admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
44f7892c1953b2ad5cf66dc682008f263edebcbb
splunk-security_content/detections/endpoint
T
History
mhaag-spl 44f7892c19 RBA done
2021-07-14 15:43:38 -06:00
..
access_lsass_memory_for_dump_creation.yml
updating docs and package bits [ci skip]
2021-07-02 16:06:07 +00:00
account_discovery_with_net_app.yml
RBA
2021-07-01 06:52:15 -06:00
allow_file_and_printing_sharing_in_firewall.yml
updating docs and package bits [ci skip]
2021-07-13 23:26:40 +00:00
allow_inbound_traffic_by_firewall_rule_registry.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
allow_inbound_traffic_in_firewall_rule.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
allow_network_discovery_in_firewall.yml
Merge branch 'develop' into Risky
2021-07-14 07:49:31 -06:00
allow_operation_with_consent_admin.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
anomalous_usage_of_7zip.yml
bug fix detection testing
2021-07-14 11:45:33 +02:00
any_powershell_downloadfile.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
any_powershell_downloadstring.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
attempt_to_add_certificate_to_untrusted_store.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
attempt_to_stop_security_service.yml
RBA done
2021-07-14 15:43:38 -06:00
attempted_credential_dump_from_registry_via_reg_exe.yml
fixes
2021-07-14 08:31:05 -06:00
batch_file_write_to_system32.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
bcdedit_failure_recovery_modification.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
bits_job_persistence.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
bitsadmin_download_file.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
certutil_download_with_urlcache_and_split_arguments.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
certutil_download_with_verifyctl_and_split_arguments.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
certutil_exe_certificate_extraction.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
certutil_with_decode_argument.yml
updating docs and package bits [ci skip]
2021-07-13 23:26:40 +00:00
clear_unallocated_sector_using_cipher_app.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
clop_common_exec_parameter.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
clop_ransomware_known_service_name.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
cmd_echo_pipe___escalation.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
cmlua_or_cmstplua_uac_bypass.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
cobalt_strike_named_pipes.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
common_ransomware_extensions.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
common_ransomware_notes.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
conti_common_exec_parameter.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
create_local_admin_accounts_using_net_exe.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
create_or_delete_windows_shares_using_net_exe.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
create_remote_thread_into_lsass.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
create_service_in_suspicious_file_path.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
creation_of_lsass_dump_with_taskmgr.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
creation_of_shadow_copy_with_wmic_and_powershell.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
creation_of_shadow_copy.yml
fixes
2021-07-14 08:31:05 -06:00
credential_dumping_via_copy_command_from_shadow_copy.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
credential_dumping_via_symlink_to_shadow_copy.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
delete_shadowcopy_with_powershell.yml
Merge branch 'develop' into Risky
2021-07-14 07:49:31 -06:00
deleting_of_net_users.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
