FilesExpand file tree

develop

/

macros

/

Copy path

Directory actions

More options

More options

Directory actions

More options

More options

Latest commit

 

History

History

History

 

 

develop

/

macros

/

Copy path

Top

Folders and files

Name		Name	Last commit message	Last commit date
parent directory ..
access_lsass_memory_for_dump_creation_filter.yml		access_lsass_memory_for_dump_creation_filter.yml
attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter.yml		attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter.yml
attempted_credential_dump_from_registry_via_reg_filter.yml		attempted_credential_dump_from_registry_via_reg_filter.yml
attrib_to_hide_files_filter.yml		attrib_to_hide_files_filter.yml
brand_abuse_dns.yml		brand_abuse_dns.yml
brand_abuse_email.yml		brand_abuse_email.yml
brand_abuse_web.yml		brand_abuse_web.yml
change_file_association_filter.yml		change_file_association_filter.yml
children_of_spoolsv_filter.yml		children_of_spoolsv_filter.yml
clients_connecting_to_multiple_dns_servers.yml		clients_connecting_to_multiple_dns_servers.yml
common_ransomware_extensions_filter.yml		common_ransomware_extensions_filter.yml
common_ransomware_notes_filter.yml		common_ransomware_notes_filter.yml
container_implant_aws_detection_filter.yml		container_implant_aws_detection_filter.yml
container_implant_gcp_detection_filter.yml		container_implant_gcp_detection_filter.yml
create_local_admin_via_net_filter.yml		create_local_admin_via_net_filter.yml
create_or_delete_windows_shares.yml		create_or_delete_windows_shares.yml
create_remote_thread_into_lsass_filter.yml		create_remote_thread_into_lsass_filter.yml
creation_of_shadow_copy_filter.yml		creation_of_shadow_copy_filter.yml
creation_of_shadow_copy_with_wmic_and_powershell_filter.yml		creation_of_shadow_copy_with_wmic_and_powershell_filter.yml
cred_dump_via_copy_from_shadowcopy_filter.yml		cred_dump_via_copy_from_shadowcopy_filter.yml
cred_dump_via_symlink_shadowcopy_filter.yml		cred_dump_via_symlink_shadowcopy_filter.yml
detect_activity_related_to_pass_the_hash_attacks_filter.yml		detect_activity_related_to_pass_the_hash_attacks_filter.yml
detect_credential_dumping_through_LSASS_access_filter.yml		detect_credential_dumping_through_LSASS_access_filter.yml
detect_mimikatz_using_loaded_images_filter.yml		detect_mimikatz_using_loaded_images_filter.yml
dns_query_length_mltk_filter.yml		dns_query_length_mltk_filter.yml
dns_query_length_with_high_standard_deviation_filter.yml		dns_query_length_with_high_standard_deviation_filter.yml
dns_record_changed_filter.yml		dns_record_changed_filter.yml
dragonfly_schtasks_filter.yml		dragonfly_schtasks_filter.yml
dump_lsass_via_comsvcs_dll_filter.yml		dump_lsass_via_comsvcs_dll_filter.yml
dynamic_dns_providers.yml		dynamic_dns_providers.yml
dynamic_dns_web_traffic.yml		dynamic_dns_web_traffic.yml
ec2_excessive_runinstances_mltk_input_filter.yml		ec2_excessive_runinstances_mltk_input_filter.yml
ec2_excessive_terminateinstances_mltk_input_filter.yml		ec2_excessive_terminateinstances_mltk_input_filter.yml
ec2_modification_api_calls.yml		ec2_modification_api_calls.yml
evilginx_phishlets_0365.yml		evilginx_phishlets_0365.yml
evilginx_phishlets_amazon.yml		evilginx_phishlets_amazon.yml
evilginx_phishlets_aws.yml		evilginx_phishlets_aws.yml
evilginx_phishlets_facebook.yml		evilginx_phishlets_facebook.yml
evilginx_phishlets_github.yml		evilginx_phishlets_github.yml
evilginx_phishlets_google.yml		evilginx_phishlets_google.yml
evilginx_phishlets_outlook.yml		evilginx_phishlets_outlook.yml
file_write_spikes_filter.yml		file_write_spikes_filter.yml
