admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
v4.16.0
splunk-security_content/dev/endpoint
T
History
Bhavin Patel f3372e03c2 Release branch v4.16.0
2023-11-16 20:33:10 +00:00
..
7zip_commandline_to_smb_share_path.yml
converter improvements
2023-01-23 09:38:17 +01:00
active_setup_registry_autostart.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
add_defaultuser_and_password_in_registry.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
add_or_set_windows_defender_exclusion.yml
converter improvements
2023-01-23 09:38:17 +01:00
allow_file_and_printing_sharing_in_firewall.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
allow_inbound_traffic_by_firewall_rule_registry.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
allow_network_discovery_in_firewall.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
allow_operation_with_consent_admin.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
anomalous_usage_of_7zip.yml
improved sigma converter
2023-03-07 11:27:12 +01:00
any_powershell_downloadfile.yml
converter improvements
2023-01-23 09:38:17 +01:00
any_powershell_downloadstring.yml
converter improvements
2023-01-23 09:38:17 +01:00
attacker_tools_on_endpoint.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
attempt_to_add_certificate_to_untrusted_store.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
attempted_credential_dump_from_registry_via_reg_exe.yml
improved detection
2023-03-07 11:55:09 +01:00
auto_admin_logon_registry_entry.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
batch_file_write_to_system32.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
bcdedit_command_back_to_normal_mode_boot.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
bcdedit_failure_recovery_modification.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
bits_job_persistence.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
bitsadmin_download_file.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
certutil_download_with_urlcache_and_split_arguments.yml
The Haagless Horseman
2023-09-11 11:20:03 -06:00
certutil_download_with_verifyctl_and_split_arguments.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
certutil_exe_certificate_extraction.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
certutil_with_decode_argument.yml
The Haagless Horseman
2023-09-11 11:20:03 -06:00
change_default_file_association.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
change_to_safe_mode_with_network_config.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
chcp_command_execution.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
check_elevated_cmd_using_whoami.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
child_processes_of_spoolsv_exe.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
clear_unallocated_sector_using_cipher_app.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
cmd_carry_out_string_command_parameter.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
cmd_echo_pipe___escalation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
cmdline_tool_not_executed_in_cmd_shell.yml
converter improvements
2023-01-23 09:38:17 +01:00
conti_common_exec_parameter.yml
converter improvements
2023-01-23 09:38:17 +01:00
control_loading_from_world_writable_directory.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
create_local_admin_accounts_using_net_exe.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
create_or_delete_windows_shares_using_net_exe.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
creation_of_shadow_copy_with_wmic_and_powershell.yml
few more
2023-05-25 05:59:55 -06:00
creation_of_shadow_copy.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
credential_dumping_via_copy_command_from_shadow_copy.yml
converter improvements
2023-01-23 09:38:17 +01:00
credential_dumping_via_symlink_to_shadow_copy.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
csc_net_on_the_fly_compilation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
curl_download_and_bash_execution.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
deleting_shadow_copies.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
detect_azurehound_command_line_arguments.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
detect_azurehound_file_modifications.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
detect_exchange_web_shell.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
detect_html_help_renamed.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
detect_html_help_spawn_child_process.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
detect_html_help_url_in_command_line.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
detect_html_help_using_infotech_storage_handlers.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
detect_mshta_inline_hta_execution.yml
converter improvements
2023-01-23 09:38:17 +01:00
detect_mshta_renamed.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
detect_mshta_url_in_command_line.yml
converter improvements
2023-01-23 09:38:17 +01:00
detect_outlook_exe_writing_a_zip_file.yml
converter improvements
2023-01-23 09:38:17 +01:00
detect_path_interception_by_creation_of_program_exe.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
detect_prohibited_applications_spawning_cmd_exe.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
detect_rclone_command_line_usage.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
detect_regasm_spawning_a_process.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
detect_regasm_with_no_command_line_arguments.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
detect_regsvcs_spawning_a_process.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
detect_regsvcs_with_no_command_line_arguments.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
detect_renamed_7_zip.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
detect_renamed_psexec.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
detect_renamed_rclone.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
detect_renamed_winrar.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
detect_sharphound_command_line_arguments.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
detect_sharphound_file_modifications.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
detect_sharphound_usage.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
detect_use_of_cmd_exe_to_launch_script_interpreters.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
detection_of_tools_built_by_nirsoft.yml
converter improvements
2023-01-23 09:38:17 +01:00
disable_amsi_through_registry.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
disable_defender_blockatfirstseen_feature.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
disable_defender_enhanced_notification.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
disable_defender_mpengine_registry.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
disable_defender_spynet_reporting.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
disable_defender_submit_samples_consent_feature.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
disable_etw_through_registry.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