deleting_shadow_copies.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_activity_related_to_pass_the_hash_attacks.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_azurehound_command_line_arguments.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_azurehound_file_modifications.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_computer_changed_with_anonymous_account.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_credential_dumping_through_lsass_access.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_empire_with_powershell_script_block_logging.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_excessive_account_lockouts_from_endpoint.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_excessive_user_account_lockouts.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_exchange_web_shell.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_html_help_renamed.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_html_help_spawn_child_process.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_html_help_url_in_command_line.yml
updating docs and package bits [ci skip]
2021-07-13 23:26:40 +00:00
detect_html_help_using_infotech_storage_handlers.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_mimikatz_using_loaded_images.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_mimikatz_with_powershell_script_block_logging.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_mshta_inline_hta_execution.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_mshta_renamed.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_mshta_url_in_command_line.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_new_local_admin_account.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_path_interception_by_creation_of_program_exe.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_processes_used_for_system_network_configuration_discovery.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_prohibited_applications_spawning_cmd_exe.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_psexec_with_accepteula_flag.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_rclone_command_line_usage.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_regasm_spawning_a_process.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_regasm_with_network_connection.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_regasm_with_no_command_line_arguments.yml
RBA done
2021-07-14 15:43:38 -06:00
detect_regsvcs_spawning_a_process.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_regsvcs_with_network_connection.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_regsvcs_with_no_command_line_arguments.yml
RBA done
2021-07-14 15:43:38 -06:00
detect_regsvr32_application_control_bypass.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_renamed_7_zip.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_renamed_psexec.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_renamed_rclone.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_renamed_winrar.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_rundll32_application_control_bypass___advpack.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_rundll32_application_control_bypass___setupapi.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_rundll32_application_control_bypass___syssetup.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_rundll32_inline_hta_execution.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_sharphound_command_line_arguments.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_sharphound_file_modifications.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_sharphound_usage.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_use_of_cmd_exe_to_launch_script_interpreters.yml
RISKY FRISKY
2021-07-13 13:47:54 -06:00
detect_wmi_event_subscription_persistence.yml
Merge branch 'develop' into Risky
2021-07-14 07:49:31 -06:00
disable_amsi_through_registry.yml
updating docs and package bits [ci skip]
2021-07-13 23:26:40 +00:00
disable_etw_through_registry.yml
updating docs and package bits [ci skip]
2021-07-13 23:26:40 +00:00
disable_logs_using_wevtutil.yml
adding rba support for 11 more detecteions
2021-07-13 12:26:02 -04:00
disable_registry_tool.yml
adding rba support for 11 more detecteions
2021-07-13 12:26:02 -04:00
disable_show_hidden_files.yml
adding rba support for 11 more detecteions
2021-07-13 12:26:02 -04:00
disable_windows_app_hotkeys.yml
adding rba support for 11 more detecteions
2021-07-13 12:26:02 -04:00
disable_windows_behavior_monitoring.yml
Merge branch 'develop' into Risky
2021-07-14 07:49:31 -06:00
disable_windows_smartscreen_protection.yml
fixes
2021-07-14 08:31:05 -06:00
disabling_cmd_application.yml
RBA done
2021-07-14 15:43:38 -06:00
disabling_controlpanel.yml
RBA done
2021-07-14 15:43:38 -06:00
disabling_firewall_with_netsh.yml
