srv-rr-gh-researchbt a1a023c28c Branch was auto-updated.

2023-03-06 10:54:19 -08:00

..

7zip_commandline_to_smb_share_path.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

access_lsass_memory_for_dump_creation.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

account_discovery_with_net_app.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

active_setup_registry_autostart.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

add_defaultuser_and_password_in_registry.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

add_or_set_windows_defender_exclusion.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

adsisearcher_account_discovery.test.yml

search updates and datasets

2022-09-13 17:37:24 -05:00

allow_file_and_printing_sharing_in_firewall.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

allow_inbound_traffic_by_firewall_rule_registry.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

allow_inbound_traffic_in_firewall_rule.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

allow_network_discovery_in_firewall.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

allow_operation_with_consent_admin.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

anomalous_usage_of_7zip.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

any_powershell_downloadfile.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

any_powershell_downloadstring.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

attacker_tools_on_endpoint.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

attempt_to_add_certificate_to_untrusted_store.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

attempt_to_stop_security_service.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

attempted_credential_dump_from_registry_via_reg_exe.test.yml

add crowdstrike data to detection

2022-07-20 12:36:41 +02:00

auto_admin_logon_registry_entry.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

batch_file_write_to_system32.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

bcdedit_command_back_to_normal_mode_boot.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

bcdedit_failure_recovery_modification.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

bits_job_persistence.test.yml

add crowdstrike data

2022-07-26 09:51:16 +02:00

bitsadmin_download_file.test.yml

Wrong dataset file specified in the test file for bitsadmin_download_file.test.yml

2022-09-13 16:41:29 -07:00

certutil_download_with_urlcache_and_split_arguments.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

certutil_download_with_verifyctl_and_split_arguments.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

certutil_exe_certificate_extraction.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

certutil_with_decode_argument.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

change_default_file_association.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

change_to_safe_mode_with_network_config.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

chcp_command_execution.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

check_elevated_cmd_using_whoami.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

clear_unallocated_sector_using_cipher_app.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

clop_common_exec_parameter.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

clop_ransomware_known_service_name.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

cmd_carry_out_string_command_parameter.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

cmd_echo_pipe___escalation.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

cmdline_tool_not_executed_in_cmd_shell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

cmlua_or_cmstplua_uac_bypass.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

cobalt_strike_named_pipes.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

common_ransomware_extensions.test.yml

notes

2022-11-10 15:03:22 -07:00

common_ransomware_notes.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

conti_common_exec_parameter.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

control_loading_from_world_writable_directory.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

create_local_admin_accounts_using_net_exe.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

create_or_delete_windows_shares_using_net_exe.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

create_remote_thread_in_shell_application.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

create_remote_thread_into_lsass.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

creation_of_lsass_dump_with_taskmgr.test.yml

updated name of another test

2022-11-11 11:39:29 -08:00

creation_of_shadow_copy_with_wmic_and_powershell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

creation_of_shadow_copy.test.yml

Path to wrong data files in creation_of_shadow_copy detection. This caused a CI failure because the proper events were not being replayed.

2022-09-13 15:48:46 -07:00

credential_dumping_via_copy_command_from_shadow_copy.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

credential_dumping_via_symlink_to_shadow_copy.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

csc_net_on_the_fly_compilation.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

curl_download_and_bash_execution.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

delete_shadowcopy_with_powershell.test.yml

Updating other spellings of

2022-06-27 16:27:32 -07:00

deleting_of_net_users.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

deleting_shadow_copies.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_activity_related_to_pass_the_hash_attacks.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_azurehound_command_line_arguments.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_azurehound_file_modifications.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_copy_of_shadowcopy_with_script_block_logging.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_credential_dumping_through_lsass_access.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_empire_with_powershell_script_block_logging.test.yml

fixes

2022-06-29 11:45:21 -06:00

detect_excessive_account_lockouts_from_endpoint.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_excessive_user_account_lockouts.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_exchange_web_shell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_html_help_renamed.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_html_help_spawn_child_process.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_html_help_url_in_command_line.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_html_help_using_infotech_storage_handlers.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_mimikatz_using_loaded_images.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_mimikatz_with_powershell_script_block_logging.test.yml

Updating other spellings of

2022-06-27 16:27:32 -07:00

detect_mshta_inline_hta_execution.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_mshta_renamed.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_mshta_url_in_command_line.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_new_local_admin_account.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_path_interception_by_creation_of_program_exe.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_processes_used_for_system_network_configuration_discovery.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_prohibited_applications_spawning_cmd_exe.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_psexec_with_accepteula_flag.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_rclone_command_line_usage.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_regasm_spawning_a_process.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_regasm_with_network_connection.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_regasm_with_no_command_line_arguments.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_regsvcs_spawning_a_process.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_regsvcs_with_network_connection.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_regsvcs_with_no_command_line_arguments.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_regsvr32_application_control_bypass.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_renamed_7_zip.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_renamed_psexec.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_renamed_rclone.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_renamed_winrar.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_rundll32_application_control_bypass___advpack.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_rundll32_application_control_bypass___setupapi.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_rundll32_application_control_bypass___syssetup.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_rundll32_inline_hta_execution.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_sharphound_command_line_arguments.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_sharphound_file_modifications.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_sharphound_usage.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_use_of_cmd_exe_to_launch_script_interpreters.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_wmi_event_subscription_persistence.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

disable_amsi_through_registry.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

disable_defender_antivirus_registry.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

disable_defender_blockatfirstseen_feature.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

disable_defender_enhanced_notification.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

disable_defender_mpengine_registry.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

disable_defender_spynet_reporting.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

disable_defender_submit_samples_consent_feature.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

disable_etw_through_registry.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

disable_logs_using_wevtutil.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

disable_registry_tool.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

disable_schedule_task.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

disable_security_logs_using_minint_registry.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

disable_show_hidden_files.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

disable_uac_remote_restriction.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

disable_windows_app_hotkeys.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

disable_windows_behavior_monitoring.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

disable_windows_smartscreen_protection.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

disabled_kerberos_pre_authentication_discovery_with_get_aduser.test.yml

Updating other spellings of

2022-06-27 16:27:32 -07:00

disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml

fixes

2022-06-29 11:45:21 -06:00

disabling_cmd_application.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

disabling_controlpanel.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

disabling_defender_services.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

disabling_firewall_with_netsh.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

disabling_folderoptions_windows_feature.test.yml

Updating other spellings of

2022-06-27 16:27:32 -07:00

disabling_net_user_account.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

disabling_norun_windows_app.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

disabling_remote_user_account_control.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

disabling_systemrestore_in_registry.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

disabling_task_manager.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

disabling_windows_local_security_authority_defences_via_registry.test.yml

Adding Detection for Disabling LSA defences via Reg

2022-09-10 15:16:37 +10:00

dns_exfiltration_using_nslookup_app.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

domain_account_discovery_with_dsquery.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

domain_account_discovery_with_net_app.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

domain_account_discovery_with_wmic.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

domain_controller_discovery_with_nltest.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

domain_controller_discovery_with_wmic.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

domain_group_discovery_with_adsisearcher.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

domain_group_discovery_with_dsquery.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

domain_group_discovery_with_net.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

domain_group_discovery_with_wmic.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

download_files_using_telegram.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

drop_icedid_license_dat.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

dsquery_domain_discovery.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

dump_lsass_via_comsvcs_dll.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

dump_lsass_via_procdump.test.yml

add crowdstrike data

2022-07-27 12:59:12 +02:00

elevated_group_discovery_with_net.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

elevated_group_discovery_with_powerview.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

elevated_group_discovery_with_wmic.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

enable_rdp_in_other_port_number.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

enable_wdigest_uselogoncredential_registry.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

enumerate_users_local_group_using_telegram.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

esentutl_sam_copy.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

etw_registry_disabled.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

eventvwr_uac_bypass.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

excel_spawning_powershell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

excel_spawning_windows_script_host.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

excessive_attempt_to_disable_services.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

excessive_distinct_processes_from_windows_temp.test.yml

all the changes again

2022-03-16 13:35:48 -07:00

excessive_file_deletion_in_windefender_folder.test.yml

WhisperGateIsOpen

2022-01-21 10:45:00 +01:00

excessive_number_of_service_control_start_as_disabled.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

excessive_number_of_taskhost_processes.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

excessive_service_stop_attempt.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

excessive_usage_of_cacls_app.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

excessive_usage_of_net_app.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

excessive_usage_of_nslookup_app.test.yml

detection-fix-due-to-splunk-time

2022-06-03 16:30:32 +02:00

excessive_usage_of_sc_service_utility.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

excessive_usage_of_taskkill.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

exchange_powershell_module_usage.test.yml

Updates + new

2022-10-05 10:20:07 -06:00

executable_file_written_in_administrative_smb_share.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

executables_or_script_creation_in_suspicious_path.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

execute_javascript_with_jscript_com_clsid.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

execution_of_file_with_multiple_extensions.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

extraction_of_registry_hives.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

file_with_samsam_extension.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

firewall_allowed_program_enable.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

fodhelper_uac_bypass.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

fsutil_zeroing_file.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml

Updating other spellings of

2022-06-27 16:27:32 -07:00

get_addefaultdomainpasswordpolicy_with_powershell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

get_aduser_with_powershell_script_block.test.yml

adding datasets

2022-09-13 15:33:46 -05:00

get_aduser_with_powershell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml

