admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
c8cc65bf3dcf35750eccf5a567418b45943fac7e
splunk-security_content/docs/_posts
T
History
research bot ff3319329e updating docs and package bits [ci skip]
2021-12-15 02:58:27 +00:00
..
2017-09-12-detect_new_login_attempts_to_routers.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2017-09-13-detect_unauthorized_assets_by_mac_address.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2017-09-15-no_windows_updates_in_a_time_frame.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2017-09-19-email_attachments_with_lots_of_spaces.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2017-09-20-large_volume_of_dns_any_queries.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2017-09-23-monitor_web_traffic_for_brand_abuse.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2017-10-13-unusually_long_content-type_length.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2018-01-05-monitor_email_for_brand_abuse.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2018-06-01-detect_large_outbound_icmp_packets.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2018-06-28-detect_s3_access_from_a_new_ip.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2018-10-23-wmi_permanent_event_subscription.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2018-10-23-wmi_temporary_event_subscription.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2018-11-27-detect_spike_in_s3_bucket_deletion.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2018-12-03-remote_wmi_command_attempt.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2018-12-03-usn_journal_deletion.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2018-12-06-suspicious_java_classes.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2018-12-14-file_with_samsam_extension.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2018-12-14-samsam_test_file_write.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2019-01-25-processes_tapping_keyboard_events.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2019-04-01-web_servers_executing_suspicious_processes.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2019-05-08-unusually_long_command_line_-_mltk.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2019-12-03-detect_credential_dumping_through_lsass_access.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2019-12-03-detect_mimikatz_using_loaded_images.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2019-12-06-access_lsass_memory_for_dump_creation.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2019-12-06-create_remote_thread_into_lsass.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2019-12-10-creation_of_shadow_copy.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-01-22-dns_query_length_outliers_-_mltk.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-02-03-creation_of_lsass_dump_with_taskmgr.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-02-07-macos_-_re-opened_applications.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-02-20-new_container_uploaded_to_aws_ecr.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-02-21-dump_lsass_via_comsvcs_dll.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-03-16-child_processes_of_spoolsv_exe.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-03-16-detect_rare_executables.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-03-16-process_execution_via_wmi.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-03-16-script_execution_via_wmi.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-03-16-spike_in_file_writes.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-05-20-first_time_seen_child_process_of_zoom.md
updating docs
2021-12-09 13:51:31 -05:00
2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-05-28-detect_aws_console_login_by_new_user.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-03-detect_path_interception_by_creation_of_program_exe.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-06-short_lived_windows_accounts.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-06-windows_event_log_cleared.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-07-remote_desktop_network_traffic.md
updating docs
2021-12-09 13:51:31 -05:00
2020-07-08-detect_new_local_admin_account.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-21-attempt_to_stop_security_service.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-21-detect_excessive_user_account_lockouts.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-21-detect_outbound_smb_traffic.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-21-detect_outlook_exe_writing_a_zip_file.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-21-detection_of_tools_built_by_nirsoft.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-21-email_files_written_outside_of_the_outlook_directory.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-21-excessive_dns_failures.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-21-first_time_seen_running_windows_service.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-21-hiding_files_and_directories_with_attrib_exe.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-21-okta_account_lockout_events.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-21-okta_failed_sso_attempts.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-21-okta_user_logins_from_multiple_cities.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-21-overwriting_accessibility_binaries.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-21-prohibited_network_traffic_allowed.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-21-protocol_or_port_mismatch.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-21-remote_desktop_network_bruteforce.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-21-remote_desktop_process_running_on_system.md
updating docs
2021-12-09 13:51:31 -05:00
2020-07-21-sc_exe_manipulating_windows_services.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-21-sql_injection_with_long_urls.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-22-smb_traffic_spike_-_mltk.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-22-smb_traffic_spike.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-22-suspicious_email_attachment_extensions.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-22-suspicious_reg_exe_process.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-22-suspicious_writes_to_windows_recycle_bin.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-22-tor_traffic.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-22-unload_sysmon_filter_driver.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-27-aws_detect_attach_to_role_policy.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-27-aws_detect_permanent_key_creation.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-27-aws_detect_role_creation.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-27-aws_detect_sts_assume_role_abuse.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-27-aws_detect_sts_get_session_token_abuse.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-28-detect_windows_dns_sigred_via_zeek.