filter_rare_process_whitelist.yml		filter_rare_process_whitelist.yml
first_time_seen_cmd_line_filter.yml		first_time_seen_cmd_line_filter.yml
is_windows_system_file.yml		is_windows_system_file.yml
lnk_executing_a_process_filter.yml		lnk_executing_a_process_filter.yml
malicious_powershell_process_obfuscation_techniques_output_filter.yml		malicious_powershell_process_obfuscation_techniques_output_filter.yml
network_acl_events.yml		network_acl_events.yml
outbound_smb_connections_filter.yml		outbound_smb_connections_filter.yml
outlook_writing_zip_filter.yml		outlook_writing_zip_filter.yml
previously_seen_cloud_compute_creations_by_user_input_filter.yml		previously_seen_cloud_compute_creations_by_user_input_filter.yml
previously_seen_cloud_compute_creations_by_user_search_window_begin_offset.yml		previously_seen_cloud_compute_creations_by_user_search_window_begin_offset.yml
previously_seen_cloud_compute_image_input_filter.yml		previously_seen_cloud_compute_image_input_filter.yml
previously_seen_cloud_compute_image_search_window_begin_offset.yml		previously_seen_cloud_compute_image_search_window_begin_offset.yml
previously_seen_cloud_compute_instance_types_input_filter.yml		previously_seen_cloud_compute_instance_types_input_filter.yml
previously_seen_cloud_compute_instance_types_search_window_begin_offset.yml		previously_seen_cloud_compute_instance_types_search_window_begin_offset.yml
previously_seen_cloud_regions_input_filter.yml		previously_seen_cloud_regions_input_filter.yml
previously_seen_cloud_regions_search_window_begin_offset.yml		previously_seen_cloud_regions_search_window_begin_offset.yml
prohibited_apps_launching_cmd.yml		prohibited_apps_launching_cmd.yml
prohibited_softwares.yml		prohibited_softwares.yml
ransomware_extensions.yml		ransomware_extensions.yml
ransomware_notes.yml		ransomware_notes.yml
rare_executables_on_endpoint_filter.yml		rare_executables_on_endpoint_filter.yml
remote_desktop_network_traffic_filter.yml		remote_desktop_network_traffic_filter.yml
remote_desktop_process_running_on_system_filter.yml		remote_desktop_process_running_on_system_filter.yml
remove_valid_domains.yml		remove_valid_domains.yml
schtasks_scheduling_job_on_remote_system_filter.yml		schtasks_scheduling_job_on_remote_system_filter.yml
security_content_ctime.yml		security_content_ctime.yml
security_content_summariesonly.yml		security_content_summariesonly.yml
security_group_api_calls.yml		security_group_api_calls.yml
smb_traffic_spike_filter.yml		smb_traffic_spike_filter.yml
smb_traffic_spike_mltk_filter.yml		smb_traffic_spike_mltk_filter.yml
suspicious_email_attachments.yml		suspicious_email_attachments.yml
suspicious_email_attachments_filter.yml		suspicious_email_attachments_filter.yml
suspicious_reg_process_filter.yml		suspicious_reg_process_filter.yml
suspicious_writes.yml		suspicious_writes.yml
sysmon.yml		sysmon.yml
system_network_configuration_discovery_tools.yml		system_network_configuration_discovery_tools.yml
unauthorized_dns_servers_filter.yml		unauthorized_dns_servers_filter.yml
uncommon_processes.yml		uncommon_processes.yml
uncommon_processes_filter.yml		uncommon_processes_filter.yml
unload_sysmon_filter_driver_filter.yml		unload_sysmon_filter_driver_filter.yml
unsigned_image_loaded_by_LSASS_filter.yml		unsigned_image_loaded_by_LSASS_filter.yml
unusually_long_commandlines_filter.yml		unusually_long_commandlines_filter.yml
wineventlog_security.yml		wineventlog_security.yml
wmi_process_launch_filter.yml		wmi_process_launch_filter.yml
wmi_script_execution_filter.yml		wmi_script_execution_filter.yml
View all files