Updating other spellings of

2022-06-27 16:27:32 -07:00

get_aduserresultantpasswordpolicy_with_powershell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

get_domainpolicy_with_powershell_script_block.test.yml

fixes

2022-06-29 11:45:21 -06:00

get_domainpolicy_with_powershell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

get_domaintrust_with_powershell_script_block.test.yml

fixes

2022-06-29 11:45:21 -06:00

get_domaintrust_with_powershell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

get_domainuser_with_powershell_script_block.test.yml

Updating other spellings of

2022-06-27 16:27:32 -07:00

get_domainuser_with_powershell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

get_foresttrust_with_powershell_script_block.test.yml

Updating other spellings of

2022-06-27 16:27:32 -07:00

get_foresttrust_with_powershell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

get_wmiobject_group_discovery_with_script_block_logging.test.yml

pwh_xml

2022-03-23 10:59:43 +01:00

get_wmiobject_group_discovery.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

getadcomputer_with_powershell_script_block.test.yml

Updating other spellings of

2022-06-27 16:27:32 -07:00

getadcomputer_with_powershell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

getadgroup_with_powershell_script_block.test.yml

pwh_xml

2022-03-23 10:59:43 +01:00

getadgroup_with_powershell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

getcurrent_user_with_powershell_script_block.test.yml

pwh_xml

2022-03-23 10:59:43 +01:00

getcurrent_user_with_powershell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

getdomaincomputer_with_powershell_script_block.test.yml

Updating other spellings of

2022-06-27 16:27:32 -07:00

getdomaincomputer_with_powershell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

getdomaincontroller_with_powershell_script_block.test.yml

fixes2

2022-06-29 12:57:59 -06:00

getdomaincontroller_with_powershell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

getdomaingroup_with_powershell_script_block.test.yml

fixes

2022-06-29 11:45:21 -06:00

getdomaingroup_with_powershell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

getlocaluser_with_powershell_script_block.test.yml

Updating other spellings of

2022-06-27 16:27:32 -07:00

getlocaluser_with_powershell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

getnettcpconnection_with_powershell_script_block.test.yml

fixes

2022-06-29 11:45:21 -06:00

getnettcpconnection_with_powershell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

getwmiobject_ds_computer_with_powershell_script_block.test.yml

Updating other spellings of

2022-06-27 16:27:32 -07:00

getwmiobject_ds_computer_with_powershell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

getwmiobject_ds_group_with_powershell_script_block.test.yml

Updating other spellings of

2022-06-27 16:27:32 -07:00

getwmiobject_ds_group_with_powershell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

getwmiobject_ds_user_with_powershell_script_block.test.yml

Updating other spellings of

2022-06-27 16:27:32 -07:00

getwmiobject_ds_user_with_powershell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

getwmiobject_user_account_with_powershell_script_block.test.yml

Updating other spellings of

2022-06-27 16:27:32 -07:00

getwmiobject_user_account_with_powershell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

gpupdate_with_no_command_line_arguments_with_network.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

hide_user_account_from_sign_in_screen.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

hiding_files_and_directories_with_attrib_exe.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

high_frequency_copy_of_files_in_network_share.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

high_process_termination_frequency.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

hunting_for_log4shell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

icacls_deny_command.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

icacls_grant_command.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

icedid_exfiltrated_archived_file_creation.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

impacket_lateral_movement_commandline_parameters.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

interactive_session_on_remote_endpoint_with_powershell.test.yml

pwh_xml

2022-03-23 10:59:43 +01:00

java_class_file_download_by_java_user_agent.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

java_writing_jsp_file.test.yml

rename

2022-04-06 08:39:34 -06:00

jscript_execution_using_cscript_app.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

kerberoasting_spn_request_with_rc4_encryption.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.test.yml

remove and replace test

2022-03-30 14:37:18 +02:00

kerberos_pre_authentication_flag_disabled_with_powershell.test.yml

remove and replace test

2022-03-30 14:37:18 +02:00

kerberos_service_ticket_request_using_rc4_encryption.test.yml

updating test file

2022-03-15 16:41:59 -04:00

kerberos_tgt_request_using_rc4_encryption.test.yml

adding hew detection for over pass the hash technique

2022-03-08 14:41:37 -05:00

kerberos_user_enumeration.test.yml

adding new detection for Kerberos user enumeration

2022-03-11 11:11:18 -05:00

known_services_killed_by_ransomware.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

linux_account_manipulation_of_ssh_config_and_keys.test.yml

rename-ssh-detections

2022-05-17 15:52:19 +02:00

linux_add_files_in_known_crontab_directories.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

linux_add_user_account.test.yml

linux_persist_priv_batch_4

2022-01-10 12:51:04 +01:00

linux_adding_crontab_using_list_parameter.test.yml

industroyer2_PR2

2022-04-26 10:06:53 +02:00

linux_apt_get_privilege_escalation.test.yml

Add 12 More detections (T1548)

2022-08-12 07:27:16 -04:00

linux_apt_privilege_escalation.test.yml

Add 12 More detections (T1548)

2022-08-12 07:27:16 -04:00

linux_at_allow_config_file_creation.test.yml

Fixing a link to a dataset that has been moved.

2022-06-21 13:13:50 -07:00

linux_at_application_execution.test.yml

updating mitre ids and other metadata

2022-05-26 13:39:49 -07:00

linux_awk_privilege_escalation.test.yml

Add detections for Awk, Node, Docker Lotl

2022-08-02 16:23:31 -04:00

linux_busybox_privilege_escalation.test.yml

Add 12 More detections (T1548)

2022-08-12 07:27:16 -04:00

linux_c89_privilege_escalation.test.yml

Add 12 More detections (T1548)

2022-08-12 07:27:16 -04:00

linux_c99_privilege_escalation.test.yml

Add 12 More detections (T1548)

2022-08-12 07:27:16 -04:00

linux_change_file_owner_to_root.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

linux_clipboard_data_copy.test.yml

clipboard

2022-07-28 11:27:19 -06:00

linux_common_process_for_elevation_control.test.yml

linux_persist_priv_batch_4

2022-01-10 12:51:04 +01:00

linux_composer_privilege_escalation.test.yml

Add 12 More detections (T1548)

2022-08-12 07:27:16 -04:00

linux_cpulimit_privilege_escalation.test.yml

Add 12 More detections (T1548)

2022-08-12 07:27:16 -04:00

linux_csvtool_privilege_escalation.test.yml

Add 12 More detections (T1548)

2022-08-12 07:27:16 -04:00

linux_curl_upload_file.test.yml

Haag It

2022-07-29 11:17:19 -06:00

linux_data_destruction_command.test.yml

awfulshred

2023-02-08 15:28:32 +01:00

linux_dd_file_overwrite.test.yml

linux_lolbin_stage1

2022-02-15 10:55:01 +01:00

linux_decode_base64_to_shell.test.yml

linux base64 decode

2022-07-27 15:08:05 -06:00

linux_deleting_critical_directory_using_rm_command.test.yml

industroyer2_PR2

2022-04-26 12:01:00 +02:00

linux_deletion_of_cron_jobs.test.yml

acidrain

2022-04-12 11:20:43 +02:00

linux_deletion_of_init_daemon_script.test.yml

acidrain

2022-04-12 12:01:17 +02:00

linux_deletion_of_services.test.yml

acidrain

2022-04-12 12:01:17 +02:00

linux_deletion_of_ssl_certificate.test.yml

acidrain

2022-04-13 09:34:11 +02:00

linux_disable_services.test.yml

industroyer2_PR2

2022-04-26 10:06:53 +02:00

linux_doas_conf_file_creation.test.yml

linux_persist_priv_batch_4

2022-01-10 12:51:04 +01:00

linux_doas_tool_execution.test.yml

linux_persist_priv_batch_4

2022-01-10 12:51:04 +01:00

linux_docker_privilege_escalation.test.yml

Add detections for Awk, Node, Docker Lotl

2022-08-02 16:23:31 -04:00

linux_edit_cron_table_parameter.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

linux_emacs_privilege_escalation.test.yml

Add T1548.003

2022-08-10 06:58:54 -04:00

linux_file_created_in_kernel_driver_directory.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

linux_file_creation_in_init_boot_directory.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

linux_file_creation_in_profile_directory.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

linux_find_privilege_escalation.test.yml

Add T1548.003

2022-08-10 06:58:54 -04:00

linux_gdb_privilege_escalation.test.yml

Add T1548.003

2022-08-10 06:58:54 -04:00

linux_gem_privilege_escalation.test.yml

Add T1548.003

2022-08-10 06:58:54 -04:00

linux_gnu_awk_privilege_escalation.test.yml

Add T1548.003

2022-08-10 06:58:54 -04:00

linux_hardware_addition_swapoff.test.yml

awfulshred

2023-02-14 10:43:41 +01:00

linux_high_frequency_of_file_deletion_in_boot_folder.test.yml

industroyer2_PR2

2022-04-27 10:53:15 +02:00

linux_high_frequency_of_file_deletion_in_etc_folder.test.yml

acidrain

2022-04-12 14:34:36 +02:00

linux_impair_defenses_process_kill.test.yml

awfulshred

2023-02-14 10:43:41 +01:00

linux_indicator_removal_clear_cache.test.yml

awfulshred

2023-02-10 13:22:40 +01:00

linux_indicator_removal_service_file_deletion.test.yml

awfulshred

2023-02-14 10:43:41 +01:00

linux_ingress_tool_transfer_hunting.test.yml

Haag It

2022-07-29 11:17:19 -06:00

linux_ingress_tool_transfer_with_curl.test.yml

Updating the names of more tests in

2022-11-11 11:48:47 -08:00

linux_insert_kernel_module_using_insmod_utility.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