RBA done
2021-07-14 15:43:38 -06:00
disabling_folderoptions_windows_feature.yml
RBA done
2021-07-14 15:43:38 -06:00
disabling_net_user_account.yml
RBA done
2021-07-14 15:43:38 -06:00
disabling_norun_windows_app.yml
RBA done
2021-07-14 15:43:38 -06:00
disabling_remote_user_account_control.yml
RBA done
2021-07-14 15:43:38 -06:00
disabling_systemrestore_in_registry.yml
RBA done
2021-07-14 15:43:38 -06:00
disabling_task_manager.yml
RBA done
2021-07-14 15:43:38 -06:00
dllhost_with_no_command_line_arguments_with_network.yml
RBA done
2021-07-14 15:43:38 -06:00
dns_exfiltration_using_nslookup_app.yml
RBA done
2021-07-14 15:43:38 -06:00
download_files_using_telegram.yml
RBA done
2021-07-14 15:43:38 -06:00
dsquery_domain_discovery.yml
RBA done
2021-07-14 15:43:38 -06:00
dump_lsass_via_comsvcs_dll.yml
RBA done
2021-07-14 15:43:38 -06:00
dump_lsass_via_procdump_rename.yml
RBA done
2021-07-14 15:43:38 -06:00
dump_lsass_via_procdump.yml
RBA done
2021-07-14 15:43:38 -06:00
enable_rdp_in_other_port_number.yml
RBA done
2021-07-14 15:43:38 -06:00
enumerate_users_local_group_using_telegram.yml
RBA done
2021-07-14 15:43:38 -06:00
eventvwr_uac_bypass.yml
RBA done
2021-07-14 15:43:38 -06:00
excel_spawning_powershell.yml
RBA done
2021-07-14 15:43:38 -06:00
excel_spawning_windows_script_host.yml
RBA done
2021-07-14 15:43:38 -06:00
excessive_attempt_to_disable_services.yml
RBA done
2021-07-14 15:43:38 -06:00
excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml
RBA done
2021-07-14 15:43:38 -06:00
excessive_number_of_service_control_start_as_disabled.yml
RBA done
2021-07-14 15:43:38 -06:00
excessive_number_of_taskhost_processes.yml
RBA done
2021-07-14 15:43:38 -06:00
excessive_service_stop_attempt.yml
RBA done
2021-07-14 15:43:38 -06:00
excessive_usage_of_cacls_app.yml
RBA done
2021-07-14 15:43:38 -06:00
excessive_usage_of_net_app.yml
rttp4
2021-06-24 10:43:36 +02:00
excessive_usage_of_nslookup_app.yml
rttp4
2021-06-24 10:43:36 +02:00
excessive_usage_of_sc_service_utility.yml
updating docs and package bits [ci skip]
2021-07-13 23:26:40 +00:00
excessive_usage_of_taskkill.yml
updating docs and package bits [ci skip]
2021-05-24 17:47:29 +00:00
executables_or_script_creation_in_suspicious_path.yml
updating docs and package bits [ci skip]
2021-05-24 17:47:29 +00:00
execute_javascript_with_jscript_com_clsid.yml
updating docs and package bits [ci skip]
2021-07-13 23:26:40 +00:00
execution_of_file_with_multiple_extensions.yml
Masquerading - detections + analytic story
2021-04-26 13:38:52 -06:00
extract_sam_from_registry.yml
updating docs and package bits [ci skip]
2021-05-13 22:09:29 +00:00
file_with_samsam_extension.yml
WIP
2021-03-10 14:44:44 +01:00
first_time_seen_child_process_of_zoom.yml
WIP
2021-03-10 14:44:44 +01:00
fodhelper_uac_bypass.yml
updating docs and package bits [ci skip]
2021-03-12 17:32:09 +00:00
gpupdate_with_no_command_line_arguments_with_network.yml
updating docs and package bits [ci skip]
2021-04-22 21:55:11 +00:00
hide_user_account_from_sign_in_screen.yml
updating docs and package bits [ci skip]
2021-05-24 17:47:29 +00:00
hiding_files_and_directories_with_attrib_exe.yml
WIP
2021-03-10 14:44:44 +01:00
high_file_deletion_frequency.yml
updating docs and package bits [ci skip]
2021-03-25 19:35:07 +00:00
high_process_termination_frequency.yml
updating docs and package bits [ci skip]
2021-03-25 19:35:07 +00:00
icacls_deny_command.yml
updating docs and package bits [ci skip]
2021-05-24 17:47:29 +00:00
icacls_grant_command.yml
rttp4
2021-06-24 10:43:36 +02:00
kerberoasting_spn_request_with_rc4_encryption.yml
new detection testing
2021-06-15 17:50:53 +02:00
known_services_killed_by_ransomware.yml
updating docs and package bits [ci skip]
2021-06-10 18:46:43 +00:00
mailsniper_invoke_functions.yml
updating docs and package bits [ci skip]
2021-06-10 18:46:43 +00:00
malicious_powershell_executed_as_a_service.yml
Adding a more deterministic matching of command line options.
2021-04-15 15:49:59 -07:00
malicious_powershell_process___connect_to_internet_with_hidden_window.yml
add required fields and check
2021-03-11 09:11:48 +01:00
malicious_powershell_process___encoded_command.yml
add required fields and check
2021-03-11 09:11:48 +01:00
malicious_powershell_process___execution_policy_bypass.yml
add required fields and check
2021-03-11 09:11:48 +01:00
malicious_powershell_process_with_obfuscation_techniques.yml
WIP
