_via_comsvcs_dll.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
dump_lsass_via_procdump_rename.test.yml
error
2021-09-16 12:15:53 -06:00
dump_lsass_via_procdump.test.yml
dump lsass via procdump
2021-02-01 12:37:36 -07:00
elevated_group_discovery_with_net.test.yml
adding first four
2021-08-26 15:45:47 -04:00
elevated_group_discovery_with_powerview.test.yml
adding 2 detections
2021-08-27 13:51:42 -04:00
elevated_group_discovery_with_wmic.test.yml
fixing minor issue with dataset URL
2021-09-10 12:34:18 -04:00
enable_rdp_in_other_port_number.test.yml
Update enable_rdp_in_other_port_number.test.yml
2021-05-26 13:37:03 +02:00
enable_wdigest_uselogoncredential_registry.test.yml
privilege_escalation_persistence
2021-10-05 11:56:48 +02:00
enumerate_users_local_group_using_telegram.test.yml
xmrig1
2021-05-07 13:51:26 +02:00
esentutl_sam_copy.test.yml
esentutil
2021-08-18 10:47:58 -06:00
etw_registry_disabled.test.yml
privilege_escalation_persistence
2021-10-07 14:53:56 +02:00
eventvwr_uac_bypass.test.yml
Eventvwr UAC Bypass
2021-03-01 15:18:27 -07:00
excel_spawning_powershell.test.yml
Excel posh
2021-04-21 13:11:40 -06:00
excel_spawning_windows_script_host.test.yml
Excel WSH
2021-04-22 07:38:08 -06:00
excessive_attempt_to_disable_services.test.yml
xmrig_ir
2021-05-07 13:38:12 +02:00
excessive_number_of_distinct_processes_created_in_windows_temp_folder.test.yml
Excessive win temp detection (#1438)
2021-06-15 09:43:48 -04:00
excessive_number_of_service_control_start_as_disabled.test.yml
contentctl puts relative link to detection file in wrong place
2021-06-25 15:00:46 -04:00
excessive_number_of_taskhost_processes.test.yml
Fixing file reference name
2021-06-09 14:57:17 -04:00
excessive_service_stop_attempt.test.yml
xmrig_ir
2021-05-07 13:38:12 +02:00
excessive_usage_of_cacls_app.test.yml
xmrig_ir
2021-05-07 13:38:12 +02:00
excessive_usage_of_net_app.test.yml
xmrig_ir
2021-05-07 13:38:12 +02:00
excessive_usage_of_nslookup_app.test.yml
net_exfil
2021-04-22 15:37:09 +02:00
excessive_usage_of_sc_service_utility.test.yml
rttp5
2021-06-24 10:51:56 +02:00
excessive_usage_of_taskkill.test.yml
xmrig_ir
2021-05-07 13:38:12 +02:00
executable_file_written_in_administrative_smb_share.test.yml
updating other detections
2021-11-18 15:43:56 -05:00
executables_or_script_creation_in_suspicious_path.test.yml
xmrig_ir
2021-05-07 13:38:12 +02:00
execute_javascript_with_jscript_com_clsid.test.yml
ransom_ttp_p2
2021-06-23 12:38:49 +02:00
execution_of_file_with_multiple_extensions.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
extraction_of_registry_hives.test.yml
Renaming Detection
2021-09-08 07:07:20 -06:00
file_with_samsam_extension.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
firewall_allowed_program_enable.test.yml
ioc_detections
2021-11-17 17:59:06 +01:00
fodhelper_uac_bypass.test.yml
Update fodhelper_uac_bypass.test.yml
2021-03-02 12:52:07 -07:00
fsutil_zeroing_file.test.yml
lockbit_ttp
2021-08-11 18:37:03 +02:00
get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml
AD_Discovery_TR-789_4
2021-08-31 10:31:08 +02:00
get_addefaultdomainpasswordpolicy_with_powershell.test.yml
AD_Discovery_TR-789_4
2021-08-31 10:31:08 +02:00
get_aduser_with_powershell_script_block.test.yml
AD_Discovery_TR-789_2
2021-08-25 17:57:13 +02:00
get_aduser_with_powershell.test.yml
AD_Discovery_TR-789_2
2021-08-25 17:57:13 +02:00
get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml
AD_Discovery_TR-789_4
2021-08-31 10:31:08 +02:00
get_aduserresultantpasswordpolicy_with_powershell.test.yml
Fixed name of one of the test files.