linux_install_kernel_module_using_modprobe_utility.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

linux_iptables_firewall_modification.test.yml

cyclopsblink

2022-04-07 14:53:59 +02:00

linux_java_spawning_shell.test.yml

It's Raining Haags

2021-12-15 13:01:04 -07:00

linux_kernel_module_enumeration.test.yml

Update linux_kernel_module_enumeration.test.yml

2022-09-02 18:50:48 -04:00

linux_kworker_process_in_writable_process_path.test.yml

Update linux_kworker_process_in_writable_process_path.test.yml

2022-04-29 15:39:41 +02:00

linux_make_privilege_escalation.test.yml

Add T1548.003

2022-08-10 06:58:54 -04:00

linux_mysql_privilege_escalation.test.yml

Add T1548.003

2022-08-10 06:58:54 -04:00

linux_ngrok_reverse_proxy_usage.test.yml

Linux Ngrok

2023-01-12 13:39:06 -07:00

linux_node_privilege_escalation.test.yml

Add detections for Awk, Node, Docker Lotl

2022-08-02 16:23:31 -04:00

linux_nopasswd_entry_in_sudoers_file.test.yml

linux_persist_priv_batch_5

2022-01-11 11:57:38 +01:00

linux_obfuscated_files_or_information_base64_decode.test.yml

linux base64 decode

2022-07-27 15:08:05 -06:00

linux_octave_privilege_escalation.test.yml

Add 12 More detections (T1548)

2022-08-12 07:27:16 -04:00

linux_openvpn_privilege_escalation.test.yml

Add 12 More detections (T1548)

2022-08-12 07:27:16 -04:00

linux_persistence_and_privilege_escalation_risk_behavior.test.yml

Linux Correlation

2022-07-21 10:31:52 -06:00

linux_php_privilege_escalation.test.yml

Add T1548.003

2022-08-10 06:58:54 -04:00

linux_pkexec_privilege_escalation.test.yml

pkexec

2022-02-01 09:52:52 -07:00

linux_possible_access_or_modification_of_sshd_config_file.test.yml

linux_persist_priv_batch_5

2022-01-13 18:11:17 +01:00

linux_possible_access_to_credential_files.test.yml

linux_persist_priv_batch_4

2022-01-10 12:51:04 +01:00

linux_possible_access_to_sudoers_file.test.yml

linux_persist_priv_batch_4

2022-01-10 12:51:04 +01:00

linux_possible_append_command_to_at_allow_config_file.test.yml

updating mitre ids and other metadata

2022-05-26 13:39:49 -07:00

linux_possible_append_command_to_profile_config_file.test.yml

linux_persist_priv_batch_5

2022-01-11 11:57:38 +01:00

linux_possible_append_cronjob_entry_on_existing_cronjob_file.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

linux_possible_cronjob_modification_with_editor.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

linux_possible_ssh_key_file_creation.test.yml

linux_persist_priv_batch_5

2022-01-12 09:12:43 +01:00

linux_preload_hijack_library_calls.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

linux_proxy_socks_curl.test.yml

Haag It

2022-07-29 11:17:19 -06:00

linux_puppet_privilege_escalation.test.yml

Add 12 More detections (T1548)

2022-08-12 07:27:16 -04:00

linux_rpm_privilege_escalation.test.yml

Add T1548.003

2022-08-10 06:58:54 -04:00

linux_ruby_privilege_escalation.test.yml

Add T1548.003

2022-08-10 06:58:54 -04:00

linux_service_file_created_in_systemd_directory.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

linux_service_restarted.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

linux_service_started_or_enabled.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

linux_setuid_using_chmod_utility.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

linux_setuid_using_setcap_utility.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

linux_shred_overwrite_command.test.yml

industroyer2_PR2

2022-04-26 12:01:00 +02:00

linux_sqlite3_privilege_escalation.test.yml

Add 12 More detections (T1548)

2022-08-12 07:27:16 -04:00

linux_ssh_authorized_keys_modification.test.yml

auth key

2022-07-27 15:30:48 -06:00

linux_ssh_remote_services_script_execute.test.yml

ssh and updated correlation

2022-07-27 16:25:56 -06:00

linux_stop_services.test.yml

industroyer2_PR2

2022-04-26 10:06:53 +02:00

linux_sudo_or_su_execution.test.yml

linux_persist_priv_batch_4

2022-01-10 12:51:04 +01:00

linux_sudoers_tmp_file_creation.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

linux_system_network_discovery.test.yml

linux_lolbin_stage1

2022-02-14 10:17:46 +01:00

linux_system_reboot_via_system_request_key.test.yml

awfulshred

2023-02-09 15:25:14 +01:00

linux_unix_shell_enable_all_sysrq_functions.test.yml

awfulshred

2023-02-09 15:25:14 +01:00

linux_visudo_utility_execution.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

living_off_the_land.test.yml

LOTL

2022-07-13 15:51:47 -06:00

loading_of_dynwrapx_module.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

local_account_discovery_with_net.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

local_account_discovery_with_wmic.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

log4shell_cve_2021_44228_exploitation.test.yml

fixing path

2022-01-27 15:57:21 -05:00

logon_script_event_trigger_execution.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

lolbas_with_network_traffic.test.yml

adding new detection from community

2023-02-02 16:40:32 -08:00

macos_lolbin.test.yml

Updating two incorrectly named tests.

2022-03-18 14:01:31 -07:00

macos_plutil.test.yml

updating mitre ids and other metadata

2022-05-26 13:39:49 -07:00

mailsniper_invoke_functions.test.yml

Updating other spellings of

2022-06-27 16:27:32 -07:00

malicious_inprocserver32_modification.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

malicious_powershell_executed_as_a_service.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

malicious_powershell_process___encoded_command.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

malicious_powershell_process___execution_policy_bypass.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

malicious_powershell_process_with_obfuscation_techniques.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

mimikatz_passtheticket_commandline_parameters.test.yml

adding analytic story and three new detections

2022-02-07 18:52:34 -05:00

mmc_exe_lolbas_execution_process_spawn.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

modification_of_wallpaper.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

modify_acl_permission_to_files_or_folder.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

monitor_registry_keys_for_print_monitors.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

ms_scripting_process_loading_ldap_module.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

ms_scripting_process_loading_wmi_module.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

msbuild_suspicious_spawned_by_script_process.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

mshta_spawning_rundll32_or_regsvr32_process.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

mshtml_module_load_in_office_product.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

msi_module_loaded_by_non_system_binary.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

msmpeng_application_dll_side_loading.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

net_localgroup_discovery.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

net_profiler_uac_bypass.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

network_connection_discovery_arp.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

network_connection_discovery_net.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

network_connection_discovery_netstat.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

network_discovery_using_route_windows_app.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

nishang_powershelltcponeline.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

nltest_domain_trust_discovery.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

non_chrome_process_accessing_chrome_default_dir.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

non_firefox_process_access_firefox_profile_dir.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

notepad_with_no_command_line_arguments.test.yml

fixes

2023-02-24 12:24:55 -07:00

ntdsutil_export_ntds.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

office_application_drop_executable.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

office_application_spawn_regsvr32_process.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

office_application_spawn_rundll32_process.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

office_document_creating_schedule_task.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

office_document_executing_macro_code.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

office_document_spawned_child_process_to_download.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

office_product_spawn_cmd_process.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

office_product_spawning_bitsadmin.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

office_product_spawning_certutil.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

office_product_spawning_mshta.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

office_product_spawning_rundll32_with_no_dll.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

office_product_spawning_windows_script_host.test.yml

data fix

2022-09-27 09:55:53 -06:00

office_product_spawning_wmic.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

office_product_writing_cab_or_inf.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

office_spawning_control.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

outbound_network_connection_from_java_using_default_ports.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

overwriting_accessibility_binaries.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

password_policy_discovery_with_net.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

permission_modification_using_takeown_app.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

petitpotam_network_share_access_request.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

petitpotam_suspicious_kerberos_tgt_request.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

ping_sleep_batch_command.test.yml

WhisperGateIsOpen

2022-01-20 15:11:12 +01:00

possible_browser_pass_view_parameter.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

possible_lateral_movement_powershell_spawn.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

potential_password_in_username.test.yml

adding files from PR 2194

2022-05-27 14:35:43 -07:00

potentially_malicious_code_on_commandline.test.yml

Changing the test dataset to the main branch

2022-01-20 21:09:22 -05:00

powershell_4104_hunting.test.yml

Updating other spellings of

2022-06-27 16:27:32 -07:00

powershell___connect_to_internet_with_hidden_window.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

powershell_com_hijacking_inprocserver32_modification.test.yml

New content

2022-09-26 13:00:17 -06:00

powershell_creating_thread_mutex.test.yml

Updating other spellings of

2022-06-27 16:27:32 -07:00

powershell_disable_security_monitoring.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

