Bhavin Patel 0f1b6189ab Merge branch 'develop' into gcp_account_takeover

2022-10-31 12:41:52 -07:00

..

abnormally_high_number_of_cloud_infrastructure_api_calls.yml

Refactored security content

2022-03-09 14:43:09 +01:00

abnormally_high_number_of_cloud_security_group_api_calls.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_console_login_failed_during_mfa_challenge.yml

yaml error

2022-10-03 17:11:20 -07:00

aws_create_policy_version_to_allow_all_resources.yml

Branch was auto-updated.

2022-05-18 15:51:07 -04:00

aws_createaccesskey.yml

Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.

2022-05-02 17:12:50 -07:00

aws_createloginprofile.yml

Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.

2022-05-02 17:12:50 -07:00

aws_credential_access_failed_login.yml

nnew detection and multiple searches

2022-09-26 16:25:49 -05:00

aws_credential_access_getpassworddata.yml

nnew detection and multiple searches

2022-09-26 16:25:49 -05:00

aws_credential_access_rds_password_reset.yml

nnew detection and multiple searches

2022-09-26 16:25:49 -05:00

aws_cross_account_activity_from_previously_unseen_account.yml

nnew detection and multiple searches

2022-09-26 16:25:49 -05:00

aws_defense_evasion_delete_cloudtrail.yml

Updates

2022-07-28 12:07:05 -06:00

aws_defense_evasion_delete_cloudwatch_log_group.yml

Updates

2022-07-28 12:07:05 -06:00

aws_defense_evasion_impair_security_services.yml

Updates

2022-07-28 12:07:05 -06:00

aws_defense_evasion_putbucketlifecycle.yml

Updates

2022-07-28 12:07:05 -06:00

aws_defense_evasion_stop_logging_cloudtrail.yml

Updates

2022-07-28 12:07:05 -06:00

aws_defense_evasion_update_cloudtrail.yml

Updates

2022-07-28 12:07:05 -06:00

aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_detect_users_with_kms_keys_performing_encryption_s3.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_ecr_container_scanning_findings_high.yml

Removed the field "user" from the stats

2022-06-21 15:45:00 -07:00

aws_ecr_container_scanning_findings_low_informational_unknown.yml

Updating the author(s), versions, and

2022-08-25 15:08:46 -07:00

aws_ecr_container_scanning_findings_medium.yml

Removed user from the stats call of this search

2022-06-21 16:25:20 -07:00

aws_ecr_container_upload_outside_business_hours.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_ecr_container_upload_unknown_user.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_excessive_security_scanning.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_iam_accessdenied_discovery_events.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_iam_assume_role_policy_brute_force.yml

Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.

2022-05-02 17:12:50 -07:00

aws_iam_delete_policy.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_iam_failure_group_deletion.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_iam_successful_group_deletion.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_lambda_updatefunctioncode.yml

updating docs and package bits [ci skip]

2022-03-03 18:22:29 +00:00

aws_multi_factor_authentication_disabled.yml

mfa_disabled

2022-10-04 11:50:03 -07:00

aws_multiple_failed_mfa_requests_for_user.yml

update datasets

2022-10-04 15:02:43 -07:00

aws_multiple_users_failing_to_authenticate_from_ip.yml

_time in the by clause

2022-10-19 14:45:10 -07:00

aws_network_access_control_list_created_with_all_open_ports.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_network_access_control_list_deleted.yml

Refactored security content

2022-03-09 14:43:09 +01:00

aws_saml_access_by_provider_user_and_principal.yml

Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.

2022-05-02 17:12:50 -07:00

aws_saml_update_identity_provider.yml

Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.

2022-05-02 17:12:50 -07:00

aws_setdefaultpolicyversion.yml

Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.

2022-05-02 17:12:50 -07:00

aws_successful_single_factor_authentication.yml

new SFA detection

2022-10-04 13:48:48 -07:00

aws_unusual_number_of_failed_authentications_from_ip.yml

_time in the by clause

2022-10-19 14:45:10 -07:00

aws_updateloginprofile.yml

Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.

