admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
efdc9df9d5bec22bd2d0326348bb063a7beda3f5
splunk-security_content/docs/_posts
T
History
divious1 3488a5ebac playbook skeleton
2021-10-12 19:41:23 -04:00
..
2017-09-12-detect_new_login_attempts_to_routers.md
fixing up base on feedback
2021-10-11 18:18:23 -04:00
2017-09-13-detect_unauthorized_assets_by_mac_address.md
fixing up base on feedback
2021-10-11 18:18:23 -04:00
2017-09-15-no_windows_updates_in_a_time_frame.md
fixing up base on feedback
2021-10-11 18:18:23 -04:00
2017-09-19-email_attachments_with_lots_of_spaces.md
fixing up base on feedback
2021-10-11 18:18:23 -04:00
2017-09-20-large_volume_of_dns_any_queries.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md
fixing up base on feedback
2021-10-11 18:18:23 -04:00
2017-09-23-monitor_web_traffic_for_brand_abuse.md
fixing up base on feedback
2021-10-11 18:18:23 -04:00
2017-10-13-unusually_long_content-type_length.md
fixing up base on feedback
2021-10-11 18:18:23 -04:00
2018-01-05-monitor_email_for_brand_abuse.md
fixing up base on feedback
2021-10-11 18:18:23 -04:00
2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md
fixing up base on feedback
2021-10-11 18:18:23 -04:00
2018-06-01-detect_large_outbound_icmp_packets.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2018-06-28-detect_s3_access_from_a_new_ip.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md
fixing up base on feedback
2021-10-11 18:18:23 -04:00
2018-10-23-wmi_permanent_event_subscription.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2018-10-23-wmi_temporary_event_subscription.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2018-11-27-detect_spike_in_s3_bucket_deletion.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2018-12-03-remote_wmi_command_attempt.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2018-12-03-usn_journal_deletion.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2018-12-06-suspicious_java_classes.md
fixing up base on feedback
2021-10-11 18:18:23 -04:00
2018-12-14-batch_file_write_to_system32.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2018-12-14-file_with_samsam_extension.md
fixing up base on feedback
2021-10-11 18:18:23 -04:00
2018-12-14-samsam_test_file_write.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2019-01-25-processes_tapping_keyboard_events.md
fixing up base on feedback
2021-10-11 18:18:23 -04:00
2019-04-01-web_servers_executing_suspicious_processes.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2019-05-08-unusually_long_command_line_-_mltk.md
fixing up base on feedback
2021-10-11 18:18:23 -04:00
2019-12-02-attempted_credential_dump_from_registry_via_reg_exe.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2019-12-03-detect_credential_dumping_through_lsass_access.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2019-12-03-detect_mimikatz_using_loaded_images.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2019-12-06-access_lsass_memory_for_dump_creation.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2019-12-06-create_remote_thread_into_lsass.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2019-12-10-creation_of_shadow_copy_with_wmic_and_powershell.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2019-12-10-creation_of_shadow_copy.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2019-12-10-credential_dumping_via_copy_command_from_shadow_copy.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2019-12-10-credential_dumping_via_symlink_to_shadow_copy.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2020-6-04-attempted_credential_dump_from_registry_via_reg_exe.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-7-13-detect_prohibited_applications_spawning_cmd_exe.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-01-22-dns_query_length_outliers_-_mltk.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-02-03-creation_of_lsass_dump_with_taskmgr.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-02-07-macos_-_re-opened_applications.md
fixing up base on feedback
2021-10-11 18:18:23 -04:00
2020-02-20-new_container_uploaded_to_aws_ecr.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-02-21-dump_lsass_via_comsvcs_dll.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-03-16-child_processes_of_spoolsv_exe.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-03-16-detect_rare_executables.md
fixing up base on feedback
2021-10-11 18:18:23 -04:00
2020-03-16-process_execution_via_wmi.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-03-16-script_execution_via_wmi.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-03-16-spike_in_file_writes.md
fixing up base on feedback
2021-10-11 18:18:23 -04:00
2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-05-20-first_time_seen_child_process_of_zoom.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md
fixing up base on feedback
2021-10-11 18:18:23 -04:00
2020-05-28-detect_aws_console_login_by_new_user.md
fixing up base on feedback
2021-10-11 18:18:23 -04:00
2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md
fixing up base on feedback
2021-10-11 18:18:23 -04:00
2020-07-03-detect_path_interception_by_creation_of_program_exe.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-06-short_lived_windows_accounts.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-06-windows_event_log_cleared.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-07-remote_desktop_network_traffic.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-08-detect_new_local_admin_account.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-10-processes_launching_netsh.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-21-attempt_to_stop_security_service.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-21-create_or_delete_windows_shares_using_net_exe.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2020-07-21-detect_excessive_user_account_lockouts.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-21-detect_outbound_smb_traffic.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-21-detect_outlook_exe_writing_a_zip_file.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-21-detection_of_tools_built_by_nirsoft.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-21-email_files_written_outside_of_the_outlook_directory.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-21-excessive_dns_failures.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-21-first_time_seen_running_windows_service.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-21-hiding_files_and_directories_with_attrib_exe.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-21-malicious_powershell_process_-_encoded_command.md
removing conflict
2021-09-27 13:16:04 -04:00