disable_logs_using_wevtutil.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
disable_registry_tool.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
disable_schedule_task.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
disable_security_logs_using_minint_registry.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
disable_show_hidden_files.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
disable_uac_remote_restriction.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
disable_windows_app_hotkeys.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
disable_windows_behavior_monitoring.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
disable_windows_smartscreen_protection.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
disabling_cmd_application.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
disabling_controlpanel.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
disabling_defender_services.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
disabling_firewall_with_netsh.yml
converter improvements
2023-01-23 09:38:17 +01:00
disabling_folderoptions_windows_feature.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
disabling_norun_windows_app.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
disabling_remote_user_account_control.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
disabling_systemrestore_in_registry.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
disabling_task_manager.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
dllhost_with_no_command_line_arguments_with_network.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
domain_account_discovery_with_dsquery.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
domain_account_discovery_with_net_app.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
domain_account_discovery_with_wmic.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
domain_controller_discovery_with_nltest.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
domain_controller_discovery_with_wmic.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
domain_group_discovery_with_dsquery.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
domain_group_discovery_with_net.yml
converter improvements
2023-01-23 09:38:17 +01:00
domain_group_discovery_with_wmic.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
dsquery_domain_discovery.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
dump_lsass_via_procdump.yml
converter improvements
2023-01-23 09:38:17 +01:00
elevated_group_discovery_with_net.yml
password spray
2023-05-25 06:35:11 -06:00
elevated_group_discovery_with_wmic.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
enable_rdp_in_other_port_number.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
enable_wdigest_uselogoncredential_registry.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
esentutl_sam_copy.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
etw_registry_disabled.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
eventvwr_uac_bypass.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
excel_spawning_powershell.yml
converter improvements
2023-01-23 09:38:17 +01:00
excel_spawning_windows_script_host.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
execute_javascript_with_jscript_com_clsid.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
execution_of_file_with_multiple_extensions.yml
converter improvements
2023-01-23 09:38:17 +01:00
extraction_of_registry_hives.yml
1 more
2023-05-25 06:00:45 -06:00
firewall_allowed_program_enable.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
first_time_seen_child_process_of_zoom.yml
converter improvements
2023-01-23 09:38:17 +01:00
fodhelper_uac_bypass.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
fsutil_zeroing_file.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
get_addefaultdomainpasswordpolicy_with_powershell.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
get_aduser_with_powershell.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
get_aduserresultantpasswordpolicy_with_powershell.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
get_domainpolicy_with_powershell.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
get_domaintrust_with_powershell.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
get_domainuser_with_powershell.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
get_foresttrust_with_powershell.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
get_wmiobject_group_discovery.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
getadcomputer_with_powershell.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
getadgroup_with_powershell.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
getcurrent_user_with_powershell.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
getdomaincomputer_with_powershell.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
getdomaincontroller_with_powershell.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
getdomaingroup_with_powershell.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
getlocaluser_with_powershell.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
getnettcpconnection_with_powershell.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
getwmiobject_ds_computer_with_powershell.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
getwmiobject_ds_group_with_powershell.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
getwmiobject_ds_user_with_powershell.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
getwmiobject_user_account_with_powershell.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
gpupdate_with_no_command_line_arguments_with_network.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
hide_user_account_from_sign_in_screen.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
hiding_files_and_directories_with_attrib_exe.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
impacket_lateral_movement_commandline_parameters.yml
volt_typhoon
2023-05-25 12:16:00 +02:00
java_writing_jsp_file.yml
Release branch v4.16.0
2023-11-16 20:33:10 +00:00
