patel-bhavin fe5db9e78e adding lookup files

2022-01-26 15:34:10 -08:00

..

.untested

detection/experimental folder for untested detections

2020-11-06 10:37:11 -08:00

abnormally_high_cloud_instances_destroyed.yml

CARS_UPDATE_MITRE_ID_B8

2021-10-15 10:22:43 +02:00

abnormally_high_cloud_instances_launched.yml

CARS_UPDATE_MITRE_ID_B8

2021-10-15 10:22:43 +02:00

amazon_eks_kubernetes_cluster_scan_detection.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

amazon_eks_kubernetes_pod_scan_detection.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

aws_detect_attach_to_role_policy.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

aws_detect_permanent_key_creation.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

aws_detect_role_creation.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

aws_detect_sts_assume_role_abuse.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

aws_detect_sts_get_session_token_abuse.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

detect_gcp_storage_access_from_a_new_ip.yml

adding lookup files

2022-01-26 15:34:10 -08:00

detect_new_open_gcp_storage_buckets.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

detect_s3_access_from_a_new_ip.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

detect_spike_in_aws_security_hub_alerts_for_user.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

detect_spike_in_blocked_outbound_traffic_from_your_aws.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

detect_spike_in_s3_bucket_deletion.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

gcp_detect_gcploit_framework.yml

updated generate

2021-07-20 16:41:53 +02:00

gcp_kubernetes_cluster_pod_scan_detection.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

gdrive_suspicious_file_sharing.yml

updating docs and package bits [ci skip]

2021-11-10 16:16:30 +00:00

gsuite_suspicious_calendar_invite.yml

updating docs and package bits [ci skip]

2021-11-10 16:16:30 +00:00

high_number_of_login_failures_from_a_single_source.yml

CARS_UPDATE_MITRE_ID_B8

2021-10-15 10:22:43 +02:00

kubernetes_aws_detect_suspicious_kubectl_calls.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00

new_container_uploaded_to_aws_ecr.yml

add analytic types to detections

2021-07-19 17:41:22 +02:00