2021-10-18 16:45:34 -07:00
get_domainpolicy_with_powershell_script_block.test.yml
AD_Discovery_TR-789_4
2021-08-31 10:31:08 +02:00
get_domainpolicy_with_powershell.test.yml
AD_Discovery_TR-789_4
2021-08-31 10:31:08 +02:00
get_domaintrust_with_powershell_script_block.test.yml
Update get_domaintrust_with_powershell_script_block.test.yml
2021-09-07 19:42:37 -06:00
get_domaintrust_with_powershell.test.yml
AD_Discovery_TR-789_3
2021-09-02 09:38:51 -06:00
get_domainuser_with_powershell_script_block.test.yml
AD_Discovery_TR-789_2
2021-08-30 15:38:27 +02:00
get_domainuser_with_powershell.test.yml
AD_Discovery_TR-789_2
2021-08-25 17:57:13 +02:00
get_foresttrust_with_powershell_script_block.test.yml
test files
2021-09-07 19:19:41 -06:00
get_foresttrust_with_powershell.test.yml
AD_Discovery_TR-789_3
2021-09-02 09:38:51 -06:00
get_wmiobject_group_discovery_with_script_block_logging.test.yml
May The Haag Be With You
2021-09-14 11:05:59 -06:00
get_wmiobject_group_discovery.test.yml
May The Haag Be With You
2021-09-14 11:05:59 -06:00
getadcomputer_with_powershell_script_block.test.yml
adding 3 detections
2021-09-01 17:36:43 -04:00
getadcomputer_with_powershell.test.yml
adding 4 extra detections
2021-09-09 11:34:07 -04:00
getadgroup_with_powershell_script_block.test.yml
adding 3 detections
2021-08-27 11:54:37 -04:00
getadgroup_with_powershell.test.yml
adding 3 more detections
2021-08-30 16:39:15 -04:00
getcurrent_user_with_powershell_script_block.test.yml
adding 4 detections
2021-09-13 17:22:30 -04:00
getcurrent_user_with_powershell.test.yml
adding 4 detections
2021-09-13 17:22:30 -04:00
getdomaincomputer_with_powershell_script_block.test.yml
adding 2 detections
2021-09-02 17:16:45 -04:00
getdomaincomputer_with_powershell.test.yml
adding 4 extra detections
2021-09-09 11:34:07 -04:00
getdomaincontroller_with_powershell_script_block.test.yml
adding 2 detections
2021-09-02 17:16:45 -04:00
getdomaincontroller_with_powershell.test.yml
adding 4 extra detections
2021-09-09 11:34:07 -04:00
getdomaingroup_with_powershell_script_block.test.yml
adding 2 detections
2021-08-27 13:51:42 -04:00
getdomaingroup_with_powershell.test.yml
adding 3 more detections
2021-08-30 16:39:15 -04:00
getlocaluser_with_powershell_script_block.test.yml
adding test dataset metadata
2021-08-24 17:51:05 -04:00
getlocaluser_with_powershell.test.yml
adding test dataset metadata
2021-08-24 17:51:05 -04:00
getnettcpconnection_with_powershell_script_block.test.yml
adding T1049 detections
2021-09-10 10:57:01 -04:00
getnettcpconnection_with_powershell.test.yml
adding T1049 detections
2021-09-10 10:57:01 -04:00
getwmiobject_ds_computer_with_powershell_script_block.test.yml
adding 3 detections
2021-09-01 17:36:43 -04:00
getwmiobject_ds_computer_with_powershell.test.yml
adding 4 extra detections
2021-09-09 11:34:07 -04:00
getwmiobject_ds_group_with_powershell_script_block.test.yml
adding 3 detections
2021-08-27 11:54:37 -04:00
getwmiobject_ds_group_with_powershell.test.yml
adding 3 more detections
2021-08-30 16:39:15 -04:00
getwmiobject_ds_user_with_powershell_script_block.test.yml
AD_Discovery_TR-789_2
2021-08-30 15:38:27 +02:00
getwmiobject_ds_user_with_powershell.test.yml
AD_Discovery_TR-789_2
2021-08-25 17:57:13 +02:00
getwmiobject_user_account_with_powershell_script_block.test.yml
adding test dataset metadata
2021-08-24 17:51:05 -04:00
getwmiobject_user_account_with_powershell.test.yml
adding test dataset metadata
2021-08-24 17:51:05 -04:00
gpupdate_with_no_command_line_arguments_with_network.test.yml
dllhost and gpupdate fix
2021-04-19 13:08:04 -06:00
hide_user_account_from_sign_in_screen.test.yml
xmrig5
2021-05-07 16:34:15 +02:00
hiding_files_and_directories_with_attrib_exe.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
high_file_deletion_frequency.test.yml
clop_test_file
2021-03-22 11:45:21 +01:00
high_frequency_copy_of_files_in_network_share.test.yml
ioc_detections
2021-11-17 17:09:43 +01:00
high_process_termination_frequency.test.yml
clop_test_file
2021-03-22 11:57:42 +01:00
hunting_for_log4shell.test.yml
Create hunting_for_log4shell.test.yml
2021-12-14 19:00:04 -07:00
icacls_deny_command.test.yml
xmrig_ir
2021-05-07 13:38:12 +02:00
icacls_grant_command.test.yml
xmrig_ir
2021-05-07 13:38:12 +02:00
icedid_exfiltrated_archived_file_creation.test.yml
icedid
2021-08-05 13:39:05 +02:00
impacket_lateral_movement_commandline_parameters.test.yml
adding first detection
2021-11-19 16:40:04 -05:00
interactive_session_on_remote_endpoint_with_powershell.test.yml
adding extra detection
2021-11-18 16:26:32 -05:00
java_class_file_download_by_java_user_agent.test.yml
☕
2021-12-13 13:32:27 -07:00
jscript_execution_using_cscript_app.test.yml
FIN7
2021-09-14 12:17:55 +02:00
kerberoasting_spn_request_with_rc4_encryption.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
known_services_killed_by_ransomware.test.yml
revil
2021-06-04 16:07:02 +02:00
loading_of_dynwrapx_module.test.yml
ioc_detections
2021-11-18 15:10:02 +01:00
local_account_discovery_with_net.test.yml
adding test dataset metadata
2021-08-24 17:51:05 -04:00
local_account_discovery_with_wmic.test.yml
adding test dataset metadata
2021-08-24 17:51:05 -04:00
logon_script_event_trigger_execution.test.yml
privilege_escalation_persistence
2021-09-29 10:42:05 +02:00
mailsniper_invoke_functions.test.yml
casper1
2021-05-26 13:33:47 +02:00
malicious_inprocserver32_modification.test.yml
test files
2021-10-05 14:54:17 -06:00
malicious_powershell_executed_as_a_service.test.yml
testing
2021-04-13 10:23:35 -07:00
malicious_powershell_process___connect_to_internet_with_hidden_window.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