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-07-29-cloud_instance_modified_by_previously_unseen_user.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-08-05-detect_new_open_gcp_storage_buckets.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-08-10-detect_gcp_storage_access_from_a_new_ip.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-08-11-detect_arp_poisoning.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2020-08-11-detect_rogue_dhcp_server.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-08-21-abnormally_high_number_of_cloud_instances_launched.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-08-25-more_than_usual_number_of_lolbas_applications_in_short_time_period.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-08-25-system_process_running_from_unexpected_location.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-09-15-detect_zerologon_via_zeek.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-09-16-create_or_delete_windows_shares_using_net_exe.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-09-18-detect_computer_changed_with_anonymous_account.md
updating docs
2021-12-09 13:51:31 -05:00
2020-10-06-unusually_long_command_line.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2020-10-07-detect_aws_console_login_by_user_from_new_city.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2020-10-07-detect_aws_console_login_by_user_from_new_country.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2020-10-07-detect_aws_console_login_by_user_from_new_region.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2020-10-08-gcp_detect_gcploit_framework.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md
updating docs
2021-12-09 13:51:31 -05:00
2020-10-16-kerberoasting_spn_request_with_rc4_encryption.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2020-10-21-detect_kerberoasting.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2020-10-21-detect_snicat_sni_exfiltration.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-10-28-detect_ipv6_network_infrastructure_threats.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2020-10-28-detect_port_security_violation.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2020-10-28-detect_software_download_to_network_device.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-10-28-detect_traffic_mirroring.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-11-06-ryuk_test_files_detected.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-11-06-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-11-06-windows_security_account_manager_stopped.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-11-09-common_ransomware_extensions.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-11-09-common_ransomware_notes.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-11-09-deleting_shadow_copies.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-11-09-detect_excessive_account_lockouts_from_endpoint.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md
updating docs and package bits [ci skip]
2021-12-15 02:58:27 +00:00
2020-11-18-disabling_remote_user_account_control.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2020-11-18-execution_of_file_with_multiple_extensions.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-11-23-monitor_registry_keys_for_print_monitors.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-11-23-shim_database_installation_with_suspicious_parameters.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-11-26-registry_keys_for_creating_shim_databases.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-11-27-registry_keys_used_for_privilege_escalation.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2020-11-30-rundll_loading_dll_by_ordinal.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-12-07-schtasks_used_for_forcing_a_reboot.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-12-08-shim_database_file_creation.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-12-08-single_letter_process_on_endpoint.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-12-08-system_processes_run_from_unexpected_locations.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-12-08-unusually_long_command_line.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-12-08-wmi_permanent_event_subscription_-_sysmon.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-12-14-sunburst_correlation_dll_and_network_event.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-12-15-o365_suspicious_rights_delegation.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-12-16-high_number_of_login_failures_from_a_single_source.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-12-16-o365_disable_mfa.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-12-16-o365_excessive_authentication_failures_alert.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-12-16-o365_pst_export_alert.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-12-16-o365_suspicious_admin_email_forwarding.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-12-16-o365_suspicious_user_email_forwarding.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-12-17-scheduled_task_deleted_or_created_via_cmd.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2020-12-21-bcdedit_failure_recovery_modification.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-06-supernova_webshell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-12-aws_network_access_control_list_deleted.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-12-suspicious_microsoft_workflow_compiler_usage.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-12-suspicious_msbuild_path.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-12-suspicious_msbuild_rename.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-12-suspicious_msbuild_spawn.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-12-suspicious_mshta_child_process.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-20-detect_rundll32_inline_hta_execution.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-20-suspicious_mshta_spawn.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-22-wbadmin_delete_system_backups.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-25-nltest_domain_trust_discovery.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-26-aws_saml_access_by_provider_user_and_principal.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-26-aws_saml_update_identity_provider.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-26-certutil_exe_certificate_extraction.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-26-o365_add_app_role_assignment_grant_user.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-26-o365_added_service_principal.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-26-o365_excessive_sso_logon_errors.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-26-o365_new_federated_domain_added.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-27-detect_baron_samedit_cve-2021-3156.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-28-detect_regsvr32_application_control_bypass.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-28-ntdsutil_export_ntds.