David Dorsey 5f30745b7c Fixed issue in CRL-1387 where the check for executionpolicy bypass ...

was too broad.
Also, added investigation searches for file and registry activity
while I was here

2019-11-06 18:39:21 -08:00

..

abnormally_high_ec2_instances_launched.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

abnormally_high_instance_termination.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

account_harvesting.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

acl_with_open_ports.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

activity_related_to_pass_the_hash.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

add_to_untrust_cert_store.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

anomalous_webclick.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

api_acitivity_from_previously_unseen_user_role.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

attackers_scanning_for_vulnerable_jboss_servers.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

attrib_to_hide_files.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_activity_from_non_approved_accounts.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_activity_in_new_region.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_cloud_provisioning_from_previously_unseen_city.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_cloud_provisioning_from_previously_unseen_country.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_cloud_provisioning_from_previously_unseen_ip.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_cloud_provisioning_from_previously_unseen_region.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_cross_account_activity_from_new_account.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_spike_acl_activity.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

badrabbit_schtasks.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

batch_file_write_system32.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

brand_abuse_dns.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

brand_abuse_email.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

brand_abuse_web.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

change_file_association.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

children_of_spoolsv.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

clients_connecting_to_multiple_dns_servers.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

cloud_compute_activity_in_new_region.yml

updated to the proper datamodel name in the manifest metadata

2019-10-22 16:32:21 -06:00

cloud_compute_instance_created_by_previously_unseen_user.yml

updated to the proper datamodel name in the manifest metadata

2019-10-22 16:32:21 -06:00

cloud_compute_instance_created_with_previously_unseen_image_id.yml

Merge branch 'develop' into cloud_cryptomining

2019-10-28 13:58:23 -04:00

cloud_compute_instance_created_with_previously_unseen_instance_type.yml

updated to the proper datamodel name in the manifest metadata

2019-10-22 16:32:21 -06:00

common_ransomware_extensions.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

common_ransomware_notes.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

create_hidden_shares.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

create_local_admin_via_net.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

cred_dump_via_reg.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

cscript_via_cmd.yml

updates to generate and manifests to support ASX

2019-10-28 12:37:47 -07:00

delete_shadow_copies.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

deletion_network_acl.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

disable_remote_uac.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

dns_amplification_any_query.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

dns_evilginx_subdomains.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

dns_query_length_mltk.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

dns_query_length_with_high_standard_deviation.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

dns_record_changed.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

dns_tunnelling.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

dragonfly_schtasks.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

dyn_dns_queries.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

dyn_dns_web_traffic.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

ec2_instance_created_by_previously_unseen_user.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

ec2_instance_modified_by_previously_unseen_user.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

ec2_instance_started_with_previously_unseen_ami.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

ec2_instance_started_with_previously_unseen_instance_type.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

email_attachments_with_spaces.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

email_files_not_in_outlook_directory.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

emailserver_high_volume_outbound_traffic_to_hosts.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

excessive_dns_failures.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

excessive_lockouts_from_endpoint.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

excessive_user_account_lockouts.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

execution_of_nirsoft_tools.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

file_write_spikes.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

first_time_seen_cmd_line.yml

updates to generate and manifests to support ASX

2019-10-28 12:37:47 -07:00

first_time_seen_running_windows_service.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

fsutil_deleting_journals.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

hosts_file_modification.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

hosts_receiving_high_volume_network_traffic_from_email_servers.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

large_icmp_outbound.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

lnk_executing_a_process.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

local_admin_account_creation.yml

added connected=false to 3 searches using the transaction command.