malicious_powershell_process___encoded_command.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
malicious_powershell_process___execution_policy_bypass.test.yml
new test file
2021-01-19 14:44:01 +01:00
malicious_powershell_process_with_obfuscation_techniques.test.yml
new test file
2021-01-19 13:55:33 +01:00
mmc_exe_lolbas_execution_process_spawn.test.yml
adding dataset fields
2021-11-23 17:15:06 -05:00
modification_of_wallpaper.test.yml
revil
2021-06-04 16:07:02 +02:00
modify_acl_permission_to_files_or_folder.test.yml
xmrig_ir
2021-05-07 13:38:12 +02:00
monitor_registry_keys_for_print_monitors.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
ms_scripting_process_loading_ldap_module.test.yml
fin7
2021-09-20 15:21:53 +02:00
ms_scripting_process_loading_wmi_module.test.yml
fin7
2021-09-20 15:21:53 +02:00
msbuild_suspicious_spawned_by_script_process.test.yml
privilege_escalation_persistence
2021-10-04 13:17:04 +02:00
mshta_spawning_rundll32_or_regsvr32_process.test.yml
Update mshta_spawning_rundll32_or_regsvr32_process.test.yml
2021-07-19 15:51:31 +02:00
mshtml_module_load_in_office_product.test.yml
mshtml_module_load_in_office_product
2021-09-09 10:53:47 -06:00
msmpeng_application_dll_side_loading.test.yml
side loading
2021-07-05 16:27:36 +02:00
multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.test.yml
fail
2021-05-13 20:32:25 +02:00
multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.test.yml
fail
2021-05-13 20:32:25 +02:00
multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.test.yml
fail
2021-05-13 20:32:25 +02:00
multiple_users_attempting_to_authenticate_using_explicit_credentials.test.yml
fail
2021-05-13 20:32:25 +02:00
multiple_users_failing_to_authenticate_from_host_using_kerberos.test.yml
fail
2021-05-13 20:32:25 +02:00
multiple_users_failing_to_authenticate_from_host_using_ntlm.test.yml
fail
2021-05-13 20:32:25 +02:00
multiple_users_failing_to_authenticate_from_process.test.yml
fail
2021-05-13 20:32:25 +02:00
multiple_users_remotely_failing_to_authenticate_from_host.test.yml
fail
2021-05-13 20:32:25 +02:00
net_localgroup_discovery.test.yml
May The Haag Be With You
2021-09-14 11:05:59 -06:00
net_profiler_uac_bypass.test.yml
uac bypass
2021-07-12 15:25:32 +02:00
network_connection_discovery_arp.test.yml
adding T1049 detections
2021-09-10 10:57:01 -04:00
network_connection_discovery_net.test.yml
adding T1049 detections
2021-09-10 10:57:01 -04:00
network_connection_discovery_netstat.test.yml
adding T1049 detections
2021-09-10 10:57:01 -04:00
network_discovery_using_route_windows_app.test.yml
ioc_detections
2021-11-17 17:59:06 +01:00
nishang_powershelltcponeline.test.yml
fixes
2021-03-03 14:54:56 -07:00
nltest_domain_trust_discovery.test.yml
T1482 - NLTest usage
2021-01-25 09:09:02 -07:00
non_chrome_process_accessing_chrome_default_dir.test.yml
fin7
2021-09-15 13:45:42 +02:00
non_firefox_process_access_firefox_profile_dir.test.yml
fin7
2021-09-15 13:45:42 +02:00
ntdsutil_export_ntds.test.yml
ntdsutil export NTDS.dit
2021-01-28 14:36:52 -07:00
office_application_drop_executable.test.yml
fix_issues
2021-11-09 13:14:31 +01:00
office_application_spawn_regsvr32_process.test.yml
icedid story
2021-07-30 12:34:15 +02:00
office_application_spawn_rundll32_process.test.yml
spear_detections
2021-04-14 16:00:16 +02:00
office_document_creating_schedule_task.test.yml
spear_detections
2021-04-14 16:00:16 +02:00
office_document_executing_macro_code.test.yml
spear_detections
2021-04-14 16:00:16 +02:00
office_document_spawned_child_process_to_download.test.yml
spear2
2021-04-19 16:45:03 +02:00
office_product_spawn_cmd_process.test.yml
uac and trickbot
2021-07-19 15:48:28 +02:00
office_product_spawning_bitsadmin.test.yml
Office products spawning things
2021-04-27 06:39:12 -06:00
office_product_spawning_certutil.test.yml
Office products spawning things
2021-04-27 06:39:12 -06:00
office_product_spawning_mshta.test.yml
Office products spawning things
2021-04-27 06:39:12 -06:00
office_product_spawning_rundll32_with_no_dll.test.yml
Office Product Spawning Rundll32 with no DLL
2021-04-22 11:20:45 -06:00
office_product_spawning_wmic.test.yml
Office products spawning things
2021-04-27 06:39:12 -06:00
office_product_writing_cab_or_inf.test.yml
Haag With the Wind: CVE-2021-40444 Edition
2021-09-10 11:39:56 -06:00
office_spawning_control.test.yml
word
2021-09-08 13:57:38 -06:00
outbound_network_connection_from_java_using_default_ports.test.yml
updating detection to use data models
2021-12-15 15:53:06 -05:00
overwriting_accessibility_binaries.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
password_policy_discovery_with_net.test.yml
AD_Discovery_TR-789_4
2021-08-31 10:31:08 +02:00
permission_modification_using_takeown_app.test.yml
Delete permission_modification_using_takeown_app.test.yml
2021-06-16 10:21:28 +02:00
petitpotam_network_share_access_request.test.yml
another fix
2021-09-01 21:01:13 -06:00
petitpotam_suspicious_kerberos_tgt_request.test.yml
Update detection name and description
2021-09-02 10:19:19 -04:00
possible_browser_pass_view_parameter.test.yml
more_ioc_detections
2021-11-22 15:09:53 +01:00
possible_lateral_movement_powershell_spawn.test.yml
adding detection
2021-11-29 16:50:39 -05:00
powershell_4104_hunting.test.yml
4104 Hunting
2021-08-19 14:09:43 -06:00
powershell_creating_thread_mutex.test.yml
hpot
2021-06-14 11:55:13 +02:00
powershell_disable_security_monitoring.test.yml
pwh disable
2021-07-05 15:49:41 +02:00
powershell_domain_enumeration.test.yml
Domain enumeration
2021-06-15 14:02:45 -06:00
powershell_enable_smb1protocol_feature.test.yml
ransom_ttp_p2
2021-06-23 12:38:49 +02:00
powershell_execute_com_object.test.yml