2021-03-10 14:44:44 +01:00
modification_of_wallpaper.yml
updating docs and package bits [ci skip]
2021-06-10 18:46:43 +00:00
modify_acl_permission_to_files_or_folder.yml
updating docs and package bits [ci skip]
2021-05-24 17:47:29 +00:00
monitor_registry_keys_for_print_monitors.yml
WIP
2021-03-10 14:44:44 +01:00
msmpeng_application_dll_side_loading.yml
updating docs and package bits [ci skip]
2021-07-13 23:26:40 +00:00
multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml
updating docs and package bits [ci skip]
2021-05-13 22:09:29 +00:00
multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml
updating docs and package bits [ci skip]
2021-05-13 22:09:29 +00:00
multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml
updating docs and package bits [ci skip]
2021-05-13 22:09:29 +00:00
multiple_users_attempting_to_authenticate_using_explicit_credentials.yml
updating docs and package bits [ci skip]
2021-05-13 22:09:29 +00:00
multiple_users_failing_to_authenticate_from_host_using_kerberos.yml
updating docs and package bits [ci skip]
2021-05-13 22:09:29 +00:00
multiple_users_failing_to_authenticate_from_host_using_ntlm.yml
updating docs and package bits [ci skip]
2021-05-13 22:09:29 +00:00
multiple_users_failing_to_authenticate_from_process.yml
updating docs and package bits [ci skip]
2021-05-13 22:09:29 +00:00
multiple_users_remotely_failing_to_authenticate_from_host.yml
updating docs and package bits [ci skip]
2021-05-13 22:09:29 +00:00
nishang_powershelltcponeline.yml
updating docs and package bits [ci skip]
2021-03-12 17:32:09 +00:00
nltest_domain_trust_discovery.yml
Domain Trust Discovery
2021-03-31 13:24:32 -06:00
ntdsutil_export_ntds.yml
add required fields and check
2021-03-11 09:11:48 +01:00
office_application_spawn_rundll32_process.yml
updating docs and package bits [ci skip]
2021-05-13 22:09:29 +00:00
office_document_creating_schedule_task.yml
updating docs and package bits [ci skip]
2021-05-13 22:09:29 +00:00
office_document_executing_macro_code.yml
updating docs and package bits [ci skip]
2021-05-13 22:09:29 +00:00
office_document_spawned_child_process_to_download.yml
updating docs and package bits [ci skip]
2021-06-24 18:23:02 +00:00
office_product_spawning_bitsadmin.yml
updating docs and package bits [ci skip]
2021-04-29 21:32:44 +00:00
office_product_spawning_certutil.yml
updating docs and package bits [ci skip]
2021-04-29 21:32:44 +00:00
office_product_spawning_mshta.yml
updating docs and package bits [ci skip]
2021-04-29 21:32:44 +00:00
office_product_spawning_rundll32_with_no_dll.yml
updating docs and package bits [ci skip]
2021-04-22 21:55:11 +00:00
office_product_spawning_wmic.yml
updating docs and package bits [ci skip]
2021-04-29 21:32:44 +00:00
overwriting_accessibility_binaries.yml
WIP
2021-03-10 14:44:44 +01:00
permission_modification_using_takeown_app.yml
updating docs and package bits [ci skip]
2021-06-24 18:23:02 +00:00
powershell_creating_thread_mutex.yml
updating docs and package bits [ci skip]
2021-06-24 18:23:02 +00:00
powershell_disable_security_monitoring.yml
updating docs and package bits [ci skip]
2021-07-13 23:26:40 +00:00
powershell_domain_enumeration.yml
updating docs and package bits [ci skip]
2021-06-24 18:23:02 +00:00
powershell_enable_smb1protocol_feature.yml
updating docs and package bits [ci skip]
2021-07-13 23:26:40 +00:00
powershell_fileless_process_injection_via_getprocaddress.yml
updating docs and package bits [ci skip]
2021-06-24 18:23:02 +00:00
powershell_fileless_script_contains_base64_encoded_content.yml
updating docs and package bits [ci skip]
2021-06-24 18:23:02 +00:00
powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml
Updated System Reflection Assembly
2021-07-12 11:38:14 -06:00
powershell_processing_stream_of_data.yml
updating docs and package bits [ci skip]
2021-06-24 18:23:02 +00:00
powershell_remote_thread_to_known_windows_process.yml
updating docs and package bits [ci skip]
2021-05-13 22:09:29 +00:00
powershell_start_bitstransfer.yml
updating docs and package bits [ci skip]
2021-04-15 19:40:20 +00:00
powershell_using_memory_as_backing_store.yml
updating docs and package bits [ci skip]
2021-06-24 18:23:02 +00:00
prevent_automatic_repair_mode_using_bcdedit.yml
updating docs and package bits [ci skip]
2021-06-24 18:23:02 +00:00
print_spooler_adding_a_printer_driver.yml
updating docs and package bits [ci skip]