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-28-suspicious_regsvr32_register_suspicious_path.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-02-04-suspicious_rundll32_rename.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-02-04-suspicious_rundll32_startw.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-02-09-suspicious_rundll32_dllregisterserver.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-02-11-detect_html_help_spawn_child_process.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-02-12-detect_regasm_spawning_a_process.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-02-12-detect_regsvcs_spawning_a_process.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-02-16-detect_regasm_with_network_connection.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-02-16-detect_regsvcs_with_network_connection.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-02-22-aws_create_policy_version_to_allow_all_resources.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-02-22-cobalt_strike_named_pipes.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-02-22-suspicious_curl_network_connection.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-02-22-suspicious_plistbuddy_usage_via_osquery.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-02-22-suspicious_plistbuddy_usage.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-03-01-any_powershell_downloadfile.md
Another playbook
2021-12-14 19:24:32 -06:00
2021-03-01-any_powershell_downloadstring.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-03-01-eventvwr_uac_bypass.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-03-01-fodhelper_uac_bypass.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-03-01-ryuk_wake_on_lan_command.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-03-01-suspicious_scheduled_task_from_public_directory.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-03-02-aws_setdefaultpolicyversion.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-03-02-unified_messaging_service_spawning_a_process.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-03-02-windows_disableantispyware_registry.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-03-03-nishang_powershelltcponeline.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-03-03-w3wp_spawning_shell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-03-12-ransomware_notes_bulk_creation.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-03-12-resize_shadowstorage_volume.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-03-16-high_file_deletion_frequency.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-03-16-high_process_termination_frequency.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-03-17-clop_common_exec_parameter.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-03-17-clop_ransomware_known_service_name.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-03-17-process_deleting_its_process_file_path.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-03-23-certutil_download_with_urlcache_and_split_arguments.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-03-23-certutil_download_with_verifyctl_and_split_arguments.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-03-23-certutil_with_decode_argument.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-03-29-powershell_start-bitstransfer.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-03-31-aws_iam_successful_group_deletion.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-03-31-disable_registry_tool.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-03-31-disable_show_hidden_files.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-03-31-disable_windows_behavior_monitoring.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-03-31-disable_windows_smartscreen_protection.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-03-31-disabling_cmd_application.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-03-31-disabling_controlpanel.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-03-31-disabling_firewall_with_netsh.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-03-31-disabling_folderoptions_windows_feature.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-03-31-disabling_norun_windows_app.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-03-31-disabling_systemrestore_in_registry.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-03-31-disabling_task_manager.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-03-31-dsquery_domain_discovery.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-01-aws_iam_assume_role_policy_brute_force.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-01-aws_iam_delete_policy.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-01-aws_iam_failure_group_deletion.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-07-malicious_powershell_executed_as_a_service.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-08-winevent_scheduled_task_created_within_public_path.md
updating docs
2021-12-09 13:51:31 -05:00
2021-04-12-excel_spawning_powershell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-12-excel_spawning_windows_script_host.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-12-winword_spawning_powershell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-12-winword_spawning_windows_script_host.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-13-aws_excessive_security_scanning.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-13-multiple_users_attempting_to_authenticate_using_explicit_credentials.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-13-multiple_users_failing_to_authenticate_from_process.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-13-office_application_spawn_rundll32_process.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-04-14-multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-14-multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-14-office_document_creating_schedule_task.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-14-office_document_executing_macro_code.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-15-dns_exfiltration_using_nslookup_app.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-19-gpupdate_with_no_command_line_arguments_with_network.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-19-powershell_remote_thread_to_known_windows_process.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-19-schedule_task_with_http_command_arguments.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-19-schedule_task_with_rundll32_command_trigger.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-19-wermgr_process_create_executable_file.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-21-excessive_usage_of_nslookup_app.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-21-multiple_archive_files_http_post_traffic.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-22-anomalous_usage_of_7zip.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-22-office_product_spawning_rundll32_with_no_dll.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-22-plain_http_post_exfiltrated_data.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-22-winword_spawning_cmd.