2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-21-okta_account_lockout_events.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-21-okta_failed_sso_attempts.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-21-okta_user_logins_from_multiple_cities.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-21-overwriting_accessibility_binaries.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-21-prohibited_network_traffic_allowed.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-21-protocol_or_port_mismatch.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-21-remote_desktop_network_bruteforce.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-21-remote_desktop_process_running_on_system.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-21-sc_exe_manipulating_windows_services.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-21-schtasks_scheduling_job_on_remote_system.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-21-sql_injection_with_long_urls.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-22-smb_traffic_spike_-_mltk.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-22-smb_traffic_spike.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-22-suspicious_email_attachment_extensions.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-22-suspicious_reg_exe_process.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-22-suspicious_wevtutil_usage.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-22-suspicious_writes_to_windows_recycle_bin.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-22-tor_traffic.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-22-unload_sysmon_filter_driver.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-27-aws_detect_attach_to_role_policy.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-27-aws_detect_permanent_key_creation.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-27-aws_detect_role_creation.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-27-aws_detect_sts_assume_role_abuse.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-27-aws_detect_sts_get_session_token_abuse.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-28-detect_windows_dns_sigred_via_zeek.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-07-29-cloud_instance_modified_by_previously_unseen_user.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-08-05-detect_new_open_gcp_storage_buckets.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-08-10-detect_gcp_storage_access_from_a_new_ip.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-08-11-detect_arp_poisoning.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-08-11-detect_rogue_dhcp_server.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-08-21-abnormally_high_number_of_cloud_instances_launched.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-08-25-more_than_usual_number_of_lolbas_applications_in_short_time_period.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-08-25-system_process_running_from_unexpected_location.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md
fixing up base on feedback
2021-10-11 18:18:23 -04:00
2020-09-15-detect_dump_lsass_memory_using_comsvcs.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-09-15-detect_zerologon_via_zeek.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-09-16-create_or_delete_windows_shares_using_net_exe.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-09-18-detect_computer_changed_with_anonymous_account.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-10-06-unusually_long_command_line.md
fixing up base on feedback
2021-10-11 18:18:23 -04:00
2020-10-07-detect_aws_console_login_by_user_from_new_city.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-10-07-detect_aws_console_login_by_user_from_new_country.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-10-07-detect_aws_console_login_by_user_from_new_region.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-10-08-gcp_detect_gcploit_framework.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-10-12-system_information_discovery_detection.md
fixed bug with mitre mapping
2021-09-24 12:09:54 -04:00
2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-10-16-kerberoasting_spn_request_with_rc4_encryption.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-10-18-credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-10-18-credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-10-18-credential_extraction_indicative_of_lazagne_command_line_options.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-10-18-credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-10-18-credential_extraction_native_microsoft_debuggers_via_z_command_line_option.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-10-18-credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-10-21-credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-10-21-credential_extraction_indicative_of_use_of_dsinternals_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-10-21-credential_extraction_indicative_of_use_of_mimikatz_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-10-21-credential_extraction_indicative_of_use_of_powersploit_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-10-21-detect_kerberoasting.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-10-21-detect_pass_the_hash.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-10-21-detect_snicat_sni_exfiltration.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-10-28-detect_ipv6_network_infrastructure_threats.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-10-28-detect_port_security_violation.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-10-28-detect_software_download_to_network_device.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-10-28-detect_traffic_mirroring.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-03-applying_stolen_credentials_via_mimikatz_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-03-applying_stolen_credentials_via_powersploit_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-03-assessment_of_credential_strength_via_dsinternals_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-03-attempt_to_add_certificate_to_untrusted_store.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2020-11-03-reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-03-setting_credentials_via_dsinternals_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-03-setting_credentials_via_mimikatz_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-03-setting_credentials_via_powersploit_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-04-probing_access_with_stolen_credentials_via_powersploit_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-05-reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-05-reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-05-reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-05-reconnaissance_of_defensive_tools_via_powersploit_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-05-reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-05-reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-06-reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-06-reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-06-reconnaissance_and_access_to_computers_via_mimikatz_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-06-reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-06-reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-06-reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-06-reconnaissance_and_access_to_shared_resources_via_powersploit_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-06-reconnaissance_of_connectivity_via_powersploit_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-06-ryuk_test_files_detected.