powershell_domain_enumeration.test.yml

fixes

2022-06-29 11:45:21 -06:00

powershell_enable_smb1protocol_feature.test.yml

Updating other spellings of

2022-06-27 16:27:32 -07:00

powershell_execute_com_object.test.yml

pwh_xml_2

2022-03-30 13:58:23 +02:00

powershell_fileless_process_injection_via_getprocaddress.test.yml

Updating other spellings of

2022-06-27 16:27:32 -07:00

powershell_fileless_script_contains_base64_encoded_content.test.yml

Updating other spellings of

2022-06-27 16:27:32 -07:00

powershell_get_localgroup_discovery_with_script_block_logging.test.yml

fixes

2022-06-29 11:45:21 -06:00

powershell_get_localgroup_discovery.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

powershell_load_module_in_meterpreter.test.yml

load kiwi meterpreter

2022-11-22 11:10:30 -07:00

powershell_loading_dotnet_into_memory_via_reflection.test.yml

reflection

2022-06-29 10:35:44 -06:00

powershell_processing_stream_of_data.test.yml

streamreader

2022-06-29 10:00:23 -06:00

powershell_remote_thread_to_known_windows_process.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

powershell_remove_windows_defender_directory.test.yml

Updating other spellings of

2022-06-27 16:27:32 -07:00

powershell_start_bitstransfer.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

powershell_using_memory_as_backing_store.test.yml

pwh_xml_2

2022-03-30 16:18:05 +02:00

powershell_windows_defender_exclusion_commands.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

prevent_automatic_repair_mode_using_bcdedit.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

print_spooler_adding_a_printer_driver.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

print_spooler_failed_to_load_a_plug_in.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

process_creating_lnk_file_in_suspicious_location.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

process_deleting_its_process_file_path.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

process_execution_via_wmi.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

process_kill_base_on_file_path.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

process_writing_dynamicwrapperx.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

processes_launching_netsh.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

ransomware_notes_bulk_creation.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

recon_avproduct_through_pwh_or_wmi.test.yml

Update recon_avproduct_through_pwh_or_wmi.test.yml

2022-03-30 15:35:39 +02:00

recon_using_wmi_class.test.yml

Updating other spellings of

2022-06-27 16:27:32 -07:00

recursive_delete_of_directory_in_batch_cmd.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

reg_exe_manipulating_windows_services_registry_keys.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

registry_keys_for_creating_shim_databases.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

registry_keys_used_for_persistence.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

registry_keys_used_for_privilege_escalation.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

regsvr32_silent_and_install_param_dll_loading.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

regsvr32_with_known_silent_switch_cmdline.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

remcos_client_registry_install_entry.test.yml

add_story_and_minor_fix

2022-03-21 09:24:42 +01:00

remcos_rat_file_creation_in_remcos_folder.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

remote_process_instantiation_via_dcom_and_powershell_script_block.test.yml

pwh_xml_2

2022-03-31 10:51:00 +02:00

remote_process_instantiation_via_dcom_and_powershell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

remote_process_instantiation_via_winrm_and_powershell_script_block.test.yml

conflicts

2022-05-06 13:06:37 -07:00

remote_process_instantiation_via_winrm_and_powershell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

remote_process_instantiation_via_winrm_and_winrs.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

remote_process_instantiation_via_wmi_and_powershell_script_block.test.yml

adding test file updates

2022-09-13 18:49:00 -05:00

remote_process_instantiation_via_wmi_and_powershell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

remote_process_instantiation_via_wmi.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

remote_system_discovery_with_adsisearcher.test.yml

adsi

2022-06-29 10:13:46 -06:00

remote_system_discovery_with_dsquery.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

remote_system_discovery_with_net.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

remote_system_discovery_with_wmic.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

remote_wmi_command_attempt.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

resize_shadowstorage_volume.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

revil_common_exec_parameter.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

revil_registry_entry.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

rubeus_command_line_parameters.test.yml

adding analytic story and three new detections

2022-02-07 18:52:34 -05:00

rubeus_kerberos_ticket_exports_through_winlogon_access.test.yml

adding analytic story and three new detections

2022-02-07 18:52:34 -05:00

runas_execution_in_commandline.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

rundll32_control_rundll_hunt.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

rundll32_control_rundll_world_writable_directory.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

rundll32_create_remote_thread_to_a_process.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

rundll32_createremotethread_in_browser.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

rundll32_dnsquery.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

rundll32_lockworkstation.test.yml

Fixing field name

2022-06-21 14:59:48 -05:00

rundll32_process_creating_exe_dll_files.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

rundll32_shimcache_flush.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

rundll32_with_no_command_line_arguments_with_network.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

rundll_loading_dll_by_ordinal.test.yml

ordinal Data

2022-02-15 11:09:57 -07:00

ryuk_test_files_detected.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

ryuk_wake_on_lan_command.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

sam_database_file_access_attempt.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

samsam_test_file_write.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

sc_exe_manipulating_windows_services.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

schcache_change_by_app_connect_and_create_adsi_object.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

schedule_task_with_http_command_arguments.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

schedule_task_with_rundll32_command_trigger.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

scheduled_task_creation_on_remote_endpoint_using_at.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

scheduled_task_deleted_or_created_via_cmd.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

scheduled_task_initiation_on_remote_endpoint.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

schtasks_run_task_on_demand.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

schtasks_scheduling_job_on_remote_system.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

schtasks_used_for_forcing_a_reboot.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

screensaver_event_trigger_execution.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

script_execution_via_wmi.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

sdclt_uac_bypass.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

sdelete_application_execution.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

searchprotocolhost_with_no_command_line_with_network.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

secretdumps_offline_ntds_dumping_tool.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

serviceprincipalnames_discovery_with_powershell.test.yml

Updating other spellings of

2022-06-27 16:27:32 -07:00

serviceprincipalnames_discovery_with_setspn.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

services_escalate_exe.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

services_exe_lolbas_execution_process_spawn.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

set_default_powershell_execution_policy_to_unrestricted_or_bypass.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

shim_database_file_creation.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

shim_database_installation_with_suspicious_parameters.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

short_lived_scheduled_task.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

short_lived_windows_accounts.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

silentcleanup_uac_bypass.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

single_letter_process_on_endpoint.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

slui_runas_elevated.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

slui_spawning_a_process.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

spoolsv_spawning_rundll32.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

spoolsv_suspicious_loaded_modules.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

spoolsv_suspicious_process_access.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

spoolsv_writing_a_dll___sysmon.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

spoolsv_writing_a_dll.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

sqlite_module_in_temp_folder.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

ssa___acccheckconsole_exe.test.yml

moved test file from detections folder to tests folder

2022-10-18 09:58:21 -07:00

ssa___adplus_exe.test.yml

adding 9 BA lolbas detection

2022-10-18 12:48:18 -04:00

ssa___advpack_dll.test.yml

adding 9 BA lolbas detection

2022-10-18 12:48:18 -04:00

ssa___agentexecutor_exe.test.yml

adding 9 BA lolbas detection

2022-10-18 12:48:18 -04:00

ssa___anomalous_usage_of_archive_tools.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

ssa___appinstaller_exe.test.yml

adding 9 BA lolbas detection

2022-10-18 12:48:18 -04:00

ssa___appvlp_exe.test.yml

adding 9 BA lolbas detection

2022-10-18 12:48:18 -04:00

ssa___aspnet_compiler_exe.test.yml

remove underscore from test file

2022-10-18 13:14:20 -07:00

ssa___at_exe.test.yml

adding 9 BA lolbas detection

2022-10-18 12:48:18 -04:00

ssa___atbroker_exe.test.yml

adding 9 BA lolbas detection

2022-10-18 12:48:18 -04:00

ssa___attempt_to_delete_services.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

ssa___attempt_to_disable_services.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

ssa___attempted_credential_dump_from_registry_via_reg_exe.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

ssa___bcdedit_failure_recovery_modification.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

ssa___clear_unallocated_sector_using_cipher_app.test.yml

new_ssa_info_sabotage

2021-12-20 12:37:12 +01:00

ssa___delete_a_net_user.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

ssa___deny_permission_using_cacls_utility.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

ssa___detect_rclone_command_line_usage.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

ssa___disable_net_user_account.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

ssa___dns_exfiltration_using_nslookup_app.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

ssa___fsutil_zeroing_file.test.yml

changing detection to use windows security logs

2022-03-30 15:00:15 -04:00

ssa___grant_permission_using_cacls_utility.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

ssa___hiding_files_and_directories_with_attrib_exe.test.yml

new_ssa_info_sabotage

2021-12-20 12:37:12 +01:00

ssa___modify_acls_permission_of_files_or_folders.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

ssa___office_product_spawning_windows_script_host.test.yml

analytics

2022-10-12 14:12:34 -06:00

ssa___prohibited_apps_spawning_cmdprompt.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

ssa___resize_shadowstorage_volume.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

ssa___sdelete_application_execution.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

ssa___system_process_running_from_unexpected_location.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

ssa___wbadmin_delete_system_backups.test.yml

Update ssa___wbadmin_delete_system_backups.test.yml

2022-03-18 11:49:22 -06:00

ssa___wevtutil_usage_to_clear_logs.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

ssa___wevtutil_usage_to_disable_logs.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

