pyth0n1c 578e6bb088 Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.

2022-05-02 17:12:50 -07:00

..

.untested

detection/experimental folder for untested detections

2020-11-06 10:37:11 -08:00

abnormally_high_number_of_cloud_instances_destroyed.yml

Refactored security content

2022-03-09 14:43:09 +01:00

abnormally_high_number_of_cloud_instances_launched.yml

Refactored security content

2022-03-09 14:43:09 +01:00

amazon_eks_kubernetes_cluster_scan_detection.yml

Refactored security content

2022-03-09 14:43:09 +01:00

amazon_eks_kubernetes_pod_scan_detection.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_detect_attach_to_role_policy.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_detect_permanent_key_creation.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_detect_role_creation.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_detect_sts_assume_role_abuse.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_detect_sts_get_session_token_abuse.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_gcp_storage_access_from_a_new_ip.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_new_open_gcp_storage_buckets.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_s3_access_from_a_new_ip.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_spike_in_aws_security_hub_alerts_for_user.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_spike_in_blocked_outbound_traffic_from_your_aws.yml

fix broken detections

2022-03-14 15:51:05 +01:00

detect_spike_in_s3_bucket_deletion.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gcp_detect_gcploit_framework.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gcp_kubernetes_cluster_pod_scan_detection.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gdrive_suspicious_file_sharing.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gsuite_suspicious_calendar_invite.yml

Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.

2022-05-02 17:12:50 -07:00

high_number_of_login_failures_from_a_single_source.yml

Refactored security content

2022-03-09 14:43:09 +01:00

kubernetes_aws_detect_suspicious_kubectl_calls.yml

Refactored security content

2022-03-09 14:43:09 +01:00

new_container_uploaded_to_aws_ecr.yml

Refactored security content

2022-03-09 14:43:09 +01:00