Patrick Bareiss 71241e566f tested and updates searches for lateral movement story

2020-01-13 10:39:57 +01:00

..

account_monitoring.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

apache_struts.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

asset_tracking.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_cross_account_activity.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_cryptomining.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_ec2_modifications.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_ec2.yml

CRL-1645 - New detection "Abnormally High AWS Instances Terminated by User - MLTK"

2019-11-25 18:06:33 -08:00

aws_network_acl.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_provisioning.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_s3.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_suspcious_logins.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_suspcious_traffic.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_user_monitoring.yml

fixing broken links in stories

2019-12-09 19:59:39 -05:00

brand_monitoring.yml

fixing broken link

2019-11-18 13:30:26 -05:00

cloud_cryptomining.yml

CRL-1646 - adding Abnormally High AWS Instances Launched [mltk] to cloud_cryptomining story.

2019-11-25 17:01:20 -08:00

coldroot.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

collection_and_staging.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

command_and_control.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

common_phishing_frameworks.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

credential_dumping.yml

Worked on the feedback

2019-12-18 10:23:55 +01:00

data_protection.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

defense_evasion.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

detect_unauthorized_processes.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

dhs_report_TA18-074A.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

disable_security_tools.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

dns_amplification_attacks.yml

fixing broken links in stories

2019-12-09 19:59:39 -05:00

dns_hijacking.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

dynamic_dns.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

emotet.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

file_extension_abuse.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

hidden_cobra_malware.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

host_redirection.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

jboss_vulnerabilities.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

lateral_movement.yml

tested and updates searches for lateral movement story

2020-01-13 10:39:57 +01:00

malicious_powershell.yml

WIP: Credential Dumping Story

2019-12-11 12:29:41 +01:00

monitor_backups.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

monitor_for_updates.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

mudcarp.yml

fixing broken links in stories

2019-12-09 19:59:39 -05:00

netsh_abuse.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

non-secure_communications.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

orangeworm.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

phishing_payloads.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

prohibited_traffic_and_protocol_mismatch.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

ransomware.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

routers_and_infrastructure.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

samsam.yml

updating bug with samsam docs

2019-12-16 10:21:04 -05:00

service_abuse.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

spectre_meltdown.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

splunk_information_disclosure.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

splunk_vulnerabilities.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

sql_injection.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

suspicious_cmd_line_executions.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

suspicious_dns_traffic.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

suspicious_emails.yml

Added email brand monitoring to suspicious email story

2019-11-06 14:11:25 -08:00

suspicious_event_log_activity.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

suspicious_mshta_activities.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

suspicious_windows_registry_activities.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

suspicious_wmi.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

unusual_processes.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

web_fraud.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

windows_persistence.yml

CRL-1646 - Fixing newly broken reference.

2019-11-25 16:32:14 -08:00

windows_privilege_escalation.yml

Changed json to yml

2019-10-16 16:38:05 +02:00