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-06-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-06-windows_security_account_manager_stopped.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-09-common_ransomware_extensions.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-09-common_ransomware_notes.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-09-deleting_shadow_copies.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-09-detect_excessive_account_lockouts_from_endpoint.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-09-illegal_access_to_user_content_via_powersploit_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-09-illegal_account_creation_via_powersploit_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-09-illegal_deletion_of_logs_via_mimikatz_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-09-illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-09-illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-09-illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-09-illegal_privilege_elevation_and_persistence_via_powersploit_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-09-illegal_privilege_elevation_via_mimikatz_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-09-illegal_service_and_process_control_via_mimikatz_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-09-illegal_service_and_process_control_via_powersploit_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-10-detect_psexec_with_accepteula_flag.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2020-11-18-disabling_remote_user_account_control.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-18-execution_of_file_with_multiple_extensions.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-20-malicious_powershell_process_-_connect_to_internet_with_hidden_window.md
removing conflict
2021-09-27 13:16:04 -04:00
2020-11-23-monitor_registry_keys_for_print_monitors.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-23-shim_database_installation_with_suspicious_parameters.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-26-registry_keys_for_creating_shim_databases.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-27-registry_keys_used_for_persistence.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2020-11-27-registry_keys_used_for_privilege_escalation.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-30-remote_process_instantiation_via_wmi.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-11-30-rundll_loading_dll_by_ordinal.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-12-07-schtasks_used_for_forcing_a_reboot.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-12-08-shim_database_file_creation.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-12-08-single_letter_process_on_endpoint.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-12-08-system_processes_run_from_unexpected_locations.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-12-08-unusually_long_command_line.md
fixing up base on feedback
2021-10-11 18:18:23 -04:00
2020-12-08-wmi_permanent_event_subscription_-_sysmon.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-12-14-sunburst_correlation_dll_and_network_event.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-12-15-o365_suspicious_rights_delegation.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-12-16-high_number_of_login_failures_from_a_single_source.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-12-16-o365_disable_mfa.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-12-16-o365_excessive_authentication_failures_alert.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-12-16-o365_pst_export_alert.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-12-16-o365_suspicious_admin_email_forwarding.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-12-16-o365_suspicious_user_email_forwarding.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-12-16-windows_adfind_exe.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-12-17-scheduled_task_deleted_or_created_via_cmd.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2020-12-21-bcdedit_failure_recovery_modification.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-2-1-first_time_seen_command_line_argument.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-01-06-supernova_webshell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-01-12-aws_network_access_control_list_deleted.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-01-12-suspicious_microsoft_workflow_compiler_rename.md
fixed bug with mitre mapping
2021-09-24 12:09:54 -04:00
2021-01-12-suspicious_microsoft_workflow_compiler_usage.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-01-12-suspicious_msbuild_path.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-01-12-suspicious_msbuild_rename.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-01-12-suspicious_msbuild_spawn.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-01-12-suspicious_mshta_child_process.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-01-20-detect_mshta_inline_hta_execution.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2021-01-20-detect_mshta_renamed.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2021-01-20-detect_mshta_url_in_command_line.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2021-01-20-detect_rundll32_inline_hta_execution.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-01-20-suspicious_mshta_spawn.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-01-22-wbadmin_delete_system_backups.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-01-25-nltest_domain_trust_discovery.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-01-26-aws_saml_access_by_provider_user_and_principal.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-01-26-aws_saml_update_identity_provider.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-01-26-certutil_exe_certificate_extraction.md
fixing up base on feedback
2021-10-11 18:18:23 -04:00
2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md
fixing up base on feedback
2021-10-11 18:18:23 -04:00
2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md
fixing up base on feedback
2021-10-11 18:18:23 -04:00