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-26-office_product_spawning_bitsadmin.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-26-office_product_spawning_certutil.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-26-office_product_spawning_mshta.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-26-trickbot_named_pipe.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-29-icacls_deny_command.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-29-suspicious_driver_loaded_path.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-04-29-xmrig_driver_loaded.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-04-deleting_of_net_users.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-04-disabling_net_user_account.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-04-excessive_attempt_to_disable_services.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-04-excessive_service_stop_attempt.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-04-excessive_usage_of_taskkill.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-04-icacls_grant_command.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-04-modify_acl_permission_to_files_or_folder.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-04-process_kill_base_on_file_path.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-05-disable_windows_app_hotkeys.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-05-hide_user_account_from_sign-in_screen.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-05-05-suspicious_process_file_path.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-06-download_files_using_telegram.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-06-enumerate_users_local_group_using_telegram.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-06-excessive_usage_of_net_app.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-06-executables_or_script_creation_in_suspicious_path.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-07-excessive_usage_of_cacls_app.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-07-schtasks_run_task_on_demand.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-12-delete_shadowcopy_with_powershell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-13-cmlua_or_cmstplua_uac_bypass.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-13-slui_runas_elevated.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-13-slui_spawning_a_process.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-18-services_escalate_exe.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-19-allow_inbound_traffic_in_firewall_rule.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-19-enable_rdp_in_other_port_number.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-05-19-mailsniper_invoke_functions.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-20-cmd_echo_pipe_-_escalation.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-21-winrm_spawning_a_process.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-26-allow_inbound_traffic_by_firewall_rule_registry.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-26-secretdumps_offline_ntds_dumping_tool.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-27-detect_sharphound_file_modifications.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-05-27-detect_sharphound_usage.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-01-detect_azurehound_command-line_arguments.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-01-detect_azurehound_file_modifications.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-01-detect_sharphound_command-line_arguments.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-02-conti_common_exec_parameter.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-02-modification_of_wallpaper.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-02-revil_common_exec_parameter.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-02-revil_registry_entry.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-02-wbemprox_com_object_execution.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-03-excessive_number_of_distinct_processes_created_in_windows_temp_folder.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-04-known_services_killed_by_ransomware.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-07-excessive_number_of_taskhost_processes.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-09-detect_empire_with_powershell_script_block_logging.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-09-unloading_amsi_via_reflection.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-10-allow_operation_with_consent_admin.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-06-10-clear_unallocated_sector_using_cipher_app.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-10-disable_logs_using_wevtutil.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-10-permission_modification_using_takeown_app.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-10-powershell_creating_thread_mutex.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-10-powershell_domain_enumeration.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-10-powershell_loading_dotnet_into_memory_via_system_reflection_assembly.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-10-powershell_processing_stream_of_data.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-10-powershell_using_memory_as_backing_store.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-10-recon_avproduct_through_pwh_or_wmi.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-10-recon_using_wmi_class.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-10-start_up_during_safe_mode_boot.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-14-wmi_recon_running_process_or_services.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-15-wevtutil_usage_to_clear_logs.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-06-15-wevtutil_usage_to_disable_logs.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-06-16-detect_wmi_event_subscription_persistence.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-17-suspicious_event_log_service_behavior.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-22-disable_amsi_through_registry.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-06-22-disable_etw_through_registry.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-06-22-execute_javascript_with_jscript_com_clsid.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-22-powershell_enable_smb1protocol_feature.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-22-recursive_delete_of_directory_in_batch_cmd.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-23-allow_file_and_printing_sharing_in_firewall.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-23-allow_network_discovery_in_firewall.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-24-excessive_usage_of_sc_service_utility.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-06-25-excessive_number_of_service_control_start_as_disabled.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-01-print_spooler_adding_a_printer_driver.