conti_leak
2021-08-10 14:24:54 +02:00
powershell_fileless_process_injection_via_getprocaddress.test.yml
formatting
2021-06-09 14:41:09 -06:00
powershell_fileless_script_contains_base64_encoded_content.test.yml
PowerShell Script Block Initial Analytics
2021-06-09 14:26:05 -06:00
powershell_get_localgroup_discovery_with_script_block_logging.test.yml
May The Haag Be With You
2021-09-14 11:05:59 -06:00
powershell_get_localgroup_discovery.test.yml
May The Haag Be With You
2021-09-14 11:05:59 -06:00
powershell_loading_dotnet_into_memory_via_system_reflection_assembly.test.yml
spec chars
2021-06-15 13:28:27 -06:00
powershell_processing_stream_of_data.test.yml
hpot
2021-06-14 11:55:13 +02:00
powershell_remote_thread_to_known_windows_process.test.yml
test_tr
2021-05-03 17:12:24 +02:00
powershell_start_bitstransfer.test.yml
T1197 BITS Jobs
2021-03-30 14:49:44 -06:00
powershell_using_memory_as_backing_store.test.yml
hpot
2021-06-14 11:55:13 +02:00
powershell_windows_defender_exclusion_commands.test.yml
remcos_evasion
2021-11-25 12:27:39 +01:00
prevent_automatic_repair_mode_using_bcdedit.test.yml
Delete prevent_automatic_repair_mode_using_bcdedit.test.yml
2021-06-16 10:21:05 +02:00
print_processor_registry_autostart.test.yml
privilege_escalation_persistence
2021-10-08 14:23:55 +02:00
print_spooler_adding_a_printer_driver.test.yml
Printing All your Nightmares
2021-07-01 12:01:45 -06:00
print_spooler_failed_to_load_a_plug_in.test.yml
Printing All your Nightmares
2021-07-01 12:01:45 -06:00
process_creating_lnk_file_in_suspicious_location.test.yml
fixing file path
2021-02-01 14:56:27 -05:00
process_deleting_its_process_file_path.test.yml
clop_test_file
2021-03-22 11:45:21 +01:00
process_execution_via_wmi.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
process_kill_base_on_file_path.test.yml
xmrig_ir
2021-05-07 13:38:12 +02:00
process_writing_dynamicwrapperx.test.yml
test files
2021-10-05 14:54:17 -06:00
processes_launching_netsh.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
ransomware_notes_bulk_creation.test.yml
clop_test_file
2021-03-22 11:45:21 +01:00
recon_avproduct_through_pwh_or_wmi.test.yml
hpot
2021-06-14 11:55:13 +02:00
recon_using_wmi_class.test.yml
Fixing descriptions
2021-06-18 13:41:54 -06:00
recursive_delete_of_directory_in_batch_cmd.test.yml
ransom_ttp_p2
2021-06-23 12:38:49 +02:00
reg_exe_manipulating_windows_services_registry_keys.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
registry_keys_for_creating_shim_databases.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
registry_keys_used_for_persistence.test.yml
Fixed filenames on some tests. There were named
2021-10-15 14:58:21 -07:00
registry_keys_used_for_privilege_escalation.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
regsvr32_silent_and_install_param_dll_loading.test.yml
fix_issues
2021-11-09 11:47:06 +01:00
regsvr32_with_known_silent_switch_cmdline.test.yml
fix_issues
2021-11-09 13:14:31 +01:00
remcos_client_registry_install_entry.test.yml
success on AR
2021-09-29 11:07:22 -07:00
remcos_rat_file_creation_in_remcos_folder.test.yml
remcos_agent
2021-09-22 14:08:13 +02:00
remote_process_instantiation_via_dcom_and_powershell_script_block.test.yml
adding 2 extra detections
2021-11-15 22:42:22 -05:00
remote_process_instantiation_via_dcom_and_powershell.test.yml
adding 2 extra detections
2021-11-15 22:42:22 -05:00
remote_process_instantiation_via_winrm_and_powershell_script_block.test.yml
adding two extra detections
2021-11-16 17:41:01 -05:00
remote_process_instantiation_via_winrm_and_powershell.test.yml
adding two extra detections
2021-11-16 17:41:01 -05:00
remote_process_instantiation_via_winrm_and_winrs.test.yml
fixing test yml
2021-11-12 14:45:56 -05:00
remote_process_instantiation_via_wmi_and_powershell_script_block.test.yml
adding first two detections
2021-11-15 15:09:47 -05:00
remote_process_instantiation_via_wmi_and_powershell.test.yml
adding first two detections
2021-11-15 15:09:47 -05:00
remote_process_instantiation_via_wmi.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
remote_system_discovery_with_adsisearcher.test.yml
adding 3 detections
2021-09-01 17:36:43 -04:00
remote_system_discovery_with_dsquery.test.yml
adding 5 detections
2021-09-01 13:05:51 -04:00
remote_system_discovery_with_net.test.yml
adding 5 detections
2021-09-01 13:05:51 -04:00
remote_system_discovery_with_wmic.test.yml
adding 5 detections
2021-09-01 13:05:51 -04:00
remote_wmi_command_attempt.test.yml
wrong data
2021-06-18 11:00:34 -06:00
resize_shadowstorage_volume.test.yml
clop_test_file
2021-03-22 11:45:21 +01:00
revil_common_exec_parameter.test.yml
Update revil_common_exec_parameter.test.yml
2021-06-04 16:14:09 +02:00
revil_registry_entry.test.yml
revil1
2021-06-04 16:10:57 +02:00
runas_execution_in_commandline.test.yml
ioc_detections
2021-11-17 17:59:06 +01:00
rundll32_control_rundll_hunt.test.yml
rundll32 control_rundll32_hunt
2021-09-08 12:42:53 -06:00
rundll32_control_rundll_world_writable_directory.test.yml
rundll32_control_rundll_world_writable_directory
2021-09-08 12:49:21 -06:00
rundll32_create_remote_thread_to_a_process.test.yml
icedid
2021-07-29 15:19:44 +02:00
rundll32_createremotethread_in_browser.test.yml
icedid
2021-07-29 15:19:44 +02:00
rundll32_dnsquery.test.yml
icedid
2021-08-03 13:00:06 +02:00
rundll32_lockworkstation.test.yml
conti_leak
2021-08-12 11:48:18 +02:00
rundll32_process_creating_exe_dll_files.test.yml
icedid
2021-08-03 13:00:06 +02:00
rundll32_shimcache_flush.test.yml
privilege_escalation_persistence
2021-10-05 11:56:48 +02:00
rundll32_with_no_command_line_arguments_with_network.test.yml
Update rundll32_with_no_command_line_arguments_with_network.test.yml