2022-05-02 17:12:50 -07:00

azure_active_directory_high_risk_sign_in.yml

meta updates

2022-07-28 14:18:45 -07:00

azure_ad_authentication_failed_during_mfa_challenge.yml

Branch was auto-updated.

2022-09-14 09:17:49 -07:00

azure_ad_external_guest_user_invited.yml

minor fixes

2022-08-29 12:12:42 -04:00

azure_ad_global_administrator_role_assigned.yml

adding new detection

2022-08-29 17:00:05 -04:00

azure_ad_multi_factor_authentication_disabled.yml

minor changes on SPL

2022-09-27 15:31:24 -04:00

azure_ad_multiple_failed_mfa_requests_for_user.yml

fixing yaml issues

2022-10-17 11:44:39 -04:00

azure_ad_multiple_users_failing_to_authenticate_from_ip.yml

minor changes on SPL

2022-09-27 15:31:24 -04:00

azure_ad_new_custom_domain_added.yml

enhancing descriptions

2022-09-06 18:08:16 -04:00

azure_ad_new_federated_domain_added.yml

enhancing descriptions

2022-09-06 18:08:16 -04:00

azure_ad_privileged_role_assigned.yml

adding new detection

2022-08-29 17:00:05 -04:00

azure_ad_service_principal_created.yml

adding new detection

2022-08-29 17:00:05 -04:00

azure_ad_service_principal_new_client_credentials.yml

minor fixes

2022-08-29 12:12:42 -04:00

azure_ad_service_principal_owner_added.yml

adding new detection

2022-08-30 18:25:25 -04:00

azure_ad_successful_powershell_authentication.yml

adding new detection and fixing a few others

2022-08-18 14:50:16 -04:00

azure_ad_successful_single_factor_authentication.yml

adding 4 GCP account takeover detections

2022-10-14 15:03:54 -04:00

azure_ad_unusual_number_of_failed_authentications_from_ip.yml

minor changes on SPL

2022-09-27 15:31:24 -04:00

azure_ad_user_enabled_and_password_reset.yml

adding new detection

2022-08-30 13:07:41 -04:00

azure_ad_user_immutableid_attribute_updated.yml

enhancing descriptions

2022-09-06 18:08:16 -04:00

azure_automation_account_created.yml

minor fixes

2022-08-29 12:12:42 -04:00

azure_automation_runbook_created.yml

minor fixes

2022-08-29 12:12:42 -04:00

azure_runbook_webhook_created.yml

adding description. updating dataset url

2022-08-24 11:13:03 -04:00

circle_ci_disable_security_job.yml

Refactored security content

2022-03-09 14:43:09 +01:00

circle_ci_disable_security_step.yml

Refactored security content

2022-03-09 14:43:09 +01:00

cloud_api_calls_from_previously_unseen_user_roles.yml

Refactored security content

2022-03-09 14:43:09 +01:00

cloud_compute_instance_created_by_previously_unseen_user.yml

Refactored security content

2022-03-09 14:43:09 +01:00

cloud_compute_instance_created_in_previously_unused_region.yml

Refactored security content

2022-03-09 14:43:09 +01:00

cloud_compute_instance_created_with_previously_unseen_image.yml

Updated detection files with recommended TA list.

2022-08-01 18:43:39 +00:00

cloud_compute_instance_created_with_previously_unseen_instance_type.yml

Updated detection files with recommended TA list.