2021-07-02 16:06:07 +00:00
print_spooler_failed_to_load_a_plug_in.yml
updating docs and package bits [ci skip]
2021-07-02 16:06:07 +00:00
process_creating_lnk_file_in_suspicious_location.yml
Spearphishing Attachments detections
2021-04-21 10:16:49 -06:00
process_deleting_its_process_file_path.yml
updating docs and package bits [ci skip]
2021-03-25 19:35:07 +00:00
process_execution_via_wmi.yml
updating docs and package bits [ci skip]
2021-06-24 18:23:02 +00:00
process_kill_base_on_file_path.yml
updating docs and package bits [ci skip]
2021-05-24 17:47:29 +00:00
processes_launching_netsh.yml
WIP
2021-03-10 14:44:44 +01:00
ransomware_notes_bulk_creation.yml
updating docs and package bits [ci skip]
2021-06-10 18:46:43 +00:00
recon_avproduct_through_pwh_or_wmi.yml
updating docs and package bits [ci skip]
2021-06-24 18:23:02 +00:00
recon_using_wmi_class.yml
updating docs and package bits [ci skip]
2021-06-24 18:23:02 +00:00
recursive_delete_of_directory_in_batch_cmd.yml
updating docs and package bits [ci skip]
2021-07-13 23:26:40 +00:00
reg_exe_manipulating_windows_services_registry_keys.yml
WIP
2021-03-10 14:44:44 +01:00
registry_keys_for_creating_shim_databases.yml
WIP
2021-03-10 14:44:44 +01:00
registry_keys_used_for_persistence.yml
updating docs and package bits [ci skip]
2021-05-13 22:09:29 +00:00
registry_keys_used_for_privilege_escalation.yml
WIP
2021-03-10 14:44:44 +01:00
remote_process_instantiation_via_wmi.yml
WIP
2021-03-10 14:44:44 +01:00
remote_wmi_command_attempt.yml
updating docs and package bits [ci skip]
2021-06-24 18:23:02 +00:00
resize_shadowstorage_volume.yml
updating docs and package bits [ci skip]
2021-03-25 19:35:07 +00:00
revil_common_exec_parameter.yml
updating docs and package bits [ci skip]
2021-06-10 18:46:43 +00:00
revil_registry_entry.yml
updating docs and package bits [ci skip]
2021-07-13 23:26:40 +00:00
rundll32_with_no_command_line_arguments_with_network.yml
minor update2
2021-07-02 14:09:14 +02:00
rundll_loading_dll_by_ordinal.yml
WIP
2021-03-10 14:44:44 +01:00
ryuk_test_files_detected.yml
WIP
2021-03-10 14:44:44 +01:00
ryuk_wake_on_lan_command.yml
updating docs and package bits [ci skip]
2021-03-12 17:32:09 +00:00
samsam_test_file_write.yml
WIP
2021-03-10 14:44:44 +01:00
sc_exe_manipulating_windows_services.yml
add required fields and check
2021-03-11 09:11:48 +01:00
schedule_task_with_http_command_arguments.yml
Added detection testing service results inSchedule Task with HTTP Command Arguments
2021-05-05 20:00:43 +00:00
schedule_task_with_rundll32_command_trigger.yml
updating docs and package bits [ci skip]
2021-05-24 17:47:29 +00:00
scheduled_task_deleted_or_created_via_cmd.yml
add required fields and check
2021-03-11 09:11:48 +01:00
schtasks_run_task_on_demand.yml
updating docs and package bits [ci skip]
2021-05-24 17:47:29 +00:00
schtasks_scheduling_job_on_remote_system.yml
add required fields and check
2021-03-11 09:11:48 +01:00
schtasks_used_for_forcing_a_reboot.yml
WIP
2021-03-10 14:44:44 +01:00
script_execution_via_wmi.yml
updating docs and package bits [ci skip]
2021-06-24 18:23:02 +00:00
searchprotocolhost_with_no_command_line_with_network.yml
updating docs and package bits [ci skip]
2021-04-22 21:55:11 +00:00
secretdumps_offline_ntds_dumping_tool.yml
updating docs and package bits [ci skip]
2021-06-10 18:46:43 +00:00
services_escalate_exe.yml
updating docs and package bits [ci skip]
2021-05-24 17:47:29 +00:00
set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
minor
2021-04-20 13:24:16 -07:00
shim_database_file_creation.yml
WIP
2021-03-10 14:44:44 +01:00
shim_database_installation_with_suspicious_parameters.yml
WIP
2021-03-10 14:44:44 +01:00
short_lived_windows_accounts.yml
WIP
2021-03-10 14:44:44 +01:00
single_letter_process_on_endpoint.yml
WIP
2021-03-10 14:44:44 +01:00
slui_runas_elevated.yml
updating docs and package bits [ci skip]
2021-05-13 22:09:29 +00:00
slui_spawning_a_process.yml
updating docs and package bits [ci skip]
2021-05-13 22:09:29 +00:00
spoolsv_spawning_rundll32.yml
updating docs and package bits [ci skip]
2021-07-02 16:06:07 +00:00
spoolsv_suspicious_loaded_modules.yml
updating docs and package bits [ci skip]
2021-07-02 16:06:07 +00:00
spoolsv_suspicious_process_access.yml
updating docs and package bits [ci skip]
2021-07-02 16:06:07 +00:00
spoolsv_writing_a_dll___sysmon.yml
updating docs and package bits [ci skip]
2021-07-02 16:06:07 +00:00