2021-04-19 11:57:51 -06:00
rundll_loading_dll_by_ordinal.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
ryuk_test_files_detected.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
ryuk_wake_on_lan_command.test.yml
Ryuk Wake on LAN
2021-03-01 10:07:12 -07:00
sam_database_file_access_attempt.test.yml
SAM I AM
2021-07-23 14:06:27 -06:00
samsam_test_file_write.test.yml
new test file
2020-12-07 13:09:29 +01:00
sc_exe_manipulating_windows_services.test.yml
new test file
2020-12-07 13:22:34 +01:00
schcache_change_by_app_connect_and_create_adsi_object.test.yml
blackMatter_ransomware
2021-09-08 10:05:16 +02:00
schedule_task_with_http_command_arguments.test.yml
fix_typos
2021-05-05 21:34:02 +02:00
schedule_task_with_rundll32_command_trigger.test.yml
trickbot
2021-04-26 17:01:03 +02:00
scheduled_task_creation_on_remote_endpoint_using_at.test.yml
datasets ready
2021-11-12 13:11:10 -05:00
scheduled_task_deleted_or_created_via_cmd.test.yml
renaming dragonfly
2020-12-17 13:53:20 -05:00
scheduled_task_initiation_on_remote_endpoint.test.yml
datasets ready
2021-11-12 13:11:10 -05:00
schtasks_run_task_on_demand.test.yml
xmrig2
2021-05-07 13:56:08 +02:00
schtasks_scheduling_job_on_remote_system.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
schtasks_used_for_forcing_a_reboot.test.yml
Fixed filenames on some tests. There were named
2021-10-15 14:58:21 -07:00
screensaver_event_trigger_execution.test.yml
privilege_esc_persistence
2021-09-28 11:13:54 +02:00
script_execution_via_wmi.test.yml
new test file
2020-12-07 14:18:07 +01:00
sdclt_uac_bypass.test.yml
uac_2
2021-07-12 13:19:47 +02:00
sdelete_application_execution.test.yml
privilege_escalation_persistence
2021-10-06 11:15:47 +02:00
searchprotocolhost_with_no_command_line_with_network.test.yml
Update searchprotocolhost_with_no_command_line_with_network.test.yml
2021-04-22 10:00:32 -06:00
secretdumps_offline_ntds_dumping_tool.test.yml
casper1
2021-05-26 13:33:47 +02:00
serviceprincipalnames_discovery_with_powershell.test.yml
HaagRoast
2021-10-15 12:31:33 -06:00
serviceprincipalnames_discovery_with_setspn.test.yml
HaagRoast
2021-10-15 12:31:33 -06:00
services_escalate_exe.test.yml
svc-exe
2021-05-18 09:45:46 -06:00
services_exe_lolbas_execution_process_spawn.test.yml
adding dataset fields
2021-11-23 17:15:06 -05:00
set_default_powershell_execution_policy_to_unrestricted_or_bypass.test.yml
search name and file renames
2021-04-20 13:10:00 -07:00
shim_database_file_creation.test.yml
test detection
2020-12-08 10:02:38 +01:00
shim_database_installation_with_suspicious_parameters.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
short_lived_scheduled_task.test.yml
3 new detections
2021-12-03 15:58:00 -05:00
short_lived_windows_accounts.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
silentcleanup_uac_bypass.test.yml
uac_2
2021-07-12 13:19:47 +02:00
single_letter_process_on_endpoint.test.yml
new test file
2020-12-08 10:12:15 +01:00
slui_runas_elevated.test.yml
SLUI
2021-05-13 06:52:59 -06:00
slui_spawning_a_process.test.yml
SLUI
2021-05-13 06:52:59 -06:00
spoolsv_spawning_rundll32.test.yml
Printing All your Nightmares
2021-07-01 12:01:45 -06:00
spoolsv_suspicious_loaded_modules.test.yml
Path issues
2021-07-01 12:14:19 -06:00
spoolsv_suspicious_process_access.test.yml
Path issues
2021-07-01 12:14:19 -06:00
spoolsv_writing_a_dll___sysmon.test.yml
Path issues
2021-07-01 12:14:19 -06:00
spoolsv_writing_a_dll.test.yml
Path issues
2021-07-01 12:14:19 -06:00
sqlite_module_in_temp_folder.test.yml
icedid
2021-08-05 13:36:35 +02:00
ssa___anomalous_usage_of_archive_tools.test.yml
SSA anommalous usage of archive tools
2021-11-23 10:14:50 +01:00
ssa___applying_stolen_credentials_via_mimikatz_modules.test.yml
updated test file
2021-03-26 16:29:58 +01:00
ssa___applying_stolen_credentials_via_powersploit_modules.test.yml
updated test file
2021-03-26 16:29:58 +01:00
ssa___assess_credential_strength_via_dsinternals_modules.test.yml
updated test file
2021-03-26 16:29:58 +01:00
ssa___attempt_to_delete_services.test.yml
ssa_p2
2021-06-23 14:47:14 +02:00
ssa___attempt_to_disable_services.test.yml
ssa_p2
2021-06-23 14:47:14 +02:00
ssa___attempted_credential_dump_from_registry_via_reg_exe.test.yml
updated test file
2021-03-26 16:29:58 +01:00
ssa___bcdedit_failure_recovery_modification.test.yml
Update ssa___bcdedit_failure_recovery_modification.test.yml
2021-12-07 12:38:37 -07:00
ssa___credential_extraction_dsinternals_conversion_modules.test.yml
updated test file
2021-03-26 16:29:58 +01:00
ssa___credential_extraction_dsinternals_modules.test.yml
updated test file
2021-03-26 16:29:58 +01:00
ssa___credential_extraction_fgdump_cachedump_s_option.test.yml
updated test file
2021-03-26 16:29:58 +01:00
ssa___credential_extraction_fgdump_cachedump_v_option.test.yml
updated test file
2021-03-26 16:29:58 +01:00
ssa___credential_extraction_getaddbaccount_from_dump.test.yml
updated test file
2021-03-26 16:29:58 +01:00
ssa___credential_extraction_lazagne_command_options.test.yml
updated test file
2021-03-26 16:29:58 +01:00
ssa___credential_extraction_mimikatz_modules.test.yml
updated test file
2021-03-26 16:29:58 +01:00
ssa___credential_extraction_ms_debuggers_kernel_peek.test.yml
updated test file
2021-03-26 16:29:58 +01:00
ssa___credential_extraction_ms_debuggers_z_option.test.yml
updated test file
2021-03-26 16:29:58 +01:00
ssa___credential_extraction_powersploit_modules.test.yml
updated test file
2021-03-26 16:29:58 +01:00
ssa___delete_a_net_user.test.yml
Update ssa___delete_a_net_user.test.yml
2021-11-25 09:30:44 +01:00
ssa___deny_permission_using_cacls_utility.test.yml
[PR-1444] fix branch reversion.