2021-01-26-o365_add_app_role_assignment_grant_user.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-01-26-o365_added_service_principal.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-01-26-o365_excessive_sso_logon_errors.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-01-26-o365_new_federated_domain_added.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-01-27-detect_baron_samedit_cve-2021-3156.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-01-28-detect_regsvr32_application_control_bypass.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-01-28-ntdsutil_export_ntds.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-01-28-suspicious_regsvr32_register_suspicious_path.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-02-01-dump_lsass_via_procdump_rename.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2021-02-01-dump_lsass_via_procdump.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-02-04-suspicious_rundll32_rename.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-02-04-suspicious_rundll32_startw.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-02-09-suspicious_rundll32_dllregisterserver.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-02-09-suspicious_rundll32_no_command_line_arguments.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2021-02-11-detect_html_help_renamed.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2021-02-11-detect_html_help_spawn_child_process.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-02-11-detect_html_help_url_in_command_line.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2021-02-11-detect_html_help_using_infotech_storage_handlers.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2021-02-12-detect_regasm_spawning_a_process.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-02-12-detect_regasm_with_no_command_line_arguments.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2021-02-12-detect_regsvcs_spawning_a_process.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-02-12-detect_regsvcs_with_no_command_line_arguments.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2021-02-16-detect_regasm_with_network_connection.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-02-16-detect_regsvcs_with_network_connection.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-02-22-aws_create_policy_version_to_allow_all_resources.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-02-22-cobalt_strike_named_pipes.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-02-22-suspicious_curl_network_connection.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-02-22-suspicious_plistbuddy_usage_via_osquery.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-02-22-suspicious_plistbuddy_usage.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-02-23-suspicious_dllhost_no_command_line_arguments.md
fixed bug with mitre mapping
2021-09-24 12:09:54 -04:00
2021-02-23-suspicious_gpupdate_no_command_line_arguments.md
fixed bug with mitre mapping
2021-09-24 12:09:54 -04:00
2021-02-23-suspicious_searchprotocolhost_no_command_line_arguments.md
fixed bug with mitre mapping
2021-09-24 12:09:54 -04:00
2021-03-01-any_powershell_downloadfile.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-01-any_powershell_downloadstring.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-01-eventvwr_uac_bypass.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-01-fodhelper_uac_bypass.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-01-ryuk_wake_on_lan_command.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-01-suspicious_scheduled_task_from_public_directory.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-02-aws_setdefaultpolicyversion.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-02-unified_messaging_service_spawning_a_process.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-02-windows_disableantispyware_registry.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-03-nishang_powershelltcponeline.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-03-w3wp_spawning_shell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-09-detect_exchange_web_shell.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2021-03-12-create_service_in_suspicious_file_path.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-12-ransomware_notes_bulk_creation.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-12-resize_shadowstorage_volume.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-16-high_file_deletion_frequency.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-16-high_process_termination_frequency.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-17-clop_common_exec_parameter.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-17-clop_ransomware_known_service_name.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-17-process_deleting_its_process_file_path.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-23-certutil_download_with_urlcache_and_split_arguments.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-23-certutil_download_with_verifyctl_and_split_arguments.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-23-certutil_with_decode_argument.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-26-bitsadmin_download_file.md
fixed bug with mitre mapping
2021-09-24 12:09:54 -04:00
2021-03-29-bits_job_persistence.md
fixed bug with mitre mapping
2021-09-24 12:09:54 -04:00
2021-03-29-powershell_start-bitstransfer.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-31-aws_iam_successful_group_deletion.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-31-disable_registry_tool.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-31-disable_show_hidden_files.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-31-disable_windows_behavior_monitoring.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-31-disable_windows_smartscreen_protection.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-31-disabling_cmd_application.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-31-disabling_controlpanel.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-31-disabling_firewall_with_netsh.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-31-disabling_folderoptions_windows_feature.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-31-disabling_norun_windows_app.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-31-disabling_systemrestore_in_registry.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-31-disabling_task_manager.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-03-31-dsquery_domain_discovery.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-01-aws_iam_assume_role_policy_brute_force.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-01-aws_iam_delete_policy.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-01-aws_iam_failure_group_deletion.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-05-aws_iam_accessdenied_discovery_events.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-07-malicious_powershell_executed_as_a_service.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-08-winevent_scheduled_task_created_within_public_path.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-12-excel_spawning_powershell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-12-excel_spawning_windows_script_host.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-12-winword_spawning_powershell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-12-winword_spawning_windows_script_host.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-13-aws_excessive_security_scanning.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-13-multiple_users_attempting_to_authenticate_using_explicit_credentials.