spoolsv_writing_a_dll.yml
updating docs and package bits [ci skip]
2021-07-02 16:06:07 +00:00
ssa___applying_stolen_credentials_via_mimikatz_modules.yml
updating docs and package bits [ci skip]
2021-04-29 21:32:44 +00:00
ssa___applying_stolen_credentials_via_powersploit_modules.yml
Update ssa___applying_stolen_credentials_via_powersploit_modules.yml
2021-04-28 13:49:01 -04:00
ssa___assess_credential_strength_via_dsinternals_modules.yml
Update ssa___assess_credential_strength_via_dsinternals_modules.yml
2021-04-28 13:49:27 -04:00
ssa___attempt_to_delete_services.yml
updating docs and package bits [ci skip]
2021-07-13 23:26:40 +00:00
ssa___attempt_to_disable_services.yml
updating docs and package bits [ci skip]
2021-07-13 23:26:40 +00:00
ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
updating docs and package bits [ci skip]
2021-04-29 21:32:44 +00:00
ssa___credential_extraction_dsinternals_conversion_modules.yml
updating docs and package bits [ci skip]
2021-04-29 21:32:44 +00:00
ssa___credential_extraction_dsinternals_modules.yml
updating docs and package bits [ci skip]
2021-04-29 21:32:44 +00:00
ssa___credential_extraction_fgdump_cachedump_s_option.yml
updating docs and package bits [ci skip]
2021-04-29 21:32:44 +00:00
ssa___credential_extraction_fgdump_cachedump_v_option.yml
updating docs and package bits [ci skip]
2021-04-29 21:32:44 +00:00
ssa___credential_extraction_getaddbaccount_from_dump.yml
Update ssa___credential_extraction_getaddbaccount_from_dump.yml
2021-04-28 13:52:05 -04:00
ssa___credential_extraction_lazagne_command_options.yml
Update ssa___credential_extraction_lazagne_command_options.yml
2021-04-28 13:52:55 -04:00
ssa___credential_extraction_mimikatz_modules.yml
Update ssa___credential_extraction_mimikatz_modules.yml
2021-04-28 13:53:09 -04:00
ssa___credential_extraction_ms_debuggers_kernel_peek.yml
updating docs and package bits [ci skip]
2021-04-29 21:32:44 +00:00
ssa___credential_extraction_ms_debuggers_z_option.yml
updating docs and package bits [ci skip]
2021-04-29 21:32:44 +00:00
ssa___credential_extraction_powersploit_modules.yml
Update ssa___credential_extraction_powersploit_modules.yml
2021-04-28 13:53:51 -04:00
ssa___delete_a_net_user.yml
updating docs and package bits [ci skip]
2021-07-13 23:26:40 +00:00
ssa___deny_permission_using_cacls_utility.yml
updating docs and package bits [ci skip]
2021-07-02 16:06:07 +00:00
ssa___detect_dump_lsass_memory_using_comsvcs.yml
all SSA TBD bodies Done
2021-04-28 10:25:26 -06:00
ssa___detect_kerberoasting.yml
updating docs and package bits [ci skip]
2021-06-24 18:23:02 +00:00
ssa___detect_pass_hash.yml
updating docs and package bits [ci skip]
2021-04-29 21:32:44 +00:00
ssa___disable_net_user_account.yml
updating docs and package bits [ci skip]
2021-07-13 23:26:40 +00:00
ssa___first_time_seen_cmd_line.yml
updating docs and package bits [ci skip]
2021-04-29 21:32:44 +00:00
ssa___grant_permission_using_cacls_utility.yml
updating docs and package bits [ci skip]
2021-07-02 16:06:07 +00:00
ssa___illegal_access_user_content_via_powersploit_modules.yml
Update ssa___illegal_access_user_content_via_powersploit_modules.yml
2021-04-28 13:54:52 -04:00
ssa___illegal_account_creation_via_powersploit_modules.yml
Update ssa___illegal_account_creation_via_powersploit_modules.yml
2021-04-28 13:55:07 -04:00
ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
Update ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
2021-04-28 13:55:40 -04:00
ssa___illegal_log_deletion_via_mimikatz_modules.yml
Update ssa___illegal_log_deletion_via_mimikatz_modules.yml
2021-04-28 13:55:52 -04:00
ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
Update ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
2021-04-28 13:56:03 -04:00
ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
Update ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
2021-04-28 13:56:17 -04:00
ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
Update ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
2021-04-28 13:56:30 -04:00
ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
Update ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
2021-04-28 13:56:41 -04:00
ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
Update ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
2021-04-28 13:56:54 -04:00
ssa___illegal_service_and_process_control_via_powersploit_modules.yml
