Patrick Bareiss be0fc0b66a Worked on the feedback

2019-12-18 10:29:40 +01:00

..

access_lsass_memory_for_dump_creation_filter.yml

Worked on the feedback

2019-12-18 10:23:55 +01:00

attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter.yml

Worked on the feedback

2019-12-18 10:23:55 +01:00

attempted_credential_dump_from_registry_via_reg_filter.yml

Worked on the feedback

2019-12-18 10:23:55 +01:00

brand_abuse_dns.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

brand_abuse_email.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

brand_abuse_web.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

create_remote_thread_into_lsass_filter.yml

Worked on the feedback

2019-12-18 10:23:55 +01:00

creation_of_shadow_copy_filter.yml

Worked on the feedback

2019-12-18 10:29:40 +01:00

creation_of_shadow_copy_with_wmic_and_powershell_filter.yml

New version of Credential Dumping Story

2019-12-17 18:08:09 +01:00

cred_dump_via_copy_from_shadowcopy_filter.yml

New version of Credential Dumping Story

2019-12-17 18:08:09 +01:00

cred_dump_via_symlink_shadowcopy_filter.yml

New version of Credential Dumping Story

2019-12-17 18:08:09 +01:00

detect_credential_dumping_through_LSASS_access_filter.yml

New version of Credential Dumping Story

2019-12-17 18:08:09 +01:00

detect_mimikatz_using_loaded_images_filter.yml

New version of Credential Dumping Story

2019-12-17 18:08:09 +01:00

dynamic_dns_providers.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

dynamic_dns_web_traffic.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

ec2_excessive_runinstances_mltk_input_filter.yml

CRL-1645 - Fixing macros for excessive runinstances and terminateinstances to use src_user in description.

2019-11-25 18:17:06 -08:00

ec2_excessive_terminateinstances_mltk_input_filter.yml

CRL-1645 - Fixing macros for excessive runinstances and terminateinstances to use src_user in description.

2019-11-25 18:17:06 -08:00

ec2_modification_api_calls.yml

naming updates, jinja macros updates

2019-12-16 13:05:17 -08:00

evilginx_phishlets_0365.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_amazon.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_aws.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_facebook.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_github.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_google.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_outlook.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

filter_rare_process_whitelist.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

investigate_cloud_compute_instance_activities_output_filter.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

investigate_user_activities_in_all_cloud_region_output_filter.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

investigate_user_activities_in_single_cloud_region_output_filter.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

is_windows_system_file.yml

naming updates, jinja macros updates

2019-12-16 13:05:17 -08:00

network_acl_events.yml

naming updates, jinja macros updates

2019-12-16 13:05:17 -08:00

previously_seen_cloud_compute_creations_by_user_input_filter.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

previously_seen_cloud_compute_creations_by_user_search_window_begin_offset.yml

Added search_window macros to searches

2019-10-17 09:28:41 -07:00

previously_seen_cloud_compute_image_input_filter.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

previously_seen_cloud_compute_image_search_window_begin_offset.yml

Added search_window macros to searches

2019-10-17 09:28:41 -07:00

previously_seen_cloud_compute_instance_types_input_filter.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

previously_seen_cloud_compute_instance_types_search_window_begin_offset.yml

Added search_window macros to searches

2019-10-17 09:28:41 -07:00

previously_seen_cloud_regions_input_filter.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

previously_seen_cloud_regions_search_window_begin_offset.yml

Updated generate to output for ASX

2019-10-16 20:54:13 -07:00

prohibited_apps_launching_cmd.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

prohibited_softwares.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

ransomware_extensions.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

ransomware_notes.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

remove_valid_domains.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

security_content_ctime.yml

fixed security_content_ctime macro

2019-12-17 09:33:35 +01:00

security_content_summariesonly.yml

added summariesonly and fixed ctime

2019-12-11 15:14:49 -05:00

security_group_api_calls.yml

naming updates, jinja macros updates

2019-12-16 13:05:17 -08:00

suspicious_email_attachments.yml

naming updates, jinja macros updates

2019-12-16 13:05:17 -08:00

suspicious_writes.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

sysmon.yml

Worked on the feedback

2019-12-18 10:23:55 +01:00

system_network_configuration_discovery_tools.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

uncommon_processes.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

unsigned_image_loaded_by_LSASS_filter.yml

New version of Credential Dumping Story

2019-12-17 18:08:09 +01:00

wineventlog_security.yml

Worked on the feedback

2019-12-18 10:23:55 +01:00