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-01-print_spooler_failed_to_load_a_plug-in.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-01-sdclt_uac_bypass.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-07-01-silentcleanup_uac_bypass.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-01-spoolsv_spawning_rundll32.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-01-spoolsv_suspicious_loaded_modules.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-01-spoolsv_suspicious_process_access.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-01-spoolsv_writing_a_dll_-_sysmon.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-01-spoolsv_writing_a_dll.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-01-wsreset_uac_bypass.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-07-05-msmpeng_application_dll_side_loading.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-05-powershell_disable_security_monitoring.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-12-net_profiler_uac_bypass.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-12-uac_bypass_mmc_load_unsigned_dll.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-19-aws_createaccesskey.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-19-aws_createloginprofile.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-19-aws_updateloginprofile.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-19-detect_new_open_s3_buckets.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-19-o365_bypass_mfa_via_trusted_ip.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-19-office_product_spawn_cmd_process.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-20-detect_shared_ec2_snapshot.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-23-sam_database_file_access_attempt.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-26-rundll32_createremotethread_in_browser.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-26-rundll32_dnsquery.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-26-rundll32_process_creating_exe_dll_files.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-26-suspicious_icedid_rundll32_cmdline.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-26-suspicious_rundll32_plugininit.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-27-chcp_command_execution.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-27-regsvr32_with_known_silent_switch_cmdline.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-07-29-rundll32_create_remote_thread_to_a_process.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-30-drop_icedid_license_dat.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-30-icedid_exfiltrated_archived_file_creation.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-07-30-office_application_spawn_regsvr32_process.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-03-sqlite_module_in_temp_folder.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-04-create_remote_thread_in_shell_application.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-09-uninstall_app_using_msiexec.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-10-powershell_execute_com_object.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-11-fsutil_zeroing_file.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-13-uac_bypass_with_colorui_com_object.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-16-gsuite_drive_share_in_external_email.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-16-gsuite_email_suspicious_attachment.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-17-7zip_commandline_to_smb_share_path.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-17-aws_ecr_container_scanning_findings_high.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-17-aws_ecr_container_scanning_findings_medium.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-18-esentutl_sam_copy.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-18-powershell_4104_hunting.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-19-aws_ecr_container_upload_outside_business_hours.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-19-aws_ecr_container_upload_unknown_user.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-19-gsuite_email_suspicious_subject_with_attachment.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-19-protocols_passing_authentication_in_cleartext.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-20-github_commit_changes_in_master.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-20-kubernetes_nginx_ingress_lfi.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-23-getlocaluser_with_powershell_script_block.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-23-getlocaluser_with_powershell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-23-getwmiobject_user_account_with_powershell_script_block.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-23-getwmiobject_user_account_with_powershell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-23-gsuite_email_with_known_abuse_web_service_link.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-23-gsuite_suspicious_shared_file_name.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-23-kubernetes_nginx_ingress_rfi.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-24-adsisearcher_account_discovery.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-24-domain_account_discovery_with_dsquery.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-24-domain_account_discovery_with_net_app.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-24-domain_account_discovery_with_wmic.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-24-get_aduser_with_powershell_script_block.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-24-get_aduser_with_powershell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-24-get_domainuser_with_powershell_script_block.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-24-get_domainuser_with_powershell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-24-get-domaintrust_with_powershell_script_block.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-24-get-domaintrust_with_powershell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-24-getwmiobject_ds_user_with_powershell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-24-kubernetes_scanner_image_pulling.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-25-domain_group_discovery_with_adsisearcher.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-25-domain_group_discovery_with_net.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-25-domain_group_discovery_with_wmic.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-25-elevated_group_discovery_with_net.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-25-elevated_group_discovery_with_powerview.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-25-elevated_group_discovery_with_wmic.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-25-getadgroup_with_powershell_script_block.