2021-06-24 01:36:15 -07:00
ssa___detect_dump_lsass_memory_using_comsvcs.test.yml
updated test file
2021-03-26 16:29:58 +01:00
ssa___detect_kerberoasting.test.yml
Allow kerberoasting detection to fail
2021-07-19 15:21:05 -05:00
ssa___detect_prohibited_applications_spawning_cmd_exe.test.yml
🍺
2021-11-10 10:53:55 -07:00
ssa___detect_rclone_command_line_usage.test.yml
rcloned 4688 logs
2021-12-10 11:39:45 -07:00
ssa___disable_net_user_account.test.yml
ssa_p2
2021-06-23 14:47:14 +02:00
ssa___dns_exfiltration_using_nslookup_app.test.yml
DNS Exfil
2021-12-07 11:43:34 -07:00
ssa___excessive_number_of_office_files_copied.test.yml
BA detections
2021-12-08 15:27:44 +01:00
ssa___first_time_seen_cmd_line.test.yml
Fixing first_time pass_condition
2021-07-19 14:52:43 -05:00
ssa___fsutil_zeroing_file.test.yml
fsutil and bcdedit
2021-12-07 12:19:41 -07:00
ssa___grant_permission_using_cacls_utility.test.yml
[PR-1444] fix branch reversion.
2021-06-24 01:36:15 -07:00
ssa___high_file_deletion_frequency.test.yml
BA detections
2021-12-08 12:50:13 +01:00
ssa___illegal_access_user_content_via_powersploit_modules.test.yml
updated test file
2021-03-26 16:29:58 +01:00
ssa___illegal_account_creation_via_powersploit_modules.test.yml
updated test file
2021-03-26 16:29:58 +01:00
ssa___illegal_account_enable_disable_via_dsinternals_modules.test.yml
fix broken dataset links
2021-11-19 12:49:53 +01:00
ssa___illegal_log_deletion_via_mimikatz_modules.test.yml
updated test file
2021-03-26 16:29:58 +01:00
ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.test.yml
updated test file
2021-03-26 16:29:58 +01:00
ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.test.yml
updated test file
2021-03-26 16:29:58 +01:00
ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.test.yml
merged
2021-03-26 16:26:13 +01:00
ssa___illegal_privilege_elevation_via_mimikatz_modules.test.yml
updated test file
2021-03-26 16:29:58 +01:00
ssa___illegal_service_and_process_control_via_mimikatz_modules.test.yml
updated test file
2021-03-26 16:29:58 +01:00
ssa___illegal_service_and_process_control_via_powersploit_modules.test.yml
merged
2021-03-26 16:26:13 +01:00
ssa___modify_acls_permission_of_files_or_folders.test.yml
[PR-1444] fix branch reversion.
2021-06-24 01:36:15 -07:00
ssa___probing_access_with_stolen_credentials_via_powersploit_modules.test.yml
updated test files
2021-03-26 08:51:39 +01:00
ssa___prohibited_apps_spawning_cmdprompt.test.yml
updated test file
2021-03-29 16:30:15 +02:00
ssa___ptt_pth_kerb_ntlm_dest_device.test.yml
Paths to new tests ...
2021-09-20 10:20:33 -07:00
ssa___ptt_pth_kerb_ntlm_origin_device.test.yml
Paths to new tests ...
2021-09-20 10:20:33 -07:00
ssa___rare_parent_process_relationship_lolbas.test.yml
Fixing test data pointer
2021-06-07 22:37:23 -05:00
ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.test.yml
updated test files
2021-03-26 08:51:39 +01:00
ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.test.yml
updated test files
2021-03-26 08:51:39 +01:00
ssa___recon_and_use_accounts_groups_via_mimikatz_modules.test.yml
updated test files
2021-03-26 08:51:39 +01:00
ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.test.yml
updated test files
2021-03-26 08:51:39 +01:00
ssa___recon_and_use_computers_domains_via_powersploit_modules.test.yml
updated test files
2021-03-26 08:51:39 +01:00
ssa___recon_and_use_computers_via_mimikatz_modules.test.yml
updated test files
2021-03-26 08:51:39 +01:00
ssa___recon_and_use_operating_system_elements_via_powersploit_modules.test.yml
updated test files
2021-03-26 08:51:39 +01:00
ssa___recon_and_use_shares_via_mimikatz_modules.test.yml
updated test files
2021-03-26 08:51:39 +01:00
ssa___recon_and_use_shares_via_powersploit_modules.test.yml
updated test files
2021-03-26 10:21:19 +01:00
ssa___recon_connectivity_via_powersploit_modules.test.yml
updated test files
2021-03-26 08:51:39 +01:00
ssa___recon_credential_stores_and_services_via_mimikatz_modules.test.yml
updated test files
2021-03-26 08:51:39 +01:00
ssa___recon_defensive_tools_via_powersploit_modules.test.yml
updated test files
2021-03-26 08:51:39 +01:00
ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.test.yml
updated test files
2021-03-26 08:51:39 +01:00
ssa___recon_process_service_hijacking_via_mimikatz_modules.test.yml
updated test files
2021-03-26 08:51:39 +01:00
ssa___recon_processes_and_services_via_mimikatz_modules.test.yml
updated test files
2021-03-26 08:51:39 +01:00
ssa___resize_shadowstorage_volume.test.yml
ssa_p2
2021-06-23 14:47:14 +02:00
ssa___sdelete_application_execution.test.yml
ssa_sdelete
2021-11-17 11:25:01 +01:00
ssa___setting_credentials_via_dsinternals_modules.test.yml
updated test files
2021-03-26 08:51:39 +01:00
ssa___setting_credentials_via_mimikatz_modules.test.yml
updated test files
2021-03-26 08:51:39 +01:00
ssa___setting_credentials_via_powersploit_modules.test.yml
updated test files
2021-03-26 08:51:39 +01:00
ssa___system_process_running_unexpected_location.test.yml
Adding sourcetype to sysproc_unexpected_location test
2021-12-16 10:44:05 -06:00
ssa___unusual_lolbas_in_short_period_of_time.test.yml
Adding pass_condition verification for SSA detections
2021-07-16 16:43:26 -05:00
ssa___unusually_long_command_line.test.yml
updated test file
2021-03-29 18:14:07 +02:00
ssa___wbadmin_delete_system_backups.test.yml
Update ssa___wbadmin_delete_system_backups.test.yml
2021-12-07 14:01:52 -07:00
ssa___wevtutil_usage_to_clear_logs.test.yml
[PR-1444] fix branch reversion.