ssa___windows_bits_job_persistence.test.yml

BITS

2022-02-16 12:19:01 -07:00

ssa___windows_bitsadmin_download_file.test.yml

BITS

2022-02-16 12:19:01 -07:00

ssa___windows_certutil_decode_file.test.yml

Windows CertUtil Decode File

2022-02-17 10:10:49 -07:00

ssa___windows_certutil_urlcache_download.test.yml

urlcache

2022-02-16 14:24:50 -07:00

ssa___windows_certutil_verifyctl_download.test.yml

certutil - verifyctl

2022-02-16 14:09:18 -07:00

ssa___windows_com_hijacking_inprocserver32_modification.test.yml

analytics

2022-10-12 14:12:34 -06:00

ssa___windows_curl_upload_to_remote_destination.test.yml

old test file format

2022-02-07 10:50:32 +01:00

ssa___windows_defender_tools_in_non_standard_path.test.yml

Updated test filename

2022-07-19 13:36:18 -05:00

ssa___windows_diskshadow_proxy_execution.test.yml

Refactored security content

2022-03-10 10:27:29 +01:00

ssa___windows_dotnet_binary_in_non_standard_path.test.yml

SSA DotNet and LOLBin Analytics

2022-03-18 06:15:50 -06:00

ssa___windows_eventvwr_uac_bypass.test.yml

initial commit

2022-02-23 17:33:46 -06:00

ssa___windows_exchange_powershell_module_usage.test.yml

test file

2022-11-14 14:55:39 -07:00

ssa___windows_execute_arbitrary_commands_with_msdt.test.yml

fixes

2022-09-16 12:47:19 -06:00

ssa___windows_ingress_tool_transfer_using_explorer.test.yml

Windows Ingress Tool Transfer Using Explorer SSA

2022-09-15 12:19:18 -06:00

ssa___windows_lolbin_binary_in_non_standard_path.test.yml

SSA DotNet and LOLBin Analytics

2022-03-18 06:15:50 -06:00

ssa___windows_mshta_child_process.test.yml

mshta child

2022-02-23 21:53:31 -07:00

ssa___windows_mshta_command_line_url.test.yml

MSHTA URl

2022-02-23 15:03:51 -07:00

ssa___windows_mshta_inline_hta_execution.test.yml

mshta inline

2022-02-23 20:56:51 -07:00

ssa___windows_odbcconf_load_response_file.test.yml

fixes

2022-09-16 12:47:19 -06:00

ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.test.yml

test test

2022-09-08 10:23:08 -06:00

ssa___windows_os_credential_dumping_with_procdump.test.yml

test test

2022-09-08 10:23:08 -06:00

ssa___windows_powershell_connect_to_internet_with_hidden_window.test.yml

adding working detection

2022-02-14 15:54:12 -05:00

ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.test.yml

ba 2

2022-11-16 13:40:50 -07:00

ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.test.yml

ba 2

2022-11-16 13:40:50 -07:00

ssa___windows_powershell_downloadfile.test.yml

adding powershell downloadfile but not passing

2022-02-14 21:28:57 -05:00

ssa___windows_powershell_start_bitstransfer.test.yml

Fixed Powershell Bits

2022-02-23 09:56:45 -07:00

ssa___windows_rasautou_dll_execution.test.yml

SSA Rasautou

2022-02-15 14:09:25 -07:00

ssa___windows_rundll32_comsvcs_memory_dump.test.yml

comsvcs

2022-04-14 14:04:13 -06:00

ssa___windows_rundll32_inline_hta_execution.test.yml

rundll32 inline

2022-02-23 15:23:30 -07:00

ssa___windows_script_host_spawn_msbuild.test.yml

msb

2022-03-03 15:01:10 -07:00

ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml

Update ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml

2022-09-26 10:16:04 -04:00

ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml

chm fixes

2022-09-08 10:48:20 -06:00

ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.test.yml

chm fixes

2022-09-08 10:48:20 -06:00

ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.test.yml

fixord

2022-09-08 10:27:54 -06:00

ssa___windows_system_binary_proxy_execution_msiexec_remote_download.test.yml

fixord

2022-09-08 10:27:54 -06:00

ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.test.yml

fixord

2022-09-08 10:27:54 -06:00

ssa___windows_wmiprvse_spawn_msbuild.test.yml

msb

2022-03-03 15:01:10 -07:00

suspicious_computer_account_name_change.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_copy_on_system32.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_dllhost_no_command_line_arguments.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_driver_loaded_path.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_event_log_service_behavior.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_gpupdate_no_command_line_arguments.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_icedid_rundll32_cmdline.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_image_creation_in_appdata_folder.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_kerberos_service_ticket_request.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_linux_discovery_commands.test.yml

Updating the names of more tests in

2022-11-11 11:48:47 -08:00

suspicious_microsoft_workflow_compiler_rename.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_microsoft_workflow_compiler_usage.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_msbuild_path.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_msbuild_rename.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_msbuild_spawn.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_mshta_child_process.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_mshta_spawn.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_process_dns_query_known_abuse_web_services.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_process_file_path.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_process_with_discord_dns_query.test.yml

WhisperGateIsOpen

2022-01-19 14:51:20 +01:00

suspicious_reg_exe_process.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_regsvr32_register_suspicious_path.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_rundll32_dllregisterserver.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_rundll32_plugininit.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_rundll32_startw.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_rundll32_with_no_command_line_arguments.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_scheduled_task_from_public_directory.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_searchprotocolhost_no_command_line_arguments.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_ticket_granting_ticket_request.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_wav_file_in_appdata_folder.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_wevtutil_usage.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

suspicious_writes_to_windows_recycle_bin.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

svchost_exe_lolbas_execution_process_spawn.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

system_info_gathering_using_dxdiag_application.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

system_information_discovery_detection.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

system_processes_run_from_unexpected_locations.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

system_user_discovery_with_query.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

system_user_discovery_with_whoami.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

time_provider_persistence_registry.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

trickbot_named_pipe.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

uac_bypass_mmc_load_unsigned_dll.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

uac_bypass_with_colorui_com_object.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

unified_messaging_service_spawning_a_process.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

uninstall_app_using_msiexec.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

unknown_process_using_the_kerberos_protocol.test.yml

Update unknown_process_using_the_kerberos_protocol.test.yml

2022-03-10 10:56:30 -08:00

unload_sysmon_filter_driver.test.yml

updating datasets after sim

2022-06-01 12:34:48 -07:00

unloading_amsi_via_reflection.test.yml

pwh_xml_2

2022-03-31 17:15:19 +02:00

unusual_number_of_kerberos_service_tickets_requested.test.yml

update detection and adding a new one

2022-02-16 14:16:15 -05:00

user_discocvery_with_env_vars_powershell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

user_discovery_with_env_vars_powershell_script_block.test.yml

pwh_xml_2

2022-03-31 17:15:19 +02:00

usn_journal_deletion.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

vbscript_execution_using_wscript_app.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

verclsid_clsid_execution.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

w3wp_spawning_shell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

wbadmin_delete_system_backups.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

wbemprox_com_object_execution.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

wermgr_process_connecting_to_ip_check_web_services.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

wermgr_process_create_executable_file.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

wermgr_process_spawned_cmd_or_powershell_process.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

wget_download_and_bash_execution.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