jscript_execution_using_cscript_app.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_account_manipulation_of_ssh_config_and_keys.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_add_files_in_known_crontab_directories.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_add_user_account.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_adding_crontab_using_list_parameter.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_apt_get_privilege_escalation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_apt_privilege_escalation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_at_allow_config_file_creation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_at_application_execution.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_awk_privilege_escalation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_busybox_privilege_escalation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_c89_privilege_escalation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_c99_privilege_escalation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_change_file_owner_to_root.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_clipboard_data_copy.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_common_process_for_elevation_control.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_composer_privilege_escalation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_cpulimit_privilege_escalation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_csvtool_privilege_escalation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_curl_upload_file.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_dd_file_overwrite.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_decode_base64_to_shell.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_deleting_critical_directory_using_rm_command.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_deletion_of_cron_jobs.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_deletion_of_init_daemon_script.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_deletion_of_services.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_deletion_of_ssl_certificate.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_disable_services.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_doas_conf_file_creation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_doas_tool_execution.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_docker_privilege_escalation.yml
converter improvements
2023-01-23 09:38:17 +01:00
linux_edit_cron_table_parameter.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_emacs_privilege_escalation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_file_created_in_kernel_driver_directory.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_file_creation_in_init_boot_directory.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_file_creation_in_profile_directory.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_find_privilege_escalation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_gdb_privilege_escalation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_gem_privilege_escalation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_gnu_awk_privilege_escalation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_ingress_tool_transfer_hunting.yml
converter improvements
2023-01-23 09:38:17 +01:00
linux_ingress_tool_transfer_with_curl.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_insert_kernel_module_using_insmod_utility.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_install_kernel_module_using_modprobe_utility.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_iptables_firewall_modification.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_java_spawning_shell.yml
T1133 Tags + description updates
2023-06-01 13:44:32 -06:00
linux_kernel_module_enumeration.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_kworker_process_in_writable_process_path.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_make_privilege_escalation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_mysql_privilege_escalation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_node_privilege_escalation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_nopasswd_entry_in_sudoers_file.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_obfuscated_files_or_information_base64_decode.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_octave_privilege_escalation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_openvpn_privilege_escalation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_php_privilege_escalation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_pkexec_privilege_escalation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_possible_access_or_modification_of_sshd_config_file.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_possible_access_to_credential_files.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_possible_access_to_sudoers_file.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_possible_append_command_to_at_allow_config_file.yml
Update linux_possible_append_command_to_at_allow_config_file.yml
2023-06-22 16:21:49 -07:00
linux_possible_append_command_to_profile_config_file.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_possible_cronjob_modification_with_editor.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_possible_ssh_key_file_creation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_preload_hijack_library_calls.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_proxy_socks_curl.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_puppet_privilege_escalation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_rpm_privilege_escalation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_ruby_privilege_escalation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_service_file_created_in_systemd_directory.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_service_restarted.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_service_started_or_enabled.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_setuid_using_setcap_utility.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_shred_overwrite_command.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_sqlite3_privilege_escalation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_ssh_authorized_keys_modification.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_ssh_remote_services_script_execute.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_stdout_redirection_to_dev_null_file.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_stop_services.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_sudo_or_su_execution.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_sudoers_tmp_file_creation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_system_network_discovery.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
linux_visudo_utility_execution.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
local_account_discovery_with_net.yml
converter improvements
2023-01-23 09:38:17 +01:00
local_account_discovery_with_wmic.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
logon_script_event_trigger_execution.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
macos___re_opened_applications.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
malicious_powershell_process___encoded_command.yml
converter improvements
2023-01-23 09:38:17 +01:00
malicious_powershell_process_with_obfuscation_techniques.yml
converter improvements
2023-01-23 09:38:17 +01:00
mimikatz_passtheticket_commandline_parameters.yml
converter improvements
2023-01-23 09:38:17 +01:00
mmc_lolbas_execution_process_spawn.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
monitor_registry_keys_for_print_monitors.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
ms_exchange_mailbox_replication_service_writing_active_server_pages.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
msbuild_suspicious_spawned_by_script_process.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
mshta_spawning_rundll32_or_regsvr32_process.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
net_localgroup_discovery.yml