removed dest id from a body field since it is already part of the anomaly
2021-04-28 14:01:05 -04:00
ssa___modify_acls_permission_of_files_or_folders.yml
updating docs and package bits [ci skip]
2021-07-02 16:06:07 +00:00
ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
removed dest id from a body field since it is already part of the anomaly
2021-04-28 14:01:05 -04:00
ssa___prohibited_apps_spawning_cmdprompt.yml
Really actually fixed the merge conflict
2021-06-22 11:08:10 -05:00
ssa___rare_parent_process_relationship_lolbas.yml
updating docs and package bits [ci skip]
2021-06-24 18:23:02 +00:00
ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
removed dest id from a body field since it is already part of the anomaly
2021-04-28 14:01:05 -04:00
ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
removed dest id from a body field since it is already part of the anomaly
2021-04-28 14:01:05 -04:00
ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
removed dest id from a body field since it is already part of the anomaly
2021-04-28 14:01:05 -04:00
ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
removed dest id from a body field since it is already part of the anomaly
2021-04-28 14:01:05 -04:00
ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
removed dest id from a body field since it is already part of the anomaly
2021-04-28 14:01:05 -04:00
ssa___recon_and_use_computers_via_mimikatz_modules.yml
removed dest id from a body field since it is already part of the anomaly
2021-04-28 14:01:05 -04:00
ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
removed dest id from a body field since it is already part of the anomaly
2021-04-28 14:01:05 -04:00
ssa___recon_and_use_shares_via_mimikatz_modules.yml
removed dest id from a body field since it is already part of the anomaly
2021-04-28 14:01:05 -04:00
ssa___recon_and_use_shares_via_powersploit_modules.yml
removed dest id from a body field since it is already part of the anomaly
2021-04-28 14:01:05 -04:00
ssa___recon_connectivity_via_powersploit_modules.yml
removed dest id from a body field since it is already part of the anomaly
2021-04-28 14:01:05 -04:00
ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
removed dest id from a body field since it is already part of the anomaly
2021-04-28 14:01:05 -04:00
ssa___recon_defensive_tools_via_powersploit_modules.yml
removed dest id from a body field since it is already part of the anomaly
2021-04-28 14:01:05 -04:00
ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
removed dest id from a body field since it is already part of the anomaly
2021-04-28 14:01:05 -04:00
ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
removed dest id from a body field since it is already part of the anomaly
2021-04-28 14:01:05 -04:00
ssa___recon_processes_and_services_via_mimikatz_modules.yml
removed dest id from a body field since it is already part of the anomaly
2021-04-28 14:01:05 -04:00
ssa___resize_shadowstorage_volume.yml
updating docs and package bits [ci skip]
2021-07-13 23:26:40 +00:00
ssa___setting_credentials_via_dsinternals_modules.yml
removed dest id from a body field since it is already part of the anomaly
2021-04-28 14:01:05 -04:00
ssa___setting_credentials_via_mimikatz_modules.yml
removed dest id from a body field since it is already part of the anomaly
2021-04-28 14:01:05 -04:00
ssa___setting_credentials_via_powersploit_modules.yml
removed dest id from a body field since it is already part of the anomaly
2021-04-28 14:01:05 -04:00
ssa___system_process_running_unexpected_location.yml
Fix for TR-763
2021-06-21 13:21:30 -05:00
ssa___unusual_lolbas_in_short_period_of_time.yml
updating docs and package bits [ci skip]
2021-04-29 21:32:44 +00:00
ssa___unusually_long_command_line.yml
updating docs and package bits [ci skip]
2021-04-29 21:32:44 +00:00
ssa___wevtutil_usage_to_clear_logs.yml
updating docs and package bits [ci skip]
2021-07-02 16:06:07 +00:00
ssa___wevtutil_usage_to_disable_logs.yml
updating docs and package bits [ci skip]
2021-07-02 16:06:07 +00:00
start_up_during_safe_mode_boot.yml
updating docs and package bits [ci skip]
2021-06-24 18:23:02 +00:00
suspicious_dllhost_no_command_line_arguments.yml
updating docs and package bits [ci skip]
2021-03-12 17:32:09 +00:00
suspicious_driver_loaded_path.yml
updating docs and package bits [ci skip]