windows_access_token_manipulation_sedebugprivilege.test.yml

brute-rate-3

2022-09-05 10:26:55 +02:00

windows_access_token_manipulation_winlogon_duplicate_token_handle.test.yml

brute-ratel-3

2022-09-01 13:16:24 +02:00

windows_access_token_winlogon_duplicate_handle_in_uncommon_path.test.yml

brute-ratel-3

2022-09-01 13:16:24 +02:00

windows_ad_adminsdholder_acl_modified.test.yml

adding proper dataset url

2022-11-17 15:27:25 -05:00

windows_ad_cross_domain_sid_history_addition.test.yml

fixing test files

2023-02-09 14:30:05 -05:00

windows_ad_domain_controller_promotion.test.yml

Adding new Detection for DC Promo Events

2023-01-26 11:58:04 +10:00

windows_ad_dsrm_account_changes.test.yml

Adding Domain Repl ACL detection & detection renaming

2022-11-18 17:39:03 +10:00

windows_ad_dsrm_password_reset.test.yml

Adding Domain Repl ACL detection & detection renaming

2022-11-18 17:39:03 +10:00

windows_ad_replication_request_initiated_by_user_account.test.yml

fixing test file path

2023-02-22 14:34:10 -05:00

windows_ad_replication_request_initiated_from_unsanctioned_location.test.yml

fixing test file

2023-02-09 15:06:03 -05:00

windows_ad_same_domain_sid_history_addition.test.yml

Adding Domain Repl ACL detection & detection renaming

2022-11-18 17:39:03 +10:00

windows_ad_serviceprincipalname_added_to_domain_account.test.yml

adding new detection

2022-11-17 17:18:54 -05:00

windows_ad_short_lived_domain_account_serviceprincipalname.test.yml

fixing test files

2023-02-09 14:30:05 -05:00

windows_ad_short_lived_domain_controller_spn_attribute.test.yml

renames, updated descriptions and SPL

2022-11-19 09:47:31 +10:00

windows_ad_short_lived_server_object.test.yml

renaming detections

2022-11-17 15:24:32 -05:00

windows_ad_sid_history_attribute_modified.test.yml

renaming detections

2022-11-17 15:24:32 -05:00

windows_adfind_exe.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

windows_apache_benchmark_binary.test.yml

ApacheBench

2022-11-21 09:24:42 -07:00

windows_app_layer_protocol_qakbot_namedpipe.test.yml

cisa_coverage

2022-11-10 11:45:57 +01:00

windows_app_layer_protocol_wermgr_connect_to_namedpipe.test.yml

qakbot_2

2022-10-28 11:51:12 +02:00

windows_application_layer_protocol_rms_radmin_tool_namedpipe.test.yml

azorult-bomb2

2022-06-24 14:20:37 +02:00

windows_autostart_execution_lsass_driver_registry_modification.test.yml

LSA 🐍 SS

2022-08-22 21:16:12 -06:00

windows_binary_proxy_execution_mavinject_dll_injection.test.yml

mav

2022-07-07 15:24:13 -06:00

windows_boot_or_logon_autostart_execution_in_startup_folder.test.yml

lockbit-chaos-ransomware

2023-01-16 15:50:50 +01:00

windows_cached_domain_credentials_reg_query.test.yml

prestige_winpeas2

2022-12-06 09:49:29 +01:00

windows_change_default_file_association_for_no_file_ext.test.yml

prestige_winpeas

2022-12-05 10:54:10 +01:00

windows_clipboard_data_via_get_clipboard.test.yml

Update windows_clipboard_data_via_get_clipboard.test.yml

2022-12-06 10:18:58 +01:00

windows_com_hijacking_inprocserver32_modification.test.yml

New content

2022-09-26 13:00:17 -06:00

windows_command_and_scripting_interpreter_hunting_path_traversal.test.yml

follina_path_traversal_update

2022-06-01 16:14:46 +02:00

windows_command_and_scripting_interpreter_path_traversal_exec.test.yml

path_traversal

2022-05-30 15:44:52 +02:00

windows_command_shell_dcrat_forkbomb_payload.test.yml

dcrat-analytics2

2022-07-28 15:29:25 +02:00

windows_command_shell_fetch_env_variables.test.yml

qakbot_2

2022-10-27 16:29:52 +02:00

windows_computer_account_created_by_computer_account.test.yml

krb

2022-04-28 09:18:03 -06:00

windows_computer_account_requesting_kerberos_ticket.test.yml

krb

2022-04-28 09:18:03 -06:00

windows_computer_account_with_spn.test.yml

krb

2022-04-28 09:18:03 -06:00

windows_create_local_account.test.yml

Updates + new

2022-10-05 10:20:07 -06:00

windows_credential_dumping_lsass_memory_createdump.test.yml

createdump

2023-01-24 06:49:27 -07:00

windows_credentials_from_password_stores_query.test.yml

prestige_winpeas2

2022-12-06 09:49:29 +01:00

windows_credentials_in_registry_reg_query.test.yml

prestige_winpeas2

2022-12-07 09:33:15 +01:00

windows_curl_download_to_suspicious_path.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

windows_curl_upload_to_remote_destination.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

windows_data_destruction_recursive_exec_files_deletion.test.yml

swiftslicer

2023-02-03 09:47:51 +01:00

windows_defacement_modify_transcodedwallpaper_file.test.yml

brute-rate-3

2022-09-05 10:26:55 +02:00

windows_defender_exclusion_registry_entry.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

windows_deleted_registry_by_a_non_critical_process_file_path.test.yml

doublezero

2022-03-28 16:30:31 +02:00

windows_disable_change_password_through_registry.test.yml

More_Registry

2022-03-14 11:51:51 +01:00

windows_disable_lock_workstation_feature_through_registry.test.yml

More_Registry

2022-03-14 11:51:51 +01:00

windows_disable_logoff_button_through_registry.test.yml

More_Registry

2022-03-08 12:32:39 +01:00

windows_disable_memory_crash_dump.test.yml

Drump to Dump

2022-02-25 14:31:01 -07:00

windows_disable_notification_center.test.yml

More_Registry

2022-03-14 14:01:48 +01:00

windows_disable_shutdown_button_through_registry.test.yml

More_Registry

2022-03-08 12:14:56 +01:00

windows_disable_windows_event_logging_disable_http_logging.test.yml

Fantastic IIS Modules and Where to Find Them

2022-12-21 08:53:03 -07:00

windows_disable_windows_group_policy_features_through_registry.test.yml

More_Registry

2022-03-15 10:39:08 +01:00

windows_disableantispyware_reg.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

windows_diskcryptor_usage.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

windows_diskshadow_proxy_execution.test.yml

Updating the names of more tests in

2022-11-11 11:48:47 -08:00

windows_dism_remove_defender.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

windows_dll_search_order_hijacking_hunt_with_sysmon.test.yml

Hijack Libraries

2022-08-19 14:37:29 -06:00

windows_dll_search_order_hijacking_hunt.test.yml

Hijack Libraries

2022-08-19 14:37:29 -06:00

windows_dll_search_order_hijacking_with_iscsicpl.test.yml

iscsi fix

2022-08-02 08:35:54 -06:00

windows_dll_side_loading_in_calc.test.yml

qakbot_2

2022-10-24 15:14:35 +02:00

windows_dll_side_loading_process_child_of_calc.test.yml

qakbot_2

2022-10-20 13:44:38 +02:00

windows_dotnet_binary_in_non_standard_path.test.yml

InstallUtil and DotNet Assemblies

2022-01-20 14:34:04 -07:00

windows_driver_load_non_standard_path.test.yml

XML driver load

2023-03-01 09:16:22 -07:00

windows_drivers_loaded_by_signature.test.yml

driver load by sig

2022-04-04 14:02:02 -06:00

windows_event_for_service_disabled.test.yml

mbr_and_more

2022-02-23 14:18:07 +01:00

windows_event_log_cleared.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

windows_event_triggered_image_file_execution_options_injection.test.yml

hunt Windows Event Triggered Image File Execution Options Injection

2022-09-09 06:50:43 -06:00

windows_excessive_disabled_services_event.test.yml

mbr_and_more

2022-02-23 14:18:07 +01:00

windows_execute_arbitrary_commands_with_msdt.test.yml

Complete Follina

2022-05-31 07:16:05 -06:00

windows_export_certificate.test.yml

Cert services and MOAR

2023-02-03 06:58:50 -07:00

windows_file_transfer_protocol_in_non_common_process_path.test.yml

agent-with-tesla-2

2022-09-21 10:27:23 +02:00

windows_file_without_extension_in_critical_folder.test.yml

hermetic_wiper

2022-02-25 15:00:42 +01:00

windows_gather_victim_host_information_camera.test.yml

dcrat-analytics3

2022-07-29 10:06:40 +02:00

windows_gather_victim_identity_sam_info.test.yml

Delete windows_gather_victim_identity_sam_info.test.yml

2022-09-01 13:20:14 +02:00

windows_gather_victim_network_info_through_ip_check_web_services.test.yml

azorult-bomb2

2022-06-24 14:20:37 +02:00

windows_get_adcomputer_unconstrained_delegation_discovery.test.yml

adding new detection for unconstrained delegation discovery

2022-03-28 19:14:06 -04:00

windows_hidden_schedule_task_settings.test.yml

industroyer2_PR3

2022-04-27 12:19:45 +02:00

windows_hide_notification_features_through_registry.test.yml

More_Registry

2022-03-15 10:39:08 +01:00

windows_high_file_deletion_frequency.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

windows_hijack_execution_flow_version_dll_side_load.test.yml

Delete windows_hijack_execution_flow_version_dll_side_load.test.yml

2022-09-01 13:20:04 +02:00

windows_hunting_system_account_targeting_lsass.test.yml

Updates

2022-01-13 09:18:12 -07:00

windows_identify_protocol_handlers.test.yml

oh hey data

2022-07-14 11:51:36 -06:00

windows_iis_components_add_new_module.test.yml

Fantastic IIS Modules and Where to Find Them

2022-12-21 08:53:03 -07:00

windows_iis_components_get_webglobalmodule_module_query.test.yml

Fixes

2022-12-21 09:18:23 -07:00

windows_iis_components_module_failed_to_load.test.yml

Fantastic IIS Modules and Where to Find Them

2022-12-21 08:53:03 -07:00

windows_iis_components_new_module_added.test.yml

Fantastic IIS Modules and Where to Find Them

2022-12-21 08:53:03 -07:00

windows_impair_defense_add_xml_applocker_rules.test.yml

azorult-bomb2

2022-06-28 11:00:01 +02:00

windows_impair_defense_delete_win_defender_context_menu.test.yml

more-defense-evasion

2022-06-07 12:53:31 +02:00

windows_impair_defense_delete_win_defender_profile_registry.test.yml

more-defense-evasion

2022-06-07 13:13:02 +02:00

windows_impair_defense_deny_security_software_with_applocker.test.yml

azorult-bomb2

2022-06-28 11:09:24 +02:00

windows_impair_defenses_disable_win_defender_auto_logging.test.yml

more-defense-evasion

2022-06-07 11:50:27 +02:00

windows_indirect_command_execution_via_forfiles.test.yml

Missing space in yml file

2022-11-11 11:50:02 -08:00

windows_indirect_command_execution_via_pcalua.test.yml

Updating paths to dataset for testing

2022-04-05 14:14:42 -07:00

windows_indirect_command_execution_via_series_of_forfiles.test.yml

prestige_winpeas2

2022-12-07 09:33:15 +01:00

windows_information_discovery_fsutil.test.yml

prestige_winpeas2

2022-12-07 09:33:15 +01:00

windows_ingress_tool_transfer_using_explorer.test.yml

Rename windows_ingress_tool_transfer_using_explorer_exe.test.yml to windows_ingress_tool_transfer_using_explorer.test.yml