more
2023-05-25 06:07:25 -06:00
net_profiler_uac_bypass.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
network_connection_discovery_with_arp.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
network_connection_discovery_with_net.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
network_connection_discovery_with_netstat.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
network_discovery_using_route_windows_app.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
nishang_powershelltcponeline.yml
converted ssa detections to ocsf
2023-02-28 12:00:16 +01:00
nltest_domain_trust_discovery.yml
converter improvements
2023-01-23 09:38:17 +01:00
ntdsutil_export_ntds.yml
volts
2023-05-25 05:52:07 -06:00
office_application_drop_executable.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
office_application_spawn_regsvr32_process.yml
converter improvements
2023-01-23 09:38:17 +01:00
office_application_spawn_rundll32_process.yml
converter improvements
2023-01-23 09:38:17 +01:00
office_document_spawned_child_process_to_download.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
office_product_spawn_cmd_process.yml
converter improvements
2023-01-23 09:38:17 +01:00
office_product_spawning_bitsadmin.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
office_product_spawning_certutil.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
office_product_spawning_mshta.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
office_product_spawning_rundll32_with_no_dll.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
office_product_spawning_windows_script_host.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
office_product_spawning_wmic.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
office_product_writing_cab_or_inf.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
office_spawning_control.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
outbound_network_connection_from_java_using_default_ports.yml
T1133 Tags + description updates
2023-06-01 13:44:32 -06:00
overwriting_accessibility_binaries.yml
converter improvements
2023-01-23 09:38:17 +01:00
password_policy_discovery_with_net.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
permission_modification_using_takeown_app.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
ping_sleep_batch_command.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
possible_browser_pass_view_parameter.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
possible_lateral_movement_powershell_spawn.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
powershell___connect_to_internet_with_hidden_window.yml
converter improvements
2023-01-23 09:38:17 +01:00
powershell_disable_security_monitoring.yml
converter improvements
2023-01-23 09:38:17 +01:00
powershell_get_localgroup_discovery.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
powershell_start_bitstransfer.yml
converter improvements
2023-01-23 09:38:17 +01:00
prevent_automatic_repair_mode_using_bcdedit.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
print_processor_registry_autostart.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
process_creating_lnk_file_in_suspicious_location.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
process_execution_via_wmi.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
processes_launching_netsh.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
recursive_delete_of_directory_in_batch_cmd.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
reg_exe_manipulating_windows_services_registry_keys.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
registry_keys_for_creating_shim_databases.yml
converter improvements
2023-01-23 09:38:17 +01:00
registry_keys_used_for_persistence.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
registry_keys_used_for_privilege_escalation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
remcos_client_registry_install_entry.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
remcos_rat_file_creation_in_remcos_folder.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
remote_desktop_process_running_on_system.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
remote_process_instantiation_via_dcom_and_powershell.yml
converter improvements
2023-01-23 09:38:17 +01:00
remote_process_instantiation_via_winrm_and_powershell.yml
converter improvements
2023-01-23 09:38:17 +01:00
remote_process_instantiation_via_winrm_and_winrs.yml
converter improvements
2023-01-23 09:38:17 +01:00
remote_process_instantiation_via_wmi_and_powershell.yml
converter improvements
2023-01-23 09:38:17 +01:00
remote_process_instantiation_via_wmi.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
remote_system_discovery_with_dsquery.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
remote_system_discovery_with_net.yml
converter improvements
2023-01-23 09:38:17 +01:00
remote_system_discovery_with_wmic.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
remote_wmi_command_attempt.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
revil_common_exec_parameter.yml
converter improvements
2023-01-23 09:38:17 +01:00
revil_registry_entry.yml
converter improvements
2023-01-23 09:38:17 +01:00
rubeus_command_line_parameters.yml
converter improvements
2023-01-23 09:38:17 +01:00
runas_execution_in_commandline.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
rundll32_lockworkstation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
ryuk_wake_on_lan_command.yml
converter improvements
2023-01-23 09:38:17 +01:00
samsam_test_file_write.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
scheduled_task_creation_on_remote_endpoint_using_at.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
scheduled_task_deleted_or_created_via_cmd.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
scheduled_task_initiation_on_remote_endpoint.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
schtasks_scheduling_job_on_remote_system.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
screensaver_event_trigger_execution.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
script_execution_via_wmi.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
sdclt_uac_bypass.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
searchprotocolhost_with_no_command_line_with_network.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
secretdumps_offline_ntds_dumping_tool.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
serviceprincipalnames_discovery_with_setspn.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
services_escalate_exe.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
services_lolbas_execution_process_spawn.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
shim_database_file_creation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
silentcleanup_uac_bypass.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
slui_runas_elevated.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
slui_spawning_a_process.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
spike_in_file_writes.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
spoolsv_spawning_rundll32.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