2021-06-24 01:36:15 -07:00
ssa___wevtutil_usage_to_disable_logs.test.yml
[PR-1444] fix branch reversion.
2021-06-24 01:36:15 -07:00
ssa___windows_curl_upload_to_remote_destination.test.yml
Caps fix
2021-12-16 14:53:54 -06:00
start_up_during_safe_mode_boot.test.yml
Delete start_up_during_safe_mode_boot.test.yml
2021-06-16 10:20:51 +02:00
suspicious_computer_account_name_change.test.yml
minor fix
2021-12-20 17:04:58 -05:00
suspicious_copy_on_system32.test.yml
privilege_escalation_persistence
2021-10-05 11:56:48 +02:00
suspicious_dllhost_no_command_line_arguments.test.yml
Update suspicious_dllhost_no_command_line_arguments.test.yml
2021-02-23 14:22:23 -07:00
suspicious_driver_loaded_path.test.yml
xmrig_ir
2021-05-07 13:38:12 +02:00
suspicious_event_log_service_behavior.test.yml
fixing errors
2021-06-21 17:10:54 -04:00
suspicious_gpupdate_no_command_line_arguments.test.yml
Update suspicious_gpupdate_no_command_line_arguments.test.yml
2021-02-23 13:48:57 -07:00
suspicious_icedid_rundll32_cmdline.test.yml
icedid
2021-07-29 15:19:44 +02:00
suspicious_image_creation_in_appdata_folder.test.yml
remcos_agent
2021-09-22 14:08:13 +02:00
suspicious_kerberos_service_ticket_request.test.yml
adding new detection
2021-12-20 22:08:19 -05:00
suspicious_microsoft_workflow_compiler_rename.test.yml
Update suspicious_microsoft_workflow_compiler_rename.test.yml
2021-08-20 11:20:34 -06:00
suspicious_microsoft_workflow_compiler_usage.test.yml
Updated URLs and fixes
2021-08-20 11:53:42 -06:00
suspicious_msbuild_path.test.yml
URL Fixes
2021-01-19 13:43:37 -07:00
suspicious_msbuild_rename.test.yml
URL Fixes
2021-01-19 13:43:37 -07:00
suspicious_msbuild_spawn.test.yml
URL Fixes
2021-01-19 13:43:37 -07:00
suspicious_mshta_child_process.test.yml
wrong url
2021-01-26 10:56:49 -07:00
suspicious_mshta_spawn.test.yml
ID changes
2021-01-20 14:45:27 -07:00
suspicious_process_dns_query_known_abuse_web_services.test.yml
ioc_detections
2021-11-18 12:05:43 +01:00
suspicious_process_file_path.test.yml
xmrig_ir
2021-05-07 13:38:12 +02:00
suspicious_reg_exe_process.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
suspicious_regsvr32_register_suspicious_path.test.yml
Update suspicious_regsvr32_register_suspicious_path.test.yml
2021-01-29 13:34:40 -07:00
suspicious_rundll32_dllregisterserver.test.yml
rundll32 dllregisterserver
2021-02-09 12:10:39 -07:00
suspicious_rundll32_plugininit.test.yml
icedid
2021-07-29 15:19:44 +02:00
suspicious_rundll32_rename.test.yml
rundll32 advpack and rename
2021-02-04 14:38:54 -07:00
suspicious_rundll32_startw.test.yml
Rundll32,StartW
2021-02-09 10:54:34 -07:00
suspicious_rundll32_with_no_command_line_arguments.test.yml
misspell
2021-02-09 11:27:19 -07:00
suspicious_scheduled_task_from_public_directory.test.yml
Update suspicious_scheduled_task_from_public_directory.test.yml
2021-03-02 15:01:54 -07:00
suspicious_searchprotocolhost_no_command_line_arguments.test.yml
SearchprotocolHost
2021-02-23 15:04:11 -07:00
suspicious_ticket_granting_ticket_request.test.yml
adding new detection
2021-12-21 13:44:17 -05:00
suspicious_wav_file_in_appdata_folder.test.yml
remcos_agent
2021-09-22 14:08:13 +02:00
suspicious_wevtutil_usage.test.yml
new test file
2020-12-08 11:19:49 +01:00
suspicious_writes_to_windows_recycle_bin.test.yml
new test file
2020-12-08 11:47:59 +01:00
svchost_exe_lolbas_execution_process_spawn.test.yml
update dataset location
2021-11-24 09:37:47 -05:00
system_info_gathering_using_dxdiag_application.test.yml
more_ioc_detections
2021-11-19 12:01:45 +01:00
system_information_discovery_detection.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
system_processes_run_from_unexpected_locations.test.yml
new test file
2020-12-08 13:27:58 +01:00
system_user_discovery_with_query.test.yml
initial 2 detections
2021-09-13 12:08:42 -04:00
system_user_discovery_with_whoami.test.yml
initial 2 detections
2021-09-13 12:08:42 -04:00
time_provider_persistence_registry.test.yml
privilege_escalation_persistence
2021-09-30 10:29:01 +02:00
trickbot_named_pipe.test.yml
trickbot
2021-04-26 17:01:03 +02:00
uac_bypass_mmc_load_unsigned_dll.test.yml
uac3
2021-07-12 16:34:55 +02:00
uac_bypass_with_colorui_com_object.test.yml
conti_leak
2021-08-13 14:05:33 +02:00
unified_messaging_service_spawning_a_process.test.yml
Update unified_messaging_service_spawning_a_process.test.yml
2021-03-12 08:16:15 -07:00
uninstall_app_using_msiexec.test.yml
conti_leak
2021-08-12 11:48:18 +02:00
unload_sysmon_filter_driver.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