2022-08-01 14:22:35 +02:00

windows_input_capture_using_credential_ui_dll.test.yml

Delete windows_input_capture_using_credential_ui_dll.test.yml

2022-09-01 13:19:55 +02:00

windows_installutil_credential_theft.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

windows_installutil_in_non_standard_path.test.yml

InstallUtil and DotNet Assemblies

2022-01-20 14:34:04 -07:00

windows_installutil_remote_network_connection.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

windows_installutil_uninstall_option_with_network.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

windows_installutil_uninstall_option.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

windows_installutil_url_in_command_line.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

windows_iso_lnk_file_creation.test.yml

ISO

2022-03-30 10:11:10 -06:00

windows_kerberos_local_successful_logon.test.yml

krb

2022-04-28 09:18:03 -06:00

windows_krbrelayup_service_creation.test.yml

service

2022-05-02 11:40:31 -06:00

windows_linked_policies_in_adsi_discovery.test.yml

industroyer2_PR3

2022-04-28 14:45:29 +02:00

windows_mail_protocol_in_non_common_process_path.test.yml

agent-with-tesla-2

2022-09-21 10:27:23 +02:00

windows_masquerading_explorer_as_child_process.test.yml

qakbot_2

2022-10-20 13:44:38 +02:00

windows_mimikatz_binary_execution.test.yml

mimikatz

2022-11-16 13:06:10 -07:00

windows_mimikatz_crypto_export_file_extensions.test.yml

miimi

2023-02-09 15:06:29 -07:00

windows_modify_registry_default_icon_setting.test.yml

lockbit-chaos-ransomware

2023-01-18 14:55:46 +01:00

windows_modify_registry_disable_toast_notifications.test.yml

Update windows_modify_registry_disable_toast_notifications.test.yml

2022-06-23 13:57:11 +02:00

windows_modify_registry_disable_win_defender_raw_write_notif.test.yml

azorult-bomb3

2022-07-08 11:05:34 +02:00

windows_modify_registry_disable_windows_security_center_notif.test.yml

Update and rename windows_modify_registry_disable_windows_security_center_notifs.test.yml to windows_modify_registry_disable_windows_security_center_notif.test.yml

2022-06-23 15:24:51 +02:00

windows_modify_registry_disabling_wer_settings.test.yml

azorult-bomb3

2022-07-06 13:03:14 +02:00

windows_modify_registry_disallow_windows_app.test.yml

azorult-bomb3

2022-07-06 13:03:14 +02:00

windows_modify_registry_qakbot_binary_data_registry.test.yml

qakbot_2

2022-10-24 15:30:23 +02:00

windows_modify_registry_reg_restore.test.yml

prestige_winpeas3

2022-12-13 11:42:04 +01:00

windows_modify_registry_regedit_silent_reg_import.test.yml

azorult-bomb3

2022-07-06 13:03:14 +02:00

windows_modify_registry_suppress_win_defender_notif.test.yml

Update and rename windows_modify_registry_suppress_win_defender_notifs.test.yml to windows_modify_registry_suppress_win_defender_notif.test.yml

2022-06-23 15:25:17 +02:00

windows_modify_show_compress_color_and_info_tip_registry.test.yml

hwiper_more_ioc

2022-03-02 11:50:13 +01:00

windows_mof_event_triggered_execution_via_wmi.test.yml

MOFComp

2022-07-19 06:07:01 -06:00

windows_msexchange_management_mailbox_cmdlet_usage.test.yml

Exchange this for Shellz

2022-11-21 15:10:24 -07:00

windows_mshta_execution_in_registry.test.yml

Update windows_mshta_execution_in_registry.test.yml

2022-10-14 17:50:56 +02:00

windows_msiexec_dllregisterserver.test.yml

T1218.007 - MSIExec

2022-06-17 09:36:34 -06:00

windows_msiexec_remote_download.test.yml

T1218.007 - MSIExec

2022-06-17 09:36:34 -06:00

windows_msiexec_spawn_discovery_command.test.yml

T1218.007 - MSIExec

2022-06-17 09:36:34 -06:00

windows_msiexec_unregister_dllregisterserver.test.yml

T1218.007 - MSIExec

2022-06-17 09:36:34 -06:00

windows_msiexec_with_network_connections.test.yml

T1218.007 - MSIExec

2022-06-17 09:36:34 -06:00

windows_multi_hop_proxy_tor_website_query.test.yml

Updating the names of more tests in

2022-11-11 11:48:47 -08:00

windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.test.yml

Fixed up some incorrect paths in test and detection files.

2023-02-21 16:25:24 -08:00

windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.test.yml

renaming detections

2022-09-22 12:21:11 -04:00

windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.test.yml

renaming detections

2022-09-22 11:43:22 -04:00

windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.test.yml

renaming detections

2022-09-22 12:21:11 -04:00

windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.test.yml

renaming detections

2022-09-22 11:43:22 -04:00

windows_multiple_users_failed_to_authenticate_from_process.test.yml

renaming detections

2022-09-22 11:43:22 -04:00

windows_multiple_users_failed_to_authenticate_using_kerberos.test.yml

renaming detections

2022-09-22 11:43:22 -04:00

windows_multiple_users_remotely_failed_to_authenticate_from_host.test.yml

renaming detections

2022-09-22 11:43:22 -04:00

windows_ngrok_reverse_proxy_usage.test.yml

test files

2022-11-16 12:41:07 -07:00

windows_nirsoft_advancedrun.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

windows_nirsoft_utilities.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

windows_non_system_account_targeting_lsass.test.yml

Updates

2022-01-13 09:18:12 -07:00

windows_odbcconf_hunting.test.yml

Update windows_odbcconf_hunting.test.yml

2022-07-19 11:08:43 -07:00

windows_odbcconf_load_dll.test.yml

ODBC

2022-06-30 10:30:13 -06:00

windows_odbcconf_load_response_file.test.yml

ODBC

2022-06-30 10:30:13 -06:00

windows_office_product_spawning_msdt.test.yml

Complete Follina

2022-05-31 07:16:05 -06:00

windows_password_managers_discovery.test.yml

prestige_winpeas2

2022-12-08 09:32:33 +01:00

windows_phishing_pdf_file_executes_url_link.test.yml

lockbit-chaos-ransomware

2023-01-18 14:55:46 +01:00

windows_phishing_recent_iso_exec_registry.test.yml

Delete windows_phishing_recent_iso_exec_registry.test.yml

2022-09-01 13:19:45 +02:00

windows_possible_credential_dumping.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

windows_powershell_add_module_to_global_assembly_cache.test.yml

pwsh gac

2023-01-18 13:13:41 -07:00

windows_powershell_cryptography_namespace.test.yml

asyncrat-onenote-chain2

2023-01-26 14:12:32 +01:00

windows_powershell_disable_http_logging.test.yml

fixes

2022-12-21 08:58:59 -07:00

windows_powershell_export_certificate.test.yml

fixy

2023-02-03 09:07:10 -07:00

windows_powershell_export_pfxcertificate.test.yml

Cert services and MOAR

2023-02-03 06:58:50 -07:00

windows_powershell_iis_components_webglobalmodule_usage.test.yml

Fantastic IIS Modules and Where to Find Them

2022-12-21 08:53:03 -07:00

windows_powershell_import_applocker_policy.test.yml

azorult-bomb2

2022-06-30 12:36:22 +02:00

windows_powerview_constrained_delegation_discovery.test.yml

adding new kerberos constrained delegation discovery

2022-03-31 14:34:31 -04:00

windows_powerview_kerberos_service_ticket_request.test.yml

Edit windows_powerview_kerberos_service_ticket_request detection

2022-07-01 16:24:42 -04:00

windows_powerview_spn_discovery.test.yml

updating field name to use ScriptBlockText

2022-06-24 11:18:28 -04:00

windows_powerview_unconstrained_delegation_discovery.test.yml

renaming test file

2022-03-28 15:07:26 -04:00

windows_private_keys_discovery.test.yml

prestige_winpeas2

2022-12-08 09:32:33 +01:00

windows_process_injection_into_notepad.test.yml

fixes

2023-02-24 12:24:55 -07:00

windows_process_injection_of_wermgr_to_known_browser.test.yml

qakbot_2

2022-10-28 11:51:12 +02:00

windows_process_injection_remote_thread.test.yml

qakbot_2

2022-10-28 11:51:12 +02:00

windows_process_injection_wermgr_child_process.test.yml

qakbot_2

2022-10-27 16:07:23 +02:00

windows_process_injection_with_public_source_path.test.yml

brute-rate-3

2022-09-05 10:26:55 +02:00

windows_process_with_namedpipe_commandline.test.yml

mbr_and_more

2022-02-23 14:18:07 +01:00

windows_processes_killed_by_industroyer2_malware.test.yml

industroyer2_PR3

2022-04-28 09:18:58 +02:00

windows_protocol_tunneling_with_plink.test.yml

PLINK

2022-09-15 10:52:56 -06:00

windows_query_registry_reg_save.test.yml

prestige_winpeas3

2022-12-13 11:42:04 +01:00

windows_raccine_scheduled_task_deletion.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