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-13-multiple_users_failing_to_authenticate_from_process.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-13-office_application_spawn_rundll32_process.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-14-multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-14-multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-14-office_document_creating_schedule_task.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-14-office_document_executing_macro_code.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-15-dns_exfiltration_using_nslookup_app.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-19-dllhost_with_no_command_line_arguments_with_network.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-19-gpupdate_with_no_command_line_arguments_with_network.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-19-powershell_remote_thread_to_known_windows_process.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-19-rundll32_with_no_command_line_arguments_with_network.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-19-schedule_task_with_http_command_arguments.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-19-schedule_task_with_rundll32_command_trigger.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-19-searchprotocolhost_with_no_command_line_with_network.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-19-wermgr_process_create_executable_file.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-21-excessive_usage_of_nslookup_app.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-21-multiple_archive_files_http_post_traffic.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-22-anomalous_usage_of_7zip.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-22-office_product_spawning_rundll32_with_no_dll.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-22-plain_http_post_exfiltrated_data.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-22-winword_spawning_cmd.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-23-write_executable_in_smb_share.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-26-office_product_spawning_bitsadmin.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-26-office_product_spawning_certutil.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-26-office_product_spawning_mshta.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-26-office_product_spawning_wmic.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2021-04-26-trickbot_named_pipe.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-29-icacls_deny_command.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-29-suspicious_driver_loaded_path.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-04-29-xmrig_driver_loaded.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-03-account_discovery_with_net_app.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2021-05-04-deleting_of_net_users.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-04-disabling_net_user_account.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-04-excessive_attempt_to_disable_services.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-04-excessive_service_stop_attempt.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-04-excessive_usage_of_taskkill.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-04-icacls_grant_command.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-04-modify_acl_permission_to_files_or_folder.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-04-process_kill_base_on_file_path.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-05-disable_windows_app_hotkeys.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-05-hide_user_account_from_sign-in_screen.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-05-suspicious_process_file_path.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-06-download_files_using_telegram.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-06-enumerate_users_local_group_using_telegram.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-06-excessive_usage_of_net_app.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-06-executables_or_script_creation_in_suspicious_path.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-07-excessive_usage_of_cacls_app.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-07-schtasks_run_task_on_demand.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-12-delete_shadowcopy_with_powershell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-12-extract_sam_from_registry.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2021-05-13-cmlua_or_cmstplua_uac_bypass.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-13-detect_rclone_command-line_usage.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-13-detect_renamed_rclone.md
fixed bug with mitre mapping
2021-09-24 12:09:54 -04:00
2021-05-13-slui_runas_elevated.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-13-slui_spawning_a_process.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-18-services_escalate_exe.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-19-allow_inbound_traffic_in_firewall_rule.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-19-detect_renamed_7-zip.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2021-05-19-detect_renamed_psexec.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2021-05-19-detect_renamed_winrar.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2021-05-19-enable_rdp_in_other_port_number.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-19-mailsniper_invoke_functions.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-20-cmd_echo_pipe_-_escalation.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-20-rare_parent-child_process_relationship.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-21-winrm_spawning_a_process.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-26-allow_inbound_traffic_by_firewall_rule_registry.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-26-secretdumps_offline_ntds_dumping_tool.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-27-detect_sharphound_file_modifications.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-05-27-detect_sharphound_usage.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-01-detect_azurehound_command-line_arguments.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-01-detect_azurehound_file_modifications.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-01-detect_sharphound_command-line_arguments.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-02-conti_common_exec_parameter.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-02-modification_of_wallpaper.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-02-revil_common_exec_parameter.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-02-revil_registry_entry.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-02-wbemprox_com_object_execution.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-03-excessive_number_of_distinct_processes_created_in_windows_temp_folder.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-04-known_services_killed_by_ransomware.