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-25-getadgroup_with_powershell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-25-getdomaingroup_with_powershell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-25-getnettcpconnection_with_powershell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-25-getwmiobject_ds_group_with_powershell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-26-get_domainpolicy_with_powershell_script_block.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-26-get_domainpolicy_with_powershell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-26-getdomaingroup_with_powershell_script_block.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-26-password_policy_discovery_with_net.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-26-process_creating_lnk_file_in_suspicious_location.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-27-exchange_powershell_abuse_via_ssrf.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-27-exchange_powershell_module_usage.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-08-30-domain_controller_discovery_with_nltest.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-30-remote_system_discovery_with_net.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-31-petitpotam_network_share_access_request.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-08-31-remote_system_discovery_with_dsquery.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-01-circle_ci_disable_security_step.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-01-domain_controller_discovery_with_wmic.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-01-domain_group_discovery_with_dsquery.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-01-getadcomputer_with_powershell_script_block.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-01-github_commit_in_develop.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-01-github_dependabot_alert.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-01-github_pull_request_from_unknown_user.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-01-remote_system_discovery_with_adsisearcher.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-01-remote_system_discovery_with_wmic.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-02-circle_ci_disable_security_job.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-02-get-foresttrust_with_powershell_script_block.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-02-get-foresttrust_with_powershell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-02-getdomaincomputer_with_powershell_script_block.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-02-getdomaincontroller_with_powershell_script_block.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-06-add_defaultuser_and_password_in_registry.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-09-06-auto_admin_logon_registry_entry.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-06-bcdedit_command_back_to_normal_mode_boot.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-06-change_to_safe_mode_with_network_config.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-06-correlation_by_repository_and_risk.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-06-correlation_by_user_and_risk.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-07-getadcomputer_with_powershell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-07-getdomaincomputer_with_powershell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-07-getdomaincontroller_with_powershell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-07-getwmiobject_ds_computer_with_powershell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-07-registry_keys_used_for_persistence.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-07-system_information_discovery_detection.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-08-control_loading_from_world_writable_directory.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-08-create_local_admin_accounts_using_net_exe.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-08-office_spawning_control.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-08-rundll32_control_rundll_hunt.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-08-rundll32_control_rundll_world_writable_directory.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-09-extraction_of_registry_hives.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-09-mshtml_module_load_in_office_product.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-10-getnettcpconnection_with_powershell_script_block.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-10-network_connection_discovery_with_arp.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-10-network_connection_discovery_with_net.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-10-network_connection_discovery_with_netstat.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-10-office_product_writing_cab_or_inf.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-13-getcurrent_user_with_powershell_script_block.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-13-getcurrent_user_with_powershell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-13-jscript_execution_using_cscript_app.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-09-13-ms_scripting_process_loading_ldap_module.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-13-ms_scripting_process_loading_wmi_module.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-13-office_application_drop_executable.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-09-13-system_user_discovery_with_query.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-13-system_user_discovery_with_whoami.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-13-user_discovery_with_env_vars_powershell_script_block.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-13-user_discovery_with_env_vars_powershell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-13-xsl_script_execution_with_wmic.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-14-get_wmiobject_group_discovery.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-14-net_localgroup_discovery.md
updating docs
2021-12-09 13:51:31 -05:00
2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-14-powershell_get_localgroup_discovery.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-14-wmic_group_discovery.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-15-check_elevated_cmd_using_whoami.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-15-non_chrome_process_accessing_chrome_default_dir.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-09-15-non_firefox_process_access_firefox_profile_dir.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-09-16-account_discovery_with_net_app.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-16-attempt_to_add_certificate_to_untrusted_store.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-16-batch_file_write_to_system32.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-16-bits_job_persistence.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-16-bitsadmin_download_file.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-16-detect_html_help_renamed.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-09-16-detect_html_help_url_in_command_line.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-16-detect_html_help_using_infotech_storage_handlers.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-16-detect_mshta_inline_hta_execution.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-16-detect_mshta_renamed.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-16-detect_mshta_url_in_command_line.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-16-detect_psexec_with_accepteula_flag.md