spoolsv_writing_a_dll.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
suspicious_copy_on_system32.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
suspicious_curl_network_connection.yml
converted ssa detections to ocsf
2023-02-28 12:00:16 +01:00
suspicious_dllhost_no_command_line_arguments.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
suspicious_gpupdate_no_command_line_arguments.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
suspicious_image_creation_in_appdata_folder.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
suspicious_microsoft_workflow_compiler_rename.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
suspicious_microsoft_workflow_compiler_usage.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
suspicious_msbuild_path.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
suspicious_msbuild_rename.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
suspicious_msbuild_spawn.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
suspicious_mshta_child_process.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
suspicious_mshta_spawn.yml
converter improvements
2023-01-23 09:38:17 +01:00
suspicious_plistbuddy_usage.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
suspicious_process_file_path.yml
converter improvements
2023-01-23 09:38:17 +01:00
suspicious_reg_exe_process.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
suspicious_scheduled_task_from_public_directory.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
suspicious_searchprotocolhost_no_command_line_arguments.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
suspicious_sqlite3_lsquarantine_behavior.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
suspicious_wav_file_in_appdata_folder.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
suspicious_writes_to_windows_recycle_bin.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
svchost_lolbas_execution_process_spawn.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
system_info_gathering_using_dxdiag_application.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
system_information_discovery_detection.yml
converter improvements
2023-01-23 09:38:17 +01:00
system_processes_run_from_unexpected_locations.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
system_user_discovery_with_query.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
system_user_discovery_with_whoami.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
time_provider_persistence_registry.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
uninstall_app_using_msiexec.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
unknown_process_using_the_kerberos_protocol.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
unload_sysmon_filter_driver.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
user_discovery_with_env_vars_powershell.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
usn_journal_deletion.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
vbscript_execution_using_wscript_app.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
w3wp_spawning_shell.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
wbadmin_delete_system_backups.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
wget_download_and_bash_execution.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_adfind_exe.yml
converter improvements
2023-01-23 09:38:17 +01:00
windows_apache_benchmark_binary.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_autostart_execution_lsass_driver_registry_modification.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_binary_proxy_execution_mavinject_dll_injection.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_cached_domain_credentials_reg_query.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_change_default_file_association_for_no_file_ext.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_com_hijacking_inprocserver32_modification.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_command_and_scripting_interpreter_path_traversal_exec.yml
converter improvements
2023-01-23 09:38:17 +01:00
windows_command_shell_fetch_env_variables.yml
converter improvements
2023-01-23 09:38:17 +01:00
windows_credentials_from_password_stores_query.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_credentials_in_registry_reg_query.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_curl_download_to_suspicious_path.yml
The Haagless Horseman
2023-09-11 11:20:03 -06:00
windows_curl_upload_to_remote_destination.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_defacement_modify_transcodedwallpaper_file.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_defender_exclusion_registry_entry.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_deleted_registry_by_a_non_critical_process_file_path.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_disable_change_password_through_registry.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_disable_lock_workstation_feature_through_registry.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_disable_logoff_button_through_registry.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_disable_memory_crash_dump.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_disable_notification_center.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_disable_shutdown_button_through_registry.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_disable_windows_group_policy_features_through_registry.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_disableantispyware_registry.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_diskcryptor_usage.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_diskshadow_proxy_execution.yml
converter improvements
2023-01-23 09:38:17 +01:00
windows_dism_remove_defender.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_dll_search_order_hijacking_hunt.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_dll_search_order_hijacking_with_iscsicpl.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_dll_side_loading_process_child_of_calc.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_execute_arbitrary_commands_with_msdt.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_file_without_extension_in_critical_folder.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_hide_notification_features_through_registry.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_impair_defense_delete_win_defender_context_menu.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_impair_defense_delete_win_defender_profile_registry.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_impair_defense_deny_security_software_with_applocker.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_impair_defenses_disable_win_defender_auto_logging.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_indirect_command_execution_via_forfiles.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_indirect_command_execution_via_pcalua.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_information_discovery_fsutil.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_ingress_tool_transfer_using_explorer.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_installutil_in_non_standard_path.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_installutil_remote_network_connection.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_installutil_uninstall_option_with_network.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_installutil_uninstall_option.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_installutil_url_in_command_line.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_iso_lnk_file_creation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_java_spawning_shells.yml