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-07-excessive_number_of_taskhost_processes.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-09-detect_empire_with_powershell_script_block_logging.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-09-unloading_amsi_via_reflection.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-10-allow_operation_with_consent_admin.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-10-clear_unallocated_sector_using_cipher_app.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-10-disable_logs_using_wevtutil.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-10-permission_modification_using_takeown_app.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-10-powershell_creating_thread_mutex.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-10-powershell_domain_enumeration.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-10-powershell_loading_dotnet_into_memory_via_system_reflection_assembly.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-10-powershell_processing_stream_of_data.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-10-powershell_using_memory_as_backing_store.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-10-recon_avproduct_through_pwh_or_wmi.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-10-recon_using_wmi_class.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-10-start_up_during_safe_mode_boot.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-14-deny_permission_using_cacls_utility.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-14-grant_permission_using_cacls_utility.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-14-wmi_recon_running_process_or_services.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-15-modify_acls_permission_of_files_or_folders.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-15-wevtutil_usage_to_clear_logs.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-15-wevtutil_usage_to_disable_logs.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-16-detect_wmi_event_subscription_persistence.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-17-suspicious_event_log_service_behavior.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-18-attempt_to_delete_services.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-18-attempt_to_disable_services.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-21-attacker_tools_on_endpoint.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-21-delete_a_net_user.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-21-disable_net_user_account.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-21-resize_shadowstorage_volume.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-22-disable_amsi_through_registry.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-22-disable_etw_through_registry.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-22-execute_javascript_with_jscript_com_clsid.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-22-powershell_enable_smb1protocol_feature.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-22-recursive_delete_of_directory_in_batch_cmd.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-23-allow_file_and_printing_sharing_in_firewall.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-23-allow_network_discovery_in_firewall.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-23-office_document_spawned_child_process_to_download.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2021-06-24-excessive_usage_of_sc_service_utility.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-06-25-excessive_number_of_service_control_start_as_disabled.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-01-print_spooler_adding_a_printer_driver.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-01-print_spooler_failed_to_load_a_plug-in.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-01-sdclt_uac_bypass.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-01-silentcleanup_uac_bypass.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-01-spoolsv_spawning_rundll32.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-01-spoolsv_suspicious_loaded_modules.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-01-spoolsv_suspicious_process_access.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-01-spoolsv_writing_a_dll_-_sysmon.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-01-spoolsv_writing_a_dll.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-01-wsreset_uac_bypass.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-05-msmpeng_application_dll_side_loading.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-05-powershell_disable_security_monitoring.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-12-net_profiler_uac_bypass.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-12-uac_bypass_mmc_load_unsigned_dll.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-19-aws_createaccesskey.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-19-aws_createloginprofile.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-19-aws_updateloginprofile.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-19-detect_new_open_s3_buckets.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-19-o365_bypass_mfa_via_trusted_ip.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-19-office_product_spawn_cmd_process.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-20-detect_shared_ec2_snapshot.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-21-dns_query_length_with_high_standard_deviation.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2021-07-23-sam_database_file_access_attempt.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-26-rundll32_createremotethread_in_browser.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-26-rundll32_dnsquery.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-26-rundll32_process_creating_exe_dll_files.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-26-suspicious_icedid_rundll32_cmdline.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-26-suspicious_rundll32_plugininit.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-27-chcp_command_execution.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-27-suspicious_icedid_regsvr32_cmdline.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-29-rundll32_create_remote_thread_to_a_process.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-30-drop_icedid_license_dat.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-30-icedid_exfiltrated_archived_file_creation.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-07-30-office_application_spawn_regsvr32_process.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-03-sqlite_module_in_temp_folder.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-04-create_remote_thread_in_shell_application.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-09-uninstall_app_using_msiexec.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-10-powershell_execute_com_object.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-11-fsutil_zeroing_file.