Bhavin Patel b8d898704e Merge branch 'develop' into deprecated_aws_searches

2021-01-04 11:52:09 -08:00

..

.gitkeep

detection tests

2020-11-03 17:04:53 +01:00

abnormally_high_aws_instances_launched_by_user___mltk.yml

deprecated AWS seaches that have been translated

2020-12-14 13:09:24 -08:00

abnormally_high_aws_instances_launched_by_user.yml

deprecated AWS seaches that have been translated

2020-12-14 13:09:24 -08:00

abnormally_high_aws_instances_terminated_by_user___mltk.yml

deprecated AWS seaches that have been translated

2020-12-14 13:09:24 -08:00

abnormally_high_aws_instances_terminated_by_user.yml

deprecated AWS seaches that have been translated

2020-12-14 13:09:24 -08:00

aws_cloud_provisioning_from_previously_unseen_city.yml

deprecated AWS seaches that have been translated

2020-12-14 13:09:24 -08:00

aws_cloud_provisioning_from_previously_unseen_country.yml

deprecated AWS seaches that have been translated

2020-12-14 13:09:24 -08:00

aws_cloud_provisioning_from_previously_unseen_ip_address.yml

deprecated AWS seaches that have been translated

2020-12-14 13:09:24 -08:00

aws_cloud_provisioning_from_previously_unseen_region.yml

deprecated AWS seaches that have been translated

2020-12-14 13:09:24 -08:00

aws_cross_account_activity_from_previously_unseen_account.yml

deprecated AWS seaches that have been translated

2020-12-14 13:09:24 -08:00

detect_mimikatz_using_loaded_images.yml

new test file

2020-11-19 14:11:18 +01:00

detect_mimikatz_via_powershell_and_eventcode_4703.yml

new test file

2020-11-19 14:11:18 +01:00

detect_spike_in_aws_api_activity.yml

deprecated AWS seaches that have been translated

2020-12-14 13:09:24 -08:00

detect_spike_in_network_acl_activity.yml

deprecated AWS seaches that have been translated

2020-12-14 13:09:24 -08:00

detect_spike_in_security_group_activity.yml

deprecated AWS seaches that have been translated

2020-12-14 13:09:24 -08:00

detect_usb_device_insertion.yml

new test file

2020-11-26 13:21:46 +01:00

ec2_instance_modified_with_previously_unseen_user.yml

deprecated AWS seaches that have been translated

2020-12-14 13:09:24 -08:00

ec2_instance_started_in_previously_unseen_region.yml

deprecated AWS seaches that have been translated

2020-12-14 13:09:24 -08:00

ec2_instance_started_with_previously_unseen_ami.yml

deprecated AWS seaches that have been translated

2020-12-14 13:09:24 -08:00

ec2_instance_started_with_previously_unseen_instance_type.yml

deprecated AWS seaches that have been translated

2020-12-14 13:09:24 -08:00

ec2_instance_started_with_previously_unseen_user.yml

deprecated AWS seaches that have been translated

2020-12-14 13:09:24 -08:00

execution_of_file_with_spaces_before_extension.yml

new test file

2020-11-19 14:11:18 +01:00

extended_period_without_successful_netbackup_backups.yml

new test file

2020-11-19 14:11:18 +01:00

first_time_seen_command_line_argument.yml

updates

2020-12-09 18:12:30 +01:00

osquery_pack___coldroot_detection.yml

new test file

2020-12-08 15:17:01 +01:00

processes_created_by_netsh.yml

new test file

2020-11-23 13:28:48 +01:00

prohibited_software_on_endpoint.yml

change

2020-11-24 10:54:02 +01:00

reg_exe_used_to_hide_files_directories_via_registry_keys.yml

new test file

2020-11-26 13:21:46 +01:00

remote_registry_key_modifications.yml

detection test

2020-11-30 16:39:27 +01:00

remote_wmi_command_attempt.yml

detection test

2020-11-30 16:39:27 +01:00

scheduled_tasks_used_in_badrabbit_ransomware.yml

new test file

2020-12-07 14:00:57 +01:00

suspicious_changes_to_file_associations.yml

new test file

2020-12-08 11:19:49 +01:00

suspicious_file_write.yml

new test file

2020-12-08 11:19:49 +01:00

suspicious_writes_to_system_volume_information.yml

new test file

2020-12-08 11:47:59 +01:00

uncommon_processes_on_endpoint.yml

new test file

2020-12-08 13:38:41 +01:00

unsigned_image_loaded_by_lsass.yml

new test file

2020-11-19 14:11:18 +01:00

unsuccessful_netbackup_backups.yml

new test file

2020-12-08 13:38:41 +01:00

windows_connhost_exe_force_flag.yml

ryuk test files

2020-11-30 17:07:17 +01:00

windows_disableantispyware_reg.yml

small changes

2020-11-30 17:09:24 +01:00

windows_hosts_file_modification.yml

new test file

2020-12-08 15:17:01 +01:00