T1133 Tags + description updates
2023-06-01 13:44:32 -06:00
windows_masquerading_explorer_as_child_process.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_mimikatz_binary_execution.yml
more
2023-05-25 06:07:25 -06:00
windows_modify_registry_disable_toast_notifications.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_modify_registry_disable_win_defender_raw_write_notif.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_modify_registry_disable_windows_security_center_notif.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_modify_registry_disabling_wer_settings.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_modify_registry_disallow_windows_app.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_modify_registry_qakbot_binary_data_registry.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_modify_registry_reg_restore.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_modify_registry_suppress_win_defender_notif.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_modify_show_compress_color_and_info_tip_registry.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_mof_event_triggered_execution_via_wmi.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_mshta_execution_in_registry.yml
converter improvements
2023-01-23 09:38:17 +01:00
windows_msiexec_dllregisterserver.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_msiexec_remote_download.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_msiexec_spawn_discovery_command.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_msiexec_unregister_dllregisterserver.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_msiexec_with_network_connections.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_ngrok_reverse_proxy_usage.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_nirsoft_advancedrun.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_odbcconf_hunting.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_odbcconf_load_dll.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_odbcconf_load_response_file.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_office_product_spawning_msdt.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_os_credential_dumping_security_manager_reg.yml
Migrated all detections to v4
2023-01-03 13:42:10 +01:00
windows_password_managers_discovery.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_phishing_recent_iso_exec_registry.yml
converter improvements
2023-01-23 09:38:17 +01:00
windows_private_keys_discovery.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_process_injection_wermgr_child_process.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_process_with_namedpipe_commandline.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_protocol_tunneling_with_plink.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_query_registry_reg_save.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_raccine_scheduled_task_deletion.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_rasautou_dll_execution.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_registry_certificate_added.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_registry_delete_task_sd.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_registry_modification_for_safe_mode_persistence.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_regsvr32_renamed_binary.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_remote_access_software_hunt.yml
converted ssa detections to ocsf
2023-02-28 12:00:16 +01:00
windows_remote_access_software_rms_registry.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_remote_assistance_spawning_process.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_remote_services_allow_remote_assistance.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_remote_services_rdp_enable.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_schtasks_create_run_as_system.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_security_support_provider_reg_query.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_service_create_kernel_mode_driver.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_service_creation_on_remote_endpoint.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_service_creation_using_registry_entry.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_service_deletion_in_registry.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_service_initiation_on_remote_endpoint.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_service_stop_via_net__and_sc_application.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_steal_or_forge_kerberos_tickets_klist.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_system_discovery_using_ldap_nslookup.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_system_discovery_using_qwinsta.yml
converted ssa detections to ocsf
2023-02-28 12:00:16 +01:00
windows_system_file_on_disk.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_system_network_config_discovery_display_dns.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_system_network_connections_discovery_netsh.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_system_script_proxy_execution_syncappvpublishingserver.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_system_user_discovery_via_quser.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_wmi_process_and_service_list.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
windows_wmi_process_call_create.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
winhlp32_spawning_a_process.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
winrm_spawning_a_process.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
winword_spawning_cmd.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
winword_spawning_powershell.yml
converter improvements
2023-01-23 09:38:17 +01:00
winword_spawning_windows_script_host.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
wmic_group_discovery.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
wmic_noninteractive_app_uninstallation.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
wmic_xsl_execution_via_url.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
wmiprsve_lolbas_execution_process_spawn.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
wscript_or_cscript_suspicious_child_process.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
wsmprovhost_lolbas_execution_process_spawn.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
wsreset_uac_bypass.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00
xsl_script_execution_with_wmic.yml
Added sigma detections into dev folder
2023-01-20 13:24:15 +01:00