2022-08-01 18:43:39 +00:00

cloud_instance_modified_with_previously_unseen_user.yml

Refactored security content

2022-03-09 14:43:09 +01:00

cloud_provisioning_from_previously_unseen_city.yml

Refactored security content

2022-03-09 14:43:09 +01:00

cloud_provisioning_from_previously_unseen_country.yml

Refactored security content

2022-03-09 14:43:09 +01:00

cloud_provisioning_from_previously_unseen_ip_address.yml

Refactored security content

2022-03-09 14:43:09 +01:00

cloud_provisioning_from_previously_unseen_region.yml

Refactored security content

2022-03-09 14:43:09 +01:00

correlation_by_repository_and_risk.yml

Refactored security content

2022-03-09 14:43:09 +01:00

correlation_by_user_and_risk.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_aws_console_login_by_new_user.yml

nnew detection and multiple searches

2022-09-26 16:25:49 -05:00

detect_aws_console_login_by_user_from_new_city.yml

nnew detection and multiple searches

2022-09-26 16:25:49 -05:00

detect_aws_console_login_by_user_from_new_country.yml

nnew detection and multiple searches

2022-09-26 16:25:49 -05:00

detect_aws_console_login_by_user_from_new_region.yml

nnew detection and multiple searches

2022-09-26 16:25:49 -05:00

detect_new_open_s3_buckets_over_aws_cli.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_new_open_s3_buckets.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_shared_ec2_snapshot.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gcp_authentication_failed_during_mfa_challenge.yml

updating how to implement

2022-10-20 17:35:27 -04:00

gcp_multi_factor_authentication_disabled.yml

updating how to implement

2022-10-20 17:35:27 -04:00

gcp_multiple_failed_mfa_requests_for_user.yml

updating how to implement

2022-10-20 17:35:27 -04:00

gcp_multiple_users_failing_to_authenticate_from_ip.yml

updating how to implement

2022-10-20 17:35:27 -04:00

gcp_successful_single_factor_authentication.yml

asset type

2022-10-31 12:20:06 -07:00

gcp_unusual_number_of_failed_authentications_from_ip.yml

updating how to implement

2022-10-20 17:35:27 -04:00

github_actions_disable_security_workflow.yml

github actions detection

2022-04-04 11:08:39 +02:00

github_commit_changes_in_master.yml

improved GitHub detection

2022-04-04 13:23:37 +02:00

github_commit_in_develop.yml

Refactored security content

2022-03-09 14:43:09 +01:00

github_dependabot_alert.yml

Refactored security content

2022-03-09 14:43:09 +01:00

github_pull_request_from_unknown_user.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gsuite_drive_share_in_external_email.yml

adding insider threat, fixing minor display bug

2022-05-19 21:19:35 -04:00

gsuite_email_suspicious_attachment.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gsuite_email_suspicious_subject_with_attachment.yml

Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.

2022-05-02 17:12:50 -07:00

gsuite_email_with_known_abuse_web_service_link.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gsuite_outbound_email_with_attachment_to_external_domain.yml

adding insider threat, fixing minor display bug

2022-05-19 21:19:35 -04:00

gsuite_suspicious_shared_file_name.yml

Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.

2022-05-02 17:12:50 -07:00

kubernetes_nginx_ingress_lfi.yml

Refactored security content

2022-03-09 14:43:09 +01:00

kubernetes_nginx_ingress_rfi.yml

Updated a large number of the links in other detections. Also, adjusted the number of threads that run and tweaked the timeout time.

2022-05-03 10:34:10 -07:00

kubernetes_scanner_image_pulling.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_add_app_role_assignment_grant_user.yml

Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.

2022-05-02 17:12:50 -07:00

o365_added_service_principal.yml

Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.

2022-05-02 17:12:50 -07:00

o365_bypass_mfa_via_trusted_ip.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_disable_mfa.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_excessive_authentication_failures_alert.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_excessive_sso_logon_errors.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_new_federated_domain_added.yml

Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.

2022-05-02 17:12:50 -07:00

o365_pst_export_alert.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_suspicious_admin_email_forwarding.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_suspicious_rights_delegation.yml

Refactored security content

2022-03-09 14:43:09 +01:00

o365_suspicious_user_email_forwarding.yml

Refactored security content

2022-03-09 14:43:09 +01:00