unloading_amsi_via_reflection.test.yml
PowerShell Script Block Initial Analytics
2021-06-09 14:26:05 -06:00
unusually_long_command_line.test.yml
new test file
2020-12-08 13:38:41 +01:00
user_discocvery_with_env_vars_powershell.test.yml
adding 4 detections
2021-09-13 17:22:30 -04:00
user_discovery_with_env_vars_powershell_script_block.test.yml
adding 4 detections
2021-09-13 17:22:30 -04:00
usn_journal_deletion.test.yml
new test file
2020-12-08 14:18:08 +01:00
vbscript_execution_using_wscript_app.test.yml
privilege_escalation_persistence
2021-10-01 10:25:56 +02:00
verclsid_clsid_execution.test.yml
privilege_escalation_persistence
2021-09-29 10:42:05 +02:00
w3wp_spawning_shell.test.yml
w3wp spawning shell
2021-03-11 12:34:21 -07:00
wbadmin_delete_system_backups.test.yml
Adding WBAdmin - delete system backups
2021-01-22 13:52:56 -07:00
wbemprox_com_object_execution.test.yml
revil
2021-06-04 16:07:02 +02:00
wermgr_process_connecting_to_ip_check_web_services.test.yml
test_tr
2021-05-03 17:12:24 +02:00
wermgr_process_create_executable_file.test.yml
test_tr
2021-05-03 17:12:24 +02:00
wermgr_process_spawned_cmd_or_powershell_process.test.yml
test_tr
2021-05-03 17:12:24 +02:00
wget_download_and_bash_execution.test.yml
wget curl
2021-12-13 07:11:07 -07:00
windows_adfind_exe.test.yml
updates
2021-11-03 13:40:22 -07:00
windows_curl_download_to_suspicious_path.test.yml
fixes
2021-10-20 07:08:14 -06:00
windows_curl_upload_to_remote_destination.test.yml
Curl to upload
2021-11-10 08:59:59 -07:00
windows_defender_exclusion_registry_entry.test.yml
remcos_evasion
2021-11-25 12:27:39 +01:00
windows_disableantispyware_reg.test.yml
Create windows_disableantispyware_reg.test.yml
2021-03-02 15:21:55 -07:00
windows_diskcryptor_usage.test.yml
dcrypt
2021-11-15 14:22:39 -07:00
windows_event_log_cleared.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
windows_installutil_credential_theft.test.yml
InstallUTIL 🍺
2021-11-12 13:05:19 -07:00
windows_installutil_remote_network_connection.test.yml
InstallUTIL 🍺
2021-11-12 13:05:19 -07:00
windows_installutil_uninstall_option_with_network.test.yml
InstallUTIL 🍺
2021-11-12 13:05:19 -07:00
windows_installutil_uninstall_option.test.yml
InstallUTIL 🍺
2021-11-12 13:05:19 -07:00
windows_installutil_url_in_command_line.test.yml
InstallUTIL 🍺
2021-11-12 13:05:19 -07:00
windows_security_account_manager_stopped.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
windows_service_created_with_suspicious_service_path.test.yml
creating an extra detection
2021-11-22 16:21:43 -05:00
windows_service_created_within_public_path.test.yml
adding 4 new detections
2021-11-23 10:13:07 -05:00
windows_service_creation_on_remote_endpoint.test.yml
datasets ready
2021-11-12 13:11:10 -05:00
windows_service_initiation_on_remote_endpoint.test.yml
datasets ready
2021-11-12 13:11:10 -05:00
winevent_scheduled_task_created_to_spawn_shell.test.yml
Update winevent_scheduled_task_created_to_spawn_shell.test.yml
2021-04-19 12:37:35 -06:00
winevent_scheduled_task_created_within_public_path.test.yml
winevent fix
2021-04-19 10:39:42 -06:00
winevent_windows_task_scheduler_event_action_started.test.yml
updated
2021-11-10 05:53:31 -07:00
winhlp32_spawning_a_process.test.yml
test files
2021-10-05 14:54:17 -06:00
winword_spawning_cmd.test.yml
Update winword_spawning_cmd.test.yml
2021-04-22 09:52:23 -06:00
winword_spawning_powershell.test.yml
Update winword_spawning_powershell.test.yml
2021-04-21 10:55:51 -06:00
winword_spawning_windows_script_host.test.yml
Update winword_spawning_windows_script_host.test.yml
2021-04-22 11:29:59 -06:00
wmi_permanent_event_subscription___sysmon.test.yml
new test file
2020-12-08 15:43:25 +01:00
wmi_recon_running_process_or_services.test.yml
hpot
2021-06-14 11:55:13 +02:00
wmic_group_discovery.test.yml
May The Haag Be With You
2021-09-14 11:05:59 -06:00
wmic_noninteractive_app_uninstallation.test.yml
iceid_ttps
2021-10-20 11:38:22 +02:00
wmic_xsl_execution_via_url.test.yml
Update wmic_xsl_execution_via_url.test.yml
2021-11-12 08:07:59 -07:00
wmiprsve_exe_lolbas_execution_process_spawn.test.yml
update dataset metadata
2021-11-23 18:42:48 -05:00
wscript_or_cscript_suspicious_child_process.test.yml
privilege_escalation_persistence
2021-10-06 11:15:47 +02:00
wsmprovhost_exe_lolbas_execution_process_spawn.test.yml
update datasets
2021-11-23 20:33:27 -05:00
wsreset_uac_bypass.test.yml
uac_2
2021-07-12 13:19:47 +02:00
xmrig_driver_loaded.test.yml
xmrig_ir
2021-05-07 13:38:12 +02:00
xsl_script_execution_with_wmic.test.yml
FIN7
2021-09-14 12:17:55 +02:00