2019-10-30 13:32:31 -06:00

long_dns_text_response.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

malicious_application_shimming_via_registry.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

malicious_powershell_process_connect_to_internet_with_hidden_window.yml

updates to generate and manifests to support ASX

2019-10-28 12:37:47 -07:00

malicious_powershell_process_encoded_command.yml

updates to generate and manifests to support ASX

2019-10-28 12:37:47 -07:00

malicious_powershell_process_execpolicy.yml

Fixed issue in CRL-1387 where the check for executionpolicy bypass

2019-11-06 18:39:21 -08:00

malicious_powershell_process_multiple_suspicious_arguments.yml

updates to generate and manifests to support ASX

2019-10-28 12:37:47 -07:00

malicious_powershell_process_obfuscation_techniques.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

malicious_requests_to_exploit_jboss_servers.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

mshta_launching_scripts.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

netbackup_failed_backup.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

netbackup_no_backups_in_time_period.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

netsh_launching_process.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

new_aws_console_login_by_user.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

new_aws_console_login_city_by_user.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

new_aws_console_login_country_by_user.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

new_aws_console_login_region_by_user.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

new_connections_to_routers.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

new_open_s3_buckets.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

new_user_accounts.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

no_win_updates_in_timeframe.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

open_redirect_in_splunk_web.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

osx_coldroot_pack.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

osx_keyboard_taps.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

outbound_smb_connections.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

outlook_writing_zip.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

overwrite_accessibility_binaries.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

password_sharing.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

path_interception_program.exe.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

port_monitor_via_registry.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

powershell_get_sedebug.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

powershell_read_from_lsass.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

powershell_reg_key_mod.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

process_launching_netsh.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

process_with_double_extension.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

process_with_spaces_before_extension.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

prohibited_allowed_through_fw.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

prohibited_apps_spawning_cmdprompt.yml

updates to generate and manifests to support ASX

2019-10-28 12:37:47 -07:00

prohibited_software_on_endpoint.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

protocol_mismatch.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

protocols_authenticating_in_cleartext.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

psexec_accepteula.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

rare_executables_on_endpoint.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

reg_manipulating_services.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

reg_used_to_hide_files.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

registry_persistence.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

registry_privilege_escalation.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

remote_desktop_bruteforce.yml

Fixed SPL issue that didn't include average

2019-10-28 10:05:58 -07:00

remote_desktop_network_traffic.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

remote_desktop_process_running_on_system.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

remote_registry_modifications.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

remote_wmi_command_attempt.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

remote_wmi_process_instantiation.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

rundll_loading_dll_by_ordinal.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

s3_access_from_new_ip.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

samsam_payload_extensions.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

samsam_test_file_write.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

sc_manipulating_services.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

schtasks_forced_reboot.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

schtasks_scheduling_job_on_remote_system.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

shim_database_file_creation.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

shim_database_installation.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

short_lived_accounts.yml

added connected=false to 3 searches using the transaction command.

2019-10-30 13:32:31 -06:00

single_letter_executables.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

smb_traffic_spike_mltk.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

smb_traffic_spike.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

sncd_processes.yml

added connected=false to 3 searches using the transaction command.

2019-10-30 13:32:31 -06:00

spectre_meltdown_vulnerabilities.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

spike_aws_api_call_per_account.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

spike_aws_security_group_activity.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

spike_s3_deletion.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

spike_vpc_blocked_traffic.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

splunk_information_disclosure.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

sql_injection_with_long_urls.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

stop_security_services.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

suspicious_email_attachments.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

suspicious_file_writes.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

suspicious_java_classes.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

suspicious_reg_process.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

suspicious_wevtutil_usage.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

suspicious_write_to_recycler.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

suspicious_write_to_sysvol.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

system_processes_run_from_unexpected_locations.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

tor_traffic.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

uba_email_anomaly.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

unauthorized_assets_via_mac_address.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

unauthorized_dns_servers.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

uncommon_processes.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

unusually_long_commandlines_mltk.yml

updates to generate and manifests to support ASX

2019-10-28 12:37:47 -07:00

unusually_long_commandlines.yml

updates to generate and manifests to support ASX

2019-10-28 12:37:47 -07:00

unusually_long_content-type_length.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

usb_insertion.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

users_without_mfa.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

web_servers_executing_suspicious_processes.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

windows_event_log_cleared.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

wmi_perm_event_subscription_sysmon.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

wmi_perm_event_subscription.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

wmi_process_launch.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

wmi_script_execution.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

wmi_temp_event_subscription.yml

Changed json to yml

2019-10-16 16:38:05 +02:00