updating docs
2021-12-09 13:51:31 -05:00
2021-09-16-detect_renamed_7-zip.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-16-detect_renamed_psexec.md
updating docs
2021-12-09 13:51:31 -05:00
2021-09-16-detect_renamed_rclone.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-16-detect_renamed_winrar.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-16-dump_lsass_via_procdump.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-16-local_account_discovery_with_net.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-16-local_account_discovery_with_wmic.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-16-office_product_spawning_wmic.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-16-processes_launching_netsh.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-20-detect_regasm_with_no_command_line_arguments.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-20-detect_regsvcs_with_no_command_line_arguments.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-20-office_document_spawned_child_process_to_download.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-20-suspicious_dllhost_no_command_line_arguments.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-20-suspicious_gpupdate_no_command_line_arguments.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-20-suspicious_microsoft_workflow_compiler_rename.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-20-suspicious_rundll32_no_command_line_arguments.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-20-suspicious_searchprotocolhost_no_command_line_arguments.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-21-remcos_rat_file_creation_in_remcos_folder.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-21-suspicious_image_creation_in_appdata_folder.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-21-suspicious_wav_file_in_appdata_folder.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-24-remcos_client_registry_install_entry.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-27-change_default_file_association.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-27-logon_script_event_trigger_execution.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-27-screensaver_event_trigger_execution.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-28-active_setup_registry_autostart.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-28-print_processor_registry_autostart.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-29-disable_uac_remote_restriction.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-29-time_provider_persistence_registry.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-09-29-verclsid_clsid_execution.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-01-vbscript_execution_using_wscript_app.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-04-msbuild_suspicious_spawned_by_script_process.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-04-regsvr32_silent_and_install_param_dll_loading.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-10-05-detect_exchange_web_shell.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-05-disable_security_logs_using_minint_registry.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-05-enable_wdigest_uselogoncredential_registry.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-05-malicious_inprocserver32_modification.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-05-malicious_powershell_process_-_connect_to_internet_with_hidden_window.md
Another playbook
2021-12-14 19:24:32 -06:00
2021-10-05-malicious_powershell_process_-_encoded_command.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-05-process_writing_dynamicwrapperx.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-05-rundll32_shimcache_flush.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-05-suspicious_copy_on_system32.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-05-winhlp32_spawning_a_process.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-06-dns_query_length_with_high_standard_deviation.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-06-sdelete_application_execution.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-06-wscript_or_cscript_suspicious_child_process.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-07-etw_registry_disabled.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-11-suspicious_wevtutil_usage.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-13-dllhost_with_no_command_line_arguments_with_network.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-13-rundll32_with_no_command_line_arguments_with_network.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-13-searchprotocolhost_with_no_command_line_with_network.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-14-serviceprincipalnames_discovery_with_powershell.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-10-14-serviceprincipalnames_discovery_with_setspn.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-10-18-disable_defender_antivirus_registry.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-18-disable_defender_blockatfirstseen_feature.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-18-disable_defender_enhanced_notification.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-18-disable_defender_mpengine_registry.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-18-disable_defender_spynet_reporting.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-18-disable_defender_submit_samples_consent_feature.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-18-disable_schedule_task.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-19-windows_curl_download_to_suspicious_path.md
updating docs
2021-11-10 14:41:56 -05:00
2021-10-19-winevent_windows_task_scheduler_event_action_started.md
updating docs
2021-11-10 14:41:56 -05:00
2021-10-20-disabling_defender_services.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-20-wmic_noninteractive_app_uninstallation.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-24-gdrive_suspicious_file_sharing.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-10-24-gsuite_suspicious_calendar_invite.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-11-03-windows_adfind_exe.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-11-04-attacker_tools_on_endpoint.md
updating docs and package bits [ci skip]
2021-11-10 16:16:30 +00:00
2021-11-05-potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-10-windows_curl_upload_to_remote_destination.md
updating docs
2021-11-10 14:41:56 -05:00