2021-05-24 17:47:29 +00:00
suspicious_event_log_service_behavior.yml
updating docs and package bits [ci skip]
2021-06-24 18:23:02 +00:00
suspicious_gpupdate_no_command_line_arguments.yml
updating docs and package bits [ci skip]
2021-03-12 17:32:09 +00:00
suspicious_microsoft_workflow_compiler_rename.yml
Masquerading - detections + analytic story
2021-04-26 13:38:52 -06:00
suspicious_microsoft_workflow_compiler_usage.yml
WIP
2021-03-10 14:44:44 +01:00
suspicious_msbuild_path.yml
Masquerading - detections + analytic story
2021-04-26 13:38:52 -06:00
suspicious_msbuild_rename.yml
Update suspicious_msbuild_rename.yml
2021-06-23 20:39:36 -06:00
suspicious_msbuild_spawn.yml
WIP
2021-03-10 14:44:44 +01:00
suspicious_mshta_child_process.yml
updating docs and package bits [ci skip]
2021-07-02 16:06:07 +00:00
suspicious_mshta_spawn.yml
WIP
2021-03-10 14:44:44 +01:00
suspicious_process_file_path.yml
updating docs and package bits [ci skip]
2021-05-24 17:47:29 +00:00
suspicious_reg_exe_process.yml
WIP
2021-03-10 14:44:44 +01:00
suspicious_regsvr32_register_suspicious_path.yml
WIP
2021-03-10 14:44:44 +01:00
suspicious_rundll32_dllregisterserver.yml
WIP
2021-03-10 14:44:44 +01:00
suspicious_rundll32_rename.yml
Masquerading - detections + analytic story
2021-04-26 13:38:52 -06:00
suspicious_rundll32_startw.yml
trickbot_1
2021-04-26 17:19:41 +02:00
suspicious_rundll32_with_no_command_line_arguments.yml
minor update
2021-07-02 14:02:31 +02:00
suspicious_scheduled_task_from_public_directory.yml
updating docs and package bits [ci skip]
2021-03-12 17:32:09 +00:00
suspicious_searchprotocolhost_no_command_line_arguments.yml
updating docs and package bits [ci skip]
2021-03-12 17:32:09 +00:00
suspicious_wevtutil_usage.yml
updating docs and package bits [ci skip]
2021-03-25 19:35:07 +00:00
suspicious_writes_to_windows_recycle_bin.yml
WIP
2021-03-10 14:44:44 +01:00
system_information_discovery_detection.yml
WIP
2021-03-10 14:44:44 +01:00
system_processes_run_from_unexpected_locations.yml
updating docs and package bits [ci skip]
2021-04-29 21:32:44 +00:00
trickbot_named_pipe.yml
updating docs and package bits [ci skip]
2021-05-13 22:09:29 +00:00
unified_messaging_service_spawning_a_process.yml
updating docs and package bits [ci skip]
2021-03-12 17:32:09 +00:00
unload_sysmon_filter_driver.yml
WIP
2021-03-10 14:44:44 +01:00
unloading_amsi_via_reflection.yml
this was brough up by doc team, it was causing docs to not be updated
2021-06-25 15:54:57 -04:00
unusually_long_command_line.yml
WIP
2021-03-10 14:44:44 +01:00
usn_journal_deletion.yml
WIP
2021-03-10 14:44:44 +01:00
w3wp_spawning_shell.yml
updating docs and package bits [ci skip]
2021-03-12 17:32:09 +00:00
wbadmin_delete_system_backups.yml
WIP
2021-03-10 14:44:44 +01:00
wbemprox_com_object_execution.yml
updating docs and package bits [ci skip]
2021-06-10 18:46:43 +00:00
wermgr_process_connecting_to_ip_check_web_services.yml
updating docs and package bits [ci skip]
2021-05-13 22:09:29 +00:00
wermgr_process_create_executable_file.yml
updating docs and package bits [ci skip]
2021-05-13 22:09:29 +00:00
wermgr_process_spawned_cmd_or_powershell_process.yml
updating docs and package bits [ci skip]
2021-05-13 22:09:29 +00:00
windows_disableantispyware_reg.yml
add required fields
2021-03-11 09:32:33 +01:00
windows_event_log_cleared.yml
updating docs and package bits [ci skip]
2021-06-24 18:23:02 +00:00
windows_security_account_manager_stopped.yml
WIP
2021-03-10 14:44:44 +01:00
winevent_scheduled_task_created_to_spawn_shell.yml
updating docs and package bits [ci skip]
2021-04-22 21:55:11 +00:00
winevent_scheduled_task_created_within_public_path.yml
updating docs and package bits [ci skip]
2021-04-22 21:55:11 +00:00
winword_spawning_cmd.yml
updating docs and package bits [ci skip]
2021-04-22 21:55:11 +00:00
winword_spawning_powershell.yml
updating docs and package bits [ci skip]
2021-04-22 21:55:11 +00:00
winword_spawning_windows_script_host.yml
updating docs and package bits [ci skip]
2021-04-22 21:55:11 +00:00
wmi_permanent_event_subscription___sysmon.yml
fix 1
2021-07-13 14:45:07 -05:00
wmi_recon_running_process_or_services.yml
updating docs and package bits [ci skip]
2021-06-24 18:23:02 +00:00
write_executable_in_smb_share.yml
updating docs and package bits [ci skip]
2021-05-13 22:09:29 +00:00
xmrig_driver_loaded.yml
updating docs and package bits [ci skip]
2021-05-24 17:47:29 +00:00