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-13-uac_bypass_with_colorui_com_object.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-16-gsuite_drive_share_in_external_email.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-16-gsuite_email_suspicious_attachment.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-17-7zip_commandline_to_smb_share_path.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-17-aws_ecr_container_scanning_findings_high.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-17-aws_ecr_container_scanning_findings_medium.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-18-esentutl_sam_copy.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-18-powershell_4104_hunting.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-19-aws_ecr_container_upload_outside_business_hours.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-19-aws_ecr_container_upload_unknown_user.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-19-gsuite_email_suspicious_subject_with_attachment.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-19-protocols_passing_authentication_in_cleartext.md
fixing up base on feedback
2021-10-11 18:18:23 -04:00
2021-08-20-github_commit_changes_in_master.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-20-kubernetes_nginx_ingress_lfi.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-23-getlocaluser_with_powershell_script_block.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-23-getlocaluser_with_powershell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-23-getwmiobject_user_account_with_powershell_script_block.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-23-getwmiobject_user_account_with_powershell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-23-gsuite_email_with_known_abuse_web_service_link.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-23-gsuite_suspicious_shared_file_name.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-23-kubernetes_nginx_ingress_rfi.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-24-adsisearcher_account_discovery.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-24-domain_account_discovery_with_dsquery.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-24-domain_account_discovery_with_net_app.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-24-domain_account_discovery_with_wmic.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-24-get_aduser_with_powershell_script_block.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-24-get_aduser_with_powershell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-24-get_domainuser_with_powershell_script_block.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-24-get_domainuser_with_powershell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-24-get-domaintrust_with_powershell_script_block.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-24-get-domaintrust_with_powershell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-24-getwmiobject_ds_user_with_powershell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-24-kubernetes_scanner_image_pulling.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-25-domain_group_discovery_with_adsisearcher.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-25-domain_group_discovery_with_net.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-25-domain_group_discovery_with_wmic.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-25-elevated_group_discovery_with_net.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-25-elevated_group_discovery_with_powerview.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-25-elevated_group_discovery_with_wmic.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-25-getadgroup_with_powershell_script_block.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-25-getadgroup_with_powershell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-25-getdomaingroup_with_powershell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-25-getnettcpconnection_with_powershell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-25-getwmiobject_ds_group_with_powershell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-26-get_domainpolicy_with_powershell_script_block.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-26-get_domainpolicy_with_powershell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-26-getdomaingroup_with_powershell_script_block.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-26-password_policy_discovery_with_net.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-26-process_creating_lnk_file_in_suspicious_location.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-27-exchange_powershell_abuse_via_ssrf.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-27-exchange_powershell_module_usage.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-29-create_local_admin_accounts_using_net_exe.md
fixing product drill downs
2021-09-23 21:27:17 -04:00
2021-08-30-domain_controller_discovery_with_nltest.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-30-remote_system_discovery_with_net.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-31-petitpotam_network_share_access_request.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-08-31-remote_system_discovery_with_dsquery.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-01-circle_ci_disable_security_step.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-01-domain_controller_discovery_with_wmic.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-01-domain_group_discovery_with_dsquery.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-01-getadcomputer_with_powershell_script_block.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-01-github_commit_in_develop.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-01-github_dependabot_alert.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-01-github_pull_request_from_unknown_user.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-01-potential_pass_the_token_or_hash_observed_at_the_destination_device.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-01-potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-01-remote_system_discovery_with_adsisearcher.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-01-remote_system_discovery_with_wmic.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-02-circle_ci_disable_security_job.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-02-get-foresttrust_with_powershell_script_block.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-02-get-foresttrust_with_powershell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-02-getdomaincomputer_with_powershell_script_block.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-02-getdomaincontroller_with_powershell_script_block.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-06-add_defaultuser_and_password_in_registry.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-06-auto_admin_logon_registry_entry.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-06-bcdedit_command_back_to_normal_mode_boot.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-06-change_to_safe_mode_with_network_config.