2021-11-10-windows_service_creation_on_remote_endpoint.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-10-windows_service_initiation_on_remote_endpoint.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-11-scheduled_task_initiation_on_remote_endpoint.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-11-schtasks_scheduling_job_on_remote_system.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-11-wmic_xsl_execution_via_url.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-11-12-aws_iam_accessdenied_discovery_events.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-11-12-csc_net_on_the_fly_compilation.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-11-12-firewall_allowed_program_enable.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-11-12-network_discovery_using_route_windows_app.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-11-12-remote_process_instantiation_via_wmi.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-12-runas_execution_in_commandline.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-11-12-windows_installutil_credential_theft.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-11-12-windows_installutil_remote_network_connection.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-11-12-windows_installutil_uninstall_option_with_network.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-11-12-windows_installutil_uninstall_option.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-11-12-windows_installutil_url_in_command_line.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-11-15-remote_process_instantiation_via_dcom_and_powershell_script_block.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-15-sdelete_application_execution.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-15-windows_diskcryptor_usage.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-11-16-high_frequency_copy_of_files_in_network_share.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-11-16-remote_process_instantiation_via_winrm_and_powershell_script_block.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-18-executable_file_written_in_administrative_smb_share.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-18-interactive_session_on_remote_endpoint_with_powershell.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-18-loading_of_dynwrapx_module.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-11-18-suspicious_process_dns_query_known_abuse_web_services.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-11-19-impacket_lateral_movement_commandline_parameters.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-19-system_info_gathering_using_dxdiag_application.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-11-22-anomalous_usage_of_archive_tools.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-11-22-possible_browser_pass_view_parameter.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-11-22-services_lolbas_execution_process_spawn.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-22-svchost_lolbas_execution_process_spawn.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-22-windows_service_created_with_suspicious_service_path.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-22-windows_service_created_within_public_path.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-22-wmiprsve_lolbas_execution_process_spawn.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-23-mmc_lolbas_execution_process_spawn.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-24-attempt_to_delete_services.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-24-attempt_to_disable_services.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-25-add_or_set_windows_defender_exclusion.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-11-25-powershell_windows_defender_exclusion_commands.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-11-25-windows_defender_exclusion_registry_entry.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-11-29-attempted_credential_dump_from_registry_via_reg_exe.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-29-deny_permission_using_cacls_utility.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-29-detect_dump_lsass_memory_using_comsvcs.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-29-detect_rclone_command-line_usage.md
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
2021-11-29-possible_lateral_movement_powershell_spawn.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-29-randomly_generated_scheduled_task_name.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-29-randomly_generated_windows_service_name.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-30-delete_a_net_user.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-30-disable_net_user_account.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-30-first_time_seen_command_line_argument.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-30-grant_permission_using_cacls_utility.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-30-modify_acls_permission_of_files_or_folders.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-30-potential_pass_the_token_or_hash_observed_at_the_destination_device.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-30-rare_parent-child_process_relationship.md
updating docs
2021-12-09 13:51:31 -05:00
2021-11-30-resize_shadowstorage_volume.md
updating docs
2021-12-09 13:51:31 -05:00
2021-12-01-unusual_number_of_computer_service_tickets_requested.md
updating docs
2021-12-09 13:51:31 -05:00
2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md
updating docs
2021-12-09 13:51:31 -05:00
2021-12-03-detect_rclone_command-line_usage.md
Another playbook
2021-12-14 19:24:32 -06:00
2021-12-03-short_lived_scheduled_task.md
updating docs
2021-12-09 13:51:31 -05:00
2021-12-03-windows_curl_upload_to_remote_destination.md
Another playbook
2021-12-14 19:24:32 -06:00
2021-12-07-bcdedit_failure_recovery_modification.md
updating docs
2021-12-09 13:51:31 -05:00
2021-12-07-dns_exfiltration_using_nslookup_app.md
updating docs
2021-12-09 13:51:31 -05:00
2021-12-07-excessive_number_of_office_files_copied.md
updating docs
2021-12-14 21:40:19 -05:00
2021-12-07-fsutil_zeroing_file.md
updating docs
2021-12-09 13:51:31 -05:00
2021-12-07-high_file_deletion_frequency.md
updating docs
2021-12-14 21:40:19 -05:00
2021-12-07-wbadmin_delete_system_backups.md
updating docs
2021-12-09 13:51:31 -05:00
2021-12-10-curl_download_and_bash_execution.md
updating docs
2021-12-14 21:40:19 -05:00
2021-12-11-wget_download_and_bash_execution.md
updating docs
2021-12-14 21:40:19 -05:00
2021-12-13-cmd_carry_out_string_command_parameter.md
updating docs
2021-12-14 21:40:19 -05:00
2021-12-13-detect_outbound_ldap_traffic.md
updating docs
2021-12-14 21:40:19 -05:00
2021-12-13-java_class_file_download_by_java_user_agent.md
updating docs
2021-12-14 21:40:19 -05:00
2021-12-13-linux_java_spawning_shell.md
updating docs
2021-12-14 21:40:19 -05:00
2021-12-13-log4shell_jndi_payload_injection_attempt.md
updating docs
2021-12-14 21:40:19 -05:00
2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md
updating docs
2021-12-14 21:40:19 -05:00
2021-12-13-outbound_network_connection_from_java_using_default_ports.md
updating docs
2021-12-14 21:40:19 -05:00
2021-12-13-windows_java_spawning_shells.md
updating docs
2021-12-14 21:40:19 -05:00
2021-12-14-hunting_for_log4shell.md
updating docs
2021-12-14 21:40:19 -05:00