Rod Soto 8f89d328d6 RBACAWSsearch

2020-06-23 15:32:12 -04:00

..

aws_cloudwatchlogs_eks.yml

new generate script

2020-05-06 17:42:38 +02:00

aws_s3_accesslogs.yml

new generate script

2020-05-06 17:42:38 +02:00

brand_abuse_dns.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

brand_abuse_email.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

brand_abuse_web.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

clients_connecting_to_multiple_dns_servers.yml

adding definitions

2020-01-23 13:31:43 -08:00

cloudtrail.yml

new generate script

2020-05-06 17:42:38 +02:00

cloudwatch_eks.yml

validate script

2020-04-30 16:52:38 +02:00

cloudwatch_vpc.yml

validate script

2020-04-30 16:52:38 +02:00

cloudwatchlogs_vpcflow.yml

new generate script

2020-05-06 17:42:38 +02:00

create_or_delete_windows_shares.yml

testing commented search

2020-01-21 01:58:30 -08:00

dynamic_dns_providers.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

dynamic_dns_web_traffic.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

ec2_modification_api_calls.yml

naming updates, jinja macros updates

2019-12-16 13:05:17 -08:00

evilginx_phishlets_0365.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_amazon.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_aws.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_facebook.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_github.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_google.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

evilginx_phishlets_outlook.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

filter_rare_process_whitelist.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

google_gcp_pubnet_message.yml

validate script

2020-04-30 16:52:38 +02:00

google_gcp_pubsub_message.yml

new generate script

2020-05-06 17:42:38 +02:00

is_windows_system_file.yml

updating files as per Dons feedback

2020-02-04 09:15:39 -08:00

kubernetes_aws_detect_most_active_service_accounts_by_pod.yml

firstgcpawssearch

2020-06-23 14:51:45 -04:00

kubernetes_aws_detect_RBAC_authorization_by_account.yml

RBACAWSsearch

2020-06-23 15:32:12 -04:00

kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml

svacconpodnasp

2020-05-26 23:16:07 -04:00

kubernetes_azure_detect_RBAC_authorization_by_account.yml

RBACauth

2020-05-26 22:18:16 -04:00

kubernetes_azure_detect_sensitive_object_access.yml

fixedanemsaddedservaccount

2020-05-26 22:40:16 -04:00

kubernetes_azure_detect_sensitive_role_access.yml

azk8srolesto

2020-05-21 18:41:32 -04:00

kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml

fixedanemsaddedservaccount

2020-05-26 22:40:16 -04:00

kubernetes_azure_detect_suspicious_kubectl_calls.yml

kubectlcalls

2020-05-26 23:42:26 -04:00

kubernetes_azure_pod_scan_fingerprint_detection_filter.yml

azpodscandetect

2020-05-20 15:38:53 -04:00

kubernetes_azure_scan_fingerprint_detection_filter.yml

k8sScan

2020-05-19 17:55:28 -04:00

netbackup.yml

new generate script

2020-05-06 17:42:38 +02:00

network_acl_events.yml

naming updates, jinja macros updates

2019-12-16 13:05:17 -08:00

okta.yml

new generate script

2020-05-06 17:42:38 +02:00

previously_seen_cloud_compute_creations_by_user_search_window_begin_offset.yml

Added search_window macros to searches

2019-10-17 09:28:41 -07:00

previously_seen_cloud_compute_image_search_window_begin_offset.yml

Added search_window macros to searches

2019-10-17 09:28:41 -07:00

previously_seen_cloud_compute_instance_types_search_window_begin_offset.yml

Added search_window macros to searches

2019-10-17 09:28:41 -07:00

previously_seen_cloud_regions_search_window_begin_offset.yml

Updated generate to output for ASX

2019-10-16 20:54:13 -07:00

prohibited_apps_launching_cmd.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

prohibited_softwares.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

ransomware_extensions.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

ransomware_notes.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

remove_valid_domains.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

s3_accesslogs.yml

validate script

2020-04-30 16:52:38 +02:00

security_content_ctime.yml

fixed security_content_ctime macro

2019-12-17 09:33:35 +01:00

security_content_summariesonly.yml

added summariesonly and fixed ctime

2019-12-11 15:14:49 -05:00

security_group_api_calls.yml

naming updates, jinja macros updates

2019-12-16 13:05:17 -08:00

stream_http.yml

new generate script

2020-05-06 17:42:38 +02:00

suspicious_email_attachments.yml

naming updates, jinja macros updates

2019-12-16 13:05:17 -08:00

suspicious_writes.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

sysmon.yml

new generate script

2020-05-06 17:42:38 +02:00

system_network_configuration_discovery_tools.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

uncommon_processes.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

wineventlog_security.yml

new generate script

2020-05-06 17:42:38 +02:00

wineventlog_system.yml

new generate script

2020-05-06 17:42:38 +02:00

wmi.yml

new generate script

2020-05-06 17:42:38 +02:00