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-06-correlation_by_repository_and_risk.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-06-correlation_by_user_and_risk.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-07-getadcomputer_with_powershell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-07-getdomaincomputer_with_powershell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-07-getdomaincontroller_with_powershell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-07-getwmiobject_ds_computer_with_powershell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-07-registry_keys_used_for_persistence.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-07-system_information_discovery_detection.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-08-control_loading_from_world_writable_directory.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-08-create_local_admin_accounts_using_net_exe.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-08-office_spawning_control.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-08-rundll32_control_rundll_hunt.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-08-rundll32_control_rundll_world_writable_directory.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-09-extraction_of_registry_hives.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-09-mshtml_module_load_in_office_product.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-10-getnettcpconnection_with_powershell_script_block.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-10-network_connection_discovery_with_arp.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-10-network_connection_discovery_with_net.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-10-network_connection_discovery_with_netstat.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-10-office_product_writing_cab_or_inf.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-13-getcurrent_user_with_powershell_script_block.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-13-getcurrent_user_with_powershell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-13-jscript_execution_using_cscript_app.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-13-ms_scripting_process_loading_ldap_module.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-13-ms_scripting_process_loading_wmi_module.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-13-office_application_drop_executable.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-13-system_user_discovery_with_query.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-13-system_user_discovery_with_whoami.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-13-user_discovery_with_env_vars_powershell_script_block.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-13-user_discovery_with_env_vars_powershell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-13-xsl_script_execution_with_wmic.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-14-get_wmiobject_group_discovery.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-14-net_localgroup_discovery.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-14-powershell_get_localgroup_discovery.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-14-wmic_group_discovery.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-15-check_elevated_cmd_using_whoami.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-15-non_chrome_process_accessing_chrome_default_dir.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-15-non_firefox_process_access_firefox_profile_dir.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-16-account_discovery_with_net_app.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-16-attempt_to_add_certificate_to_untrusted_store.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-16-batch_file_write_to_system32.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-16-bits_job_persistence.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-16-bitsadmin_download_file.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-16-detect_html_help_renamed.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-16-detect_html_help_url_in_command_line.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-16-detect_html_help_using_infotech_storage_handlers.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-16-detect_mshta_inline_hta_execution.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-16-detect_mshta_renamed.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-16-detect_mshta_url_in_command_line.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-16-detect_psexec_with_accepteula_flag.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-16-detect_renamed_7-zip.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-16-detect_renamed_psexec.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-16-detect_renamed_rclone.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-16-detect_renamed_winrar.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-16-dump_lsass_via_procdump.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-16-local_account_discovery_with_net.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-16-local_account_discovery_with_wmic.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-16-office_product_spawning_wmic.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-16-processes_launching_netsh.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-20-detect_regasm_with_no_command_line_arguments.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-20-detect_regsvcs_with_no_command_line_arguments.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-20-office_document_spawned_child_process_to_download.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-20-suspicious_dllhost_no_command_line_arguments.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-20-suspicious_gpupdate_no_command_line_arguments.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-20-suspicious_microsoft_workflow_compiler_rename.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-20-suspicious_rundll32_no_command_line_arguments.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-20-suspicious_searchprotocolhost_no_command_line_arguments.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-21-remcos_rat_file_creation_in_remcos_folder.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-21-suspicious_image_creation_in_appdata_folder.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-21-suspicious_wav_file_in_appdata_folder.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-09-24-remcos_client_registry_install_entry.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-10-05-detect_exchange_web_shell.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-10-05-malicious_powershell_process_-_connect_to_internet_with_hidden_window.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-10-05-malicious_powershell_process_-_encoded_command.md
playbook skeleton
2021-10-12 19:41:23 -04:00
2021-10-06-dns_query_length_with_high_standard_deviation.md
playbook skeleton
2021-10-12 19:41:23 -04:00