windows_rasautou_dll_execution.test.yml

rasautou

2022-02-15 13:08:59 -07:00

windows_raw_access_to_disk_volume_partition.test.yml

hermetic_wiper

2022-02-25 15:36:41 +01:00

windows_raw_access_to_master_boot_record_drive.test.yml

mbr_and_more

2022-02-22 09:18:18 +01:00

windows_registry_certificate_added.test.yml

Cert Registry

2022-03-31 14:17:39 -06:00

windows_registry_delete_task_sd.test.yml

SD Delete

2022-04-18 10:55:08 -06:00

windows_registry_modification_for_safe_mode_persistence.test.yml

SafeBoot

2022-03-31 09:11:18 -06:00

windows_regsvr32_renamed_binary.test.yml

qakbot_2

2022-10-27 15:18:28 +02:00

windows_remote_access_software_brc4_loaded_dll.test.yml

Delete windows_remote_access_software_brc4_loaded_dll.test.yml

2022-09-01 13:19:35 +02:00

windows_remote_access_software_hunt.test.yml

Remote Access Software

2022-08-22 21:57:53 -06:00

windows_remote_access_software_rms_registry.test.yml

azorult-bomb2

2022-06-24 14:20:37 +02:00

windows_remote_assistance_spawning_process.test.yml

MSRA shipment 📮

2022-02-09 12:10:58 -07:00

windows_remote_service_rdpwinst_tool_execution.test.yml

azorult-bomb3

2022-07-08 11:05:34 +02:00

windows_remote_services_allow_rdp_in_firewall.test.yml

azorult-bomb

2022-06-23 12:27:43 +02:00

windows_remote_services_allow_remote_assistance.test.yml

azorult-bomb

2022-06-22 13:31:48 +02:00

windows_remote_services_rdp_enable.test.yml

azorult-bomb

2022-06-22 13:31:48 +02:00

windows_replication_through_removable_media.test.yml

lockbit-chaos-ransomware

2023-01-18 14:55:46 +01:00

windows_root_domain_linked_policies_discovery.test.yml

Update windows_root_domain_linked_policies_discovery.test.yml

2022-04-28 15:33:51 +02:00

windows_scheduled_task_with_highest_privileges.test.yml

asyncrat-onenote-chain2

2023-01-26 14:12:32 +01:00

windows_schtasks_create_run_as_system.test.yml

Windows Schtasks Create Run As System

2022-02-10 09:08:52 -07:00

windows_security_account_manager_stopped.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

windows_security_support_provider_reg_query.test.yml

Update windows_security_support_provider_reg_query.test.yml

2022-12-08 09:56:12 +01:00

windows_server_software_component_gacutil_install_to_gac.test.yml

GACutil 1

2023-01-18 12:35:42 -07:00

windows_service_create_kernel_mode_driver.test.yml

HaagCat

2022-05-16 12:59:46 -06:00

windows_service_create_sliverc2.test.yml

Update windows_service_create_sliverc2.test.yml

2023-03-06 04:55:36 -07:00

windows_service_created_with_suspicious_service_path.test.yml

Updating the names of more tests in

2022-11-11 11:48:47 -08:00

windows_service_created_within_public_path.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

windows_service_creation_on_remote_endpoint.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

windows_service_creation_using_registry_entry.test.yml

mbr_and_more

2022-02-23 11:32:05 +01:00

windows_service_deletion_in_registry.test.yml

brute-ratel-3

2022-09-01 15:18:30 +02:00

windows_service_initiation_on_remote_endpoint.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

windows_service_stop_by_deletion.test.yml

azorult-bomb

2022-06-22 13:31:48 +02:00

windows_service_stop_via_net__and_sc_application.test.yml

prestige_ransomware

2022-11-30 11:07:20 +01:00

windows_spearphishing_attachment_connect_to_none_ms_office_domain.test.yml

asyncrat-onenote-chain2

2023-01-27 14:14:35 +01:00

windows_spearphishing_attachment_onenote_spawn_mshta.test.yml

asyncrat-onenote-chain

2023-01-24 11:00:35 +01:00

windows_steal_authentication_certificates_certificate_issued.test.yml

Certs! Certs! CERTS!

2023-02-06 07:03:37 -07:00

windows_steal_authentication_certificates_certificate_request.test.yml

Certs! Certs! CERTS!

2023-02-06 07:03:37 -07:00

windows_steal_authentication_certificates_certutil_backup.test.yml

Backup Time

2023-02-06 09:48:55 -07:00

windows_steal_authentication_certificates_cryptoapi.test.yml

fixes

2023-02-14 15:35:00 -07:00

windows_steal_authentication_certificates_cs_backup.test.yml

Backup Time

2023-02-06 09:48:55 -07:00

windows_steal_authentication_certificates_export_certificate.test.yml

Cert services and MOAR

2023-02-03 06:58:50 -07:00

windows_steal_authentication_certificates_export_pfxcertificate.test.yml

Cert services and MOAR

2023-02-03 06:58:50 -07:00

windows_steal_or_forge_kerberos_tickets_klist.test.yml

prestige_winpeas2

2022-12-12 11:19:22 +01:00

windows_system_binary_proxy_execution_compiled_html_file_decompile.test.yml

SSA all things

2022-09-01 15:02:44 -06:00

windows_system_discovery_using_ldap_nslookup.test.yml

qakbot_2

2022-10-21 11:35:47 +02:00

windows_system_discovery_using_qwinsta.test.yml

qakbot_2

2022-10-21 11:35:47 +02:00

windows_system_file_on_disk.test.yml

HaagCat

2022-05-16 12:59:46 -06:00

windows_system_logoff_commandline.test.yml

dcrat-analytics2

2022-07-27 15:19:30 +02:00

windows_system_network_config_discovery_display_dns.test.yml

prestige_winpeas2

2022-12-12 11:19:22 +01:00

windows_system_network_connections_discovery_netsh.test.yml

prestige_winpeas2

2022-12-12 11:19:22 +01:00

windows_system_reboot_commandline.test.yml

dcrat-analytics2

2022-07-27 15:19:30 +02:00

windows_system_script_proxy_execution_syncappvpublishingserver.test.yml

New content

2022-09-26 13:00:17 -06:00

windows_system_shutdown_commandline.test.yml

dcrat-analytics2

2022-07-27 15:19:30 +02:00

windows_system_time_discovery_w32tm_delay.test.yml

dcrat-analytics2

2022-07-28 15:29:25 +02:00

windows_system_user_discovery_via_quser.test.yml

prestige_winpeas3

2022-12-13 11:42:04 +01:00

windows_terminating_lsass_process.test.yml

doublezero

2022-03-28 16:15:41 +02:00

windows_unusual_count_of_disabled_users_failed_to_auth_using_kerberos.test.yml

modifying existing detections and adding new

2022-09-22 15:00:21 -04:00

windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.test.yml

modifying existing detections and adding new

2022-09-22 15:00:21 -04:00

windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.test.yml

modifying existing detections and adding new

2022-09-22 15:00:21 -04:00

windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.test.yml

modifying existing detections and adding new

2022-09-22 15:00:21 -04:00

windows_unusual_count_of_users_failed_to_auth_using_kerberos.test.yml

modifying existing detections and adding new

2022-09-22 15:00:21 -04:00

windows_unusual_count_of_users_failed_to_authenticate_from_process.test.yml

modifying existing detections and adding new

2022-09-22 15:00:21 -04:00

windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.test.yml

modifying existing detections and adding new

2022-09-22 15:00:21 -04:00

windows_unusual_count_of_users_remotely_failed_to_auth_from_host.test.yml

modifying existing detections and adding new

2022-09-22 15:00:21 -04:00

windows_user_execution_malicious_url_shortcut_file.test.yml

lockbit-chaos-ransomware

2023-01-16 15:50:50 +01:00

windows_valid_account_with_never_expires_password.test.yml

azorult-bomb2

2022-06-24 14:20:37 +02:00

windows_wmi_impersonate_token.test.yml

qakbot_2

2022-10-26 12:53:25 +02:00

windows_wmi_process_and_service_list.test.yml

prestige_winpeas3

2022-12-13 11:42:04 +01:00

windows_wmi_process_call_create.test.yml

mbr_and_more

2022-02-22 14:12:27 +01:00

winevent_scheduled_task_created_to_spawn_shell.test.yml

chage test files

2023-02-06 16:39:50 -08:00

winevent_scheduled_task_created_within_public_path.test.yml

chage test files

2023-02-06 16:39:50 -08:00

winevent_windows_task_scheduler_event_action_started.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

winhlp32_spawning_a_process.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

winword_spawning_cmd.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

winword_spawning_powershell.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

winword_spawning_windows_script_host.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

wmi_permanent_event_subscription___sysmon.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

wmi_recon_running_process_or_services.test.yml

win32proc

2022-06-29 10:21:35 -06:00

wmic_group_discovery.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

wmic_noninteractive_app_uninstallation.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

wmic_xsl_execution_via_url.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

wmiprsve_exe_lolbas_execution_process_spawn.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

wscript_or_cscript_suspicious_child_process.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

wsmprovhost_exe_lolbas_execution_process_spawn.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

wsreset_uac_bypass.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

xmrig_driver_loaded.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00

xsl_script_execution_with_wmic.test.yml

Refactored security content

2022-03-09 14:43:09 +01:00