FilesExpand file tree

develop

/

deprecated

/

Copy path

Directory actions

More options

More options

Directory actions

More options

More options

Latest commit

 

History

History

History

 

 

develop

/

deprecated

/

Copy path

Top

Folders and files

Name		Name	Last commit message	Last commit date
parent directory ..
.gitkeep		.gitkeep
abnormally_high_aws_instances_launched_by_user.yml		abnormally_high_aws_instances_launched_by_user.yml
abnormally_high_aws_instances_launched_by_user___mltk.yml		abnormally_high_aws_instances_launched_by_user___mltk.yml
abnormally_high_aws_instances_terminated_by_user.yml		abnormally_high_aws_instances_terminated_by_user.yml
abnormally_high_aws_instances_terminated_by_user___mltk.yml		abnormally_high_aws_instances_terminated_by_user___mltk.yml
add_prohibited_processes_to_enterprise_security.yml		add_prohibited_processes_to_enterprise_security.yml
aws_cloud_provisioning_from_previously_unseen_city.yml		aws_cloud_provisioning_from_previously_unseen_city.yml
aws_cloud_provisioning_from_previously_unseen_country.yml		aws_cloud_provisioning_from_previously_unseen_country.yml
aws_cloud_provisioning_from_previously_unseen_ip_address.yml		aws_cloud_provisioning_from_previously_unseen_ip_address.yml
aws_cloud_provisioning_from_previously_unseen_region.yml		aws_cloud_provisioning_from_previously_unseen_region.yml
baseline_of_api_calls_per_user_arn.yml		baseline_of_api_calls_per_user_arn.yml
baseline_of_excessive_aws_instances_launched_by_user___mltk.yml		baseline_of_excessive_aws_instances_launched_by_user___mltk.yml
baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml		baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml
clients_connecting_to_multiple_dns_servers.yml		clients_connecting_to_multiple_dns_servers.yml
cloud_network_access_control_list_deleted.yml		cloud_network_access_control_list_deleted.yml
detect_api_activity_from_users_without_mfa.yml		detect_api_activity_from_users_without_mfa.yml
detect_aws_api_activities_from_unapproved_accounts.yml		detect_aws_api_activities_from_unapproved_accounts.yml
detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml		detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml
detect_long_dns_txt_record_response.yml		detect_long_dns_txt_record_response.yml
detect_mimikatz_via_powershell_and_eventcode_4703.yml		detect_mimikatz_via_powershell_and_eventcode_4703.yml
detect_new_api_calls_from_user_roles.yml		detect_new_api_calls_from_user_roles.yml
detect_new_user_aws_console_login.yml		detect_new_user_aws_console_login.yml
detect_spike_in_aws_api_activity.yml		detect_spike_in_aws_api_activity.yml
detect_spike_in_network_acl_activity.yml		detect_spike_in_network_acl_activity.yml
detect_spike_in_security_group_activity.yml		detect_spike_in_security_group_activity.yml
detect_usb_device_insertion.yml		detect_usb_device_insertion.yml
detect_web_traffic_to_dynamic_domain_providers.yml		detect_web_traffic_to_dynamic_domain_providers.yml
detection_of_dns_tunnels.yml		detection_of_dns_tunnels.yml
dns_query_requests_resolved_by_unauthorized_dns_servers.yml		dns_query_requests_resolved_by_unauthorized_dns_servers.yml
dns_record_changed.yml		dns_record_changed.yml
dump_lsass_via_procdump_rename.yml		dump_lsass_via_procdump_rename.yml
ec2_instance_modified_with_previously_unseen_user.yml		ec2_instance_modified_with_previously_unseen_user.yml
ec2_instance_started_in_previously_unseen_region.yml		ec2_instance_started_in_previously_unseen_region.yml
ec2_instance_started_with_previously_unseen_ami.yml		ec2_instance_started_with_previously_unseen_ami.yml
ec2_instance_started_with_previously_unseen_instance_type.yml		ec2_instance_started_with_previously_unseen_instance_type.yml
ec2_instance_started_with_previously_unseen_user.yml		ec2_instance_started_with_previously_unseen_user.yml
execution_of_file_with_spaces_before_extension.yml		execution_of_file_with_spaces_before_extension.yml
extended_period_without_successful_netbackup_backups.yml		extended_period_without_successful_netbackup_backups.yml
first_time_seen_command_line_argument.yml		first_time_seen_command_line_argument.yml
gcp_detect_accounts_with_high_risk_roles_by_project.yml		gcp_detect_accounts_with_high_risk_roles_by_project.yml
gcp_detect_high_risk_permissions_by_resource_and_account.yml		gcp_detect_high_risk_permissions_by_resource_and_account.yml
gcp_detect_oauth_token_abuse.yml		gcp_detect_oauth_token_abuse.yml
gcp_gcr_container_uploaded.yml		gcp_gcr_container_uploaded.yml
gcp_kubernetes_cluster_scan_detection.yml		gcp_kubernetes_cluster_scan_detection.yml
identify_new_user_accounts.yml		identify_new_user_accounts.yml
kubernetes_aws_detect_most_active_service_accounts_by_pod.yml		kubernetes_aws_detect_most_active_service_accounts_by_pod.yml
kubernetes_aws_detect_rbac_authorizations_by_account.yml		kubernetes_aws_detect_rbac_authorizations_by_account.yml
kubernetes_aws_detect_sensitive_object_access.yml		kubernetes_aws_detect_sensitive_object_access.yml
kubernetes_aws_detect_sensitive_role_access.yml		kubernetes_aws_detect_sensitive_role_access.yml
kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml		kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml
kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml		kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml
kubernetes_azure_detect_rbac_authorization_by_account.yml		kubernetes_azure_detect_rbac_authorization_by_account.yml
kubernetes_azure_detect_sensitive_object_access.yml		kubernetes_azure_detect_sensitive_object_access.yml
kubernetes_azure_detect_sensitive_role_access.yml		kubernetes_azure_detect_sensitive_role_access.yml
kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml		kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml
kubernetes_azure_detect_suspicious_kubectl_calls.yml		kubernetes_azure_detect_suspicious_kubectl_calls.yml
kubernetes_azure_pod_scan_fingerprint.yml		kubernetes_azure_pod_scan_fingerprint.yml
kubernetes_azure_scan_fingerprint.yml		kubernetes_azure_scan_fingerprint.yml
kubernetes_gcp_detect_RBAC_authorizations_by_account.yml		kubernetes_gcp_detect_RBAC_authorizations_by_account.yml
kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml		kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml
kubernetes_gcp_detect_sensitive_object_access.yml		kubernetes_gcp_detect_sensitive_object_access.yml
kubernetes_gcp_detect_sensitive_role_access.yml		kubernetes_gcp_detect_sensitive_role_access.yml
kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml		kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml
kubernetes_gcp_detect_suspicious_kubectl_calls.yml		kubernetes_gcp_detect_suspicious_kubectl_calls.yml
malicious_powershell_process___multiple_suspicious_command_line_arguments.yml		malicious_powershell_process___multiple_suspicious_command_line_arguments.yml
monitor_dns_for_brand_abuse.yml		monitor_dns_for_brand_abuse.yml
open_redirect_in_splunk_web.yml		open_redirect_in_splunk_web.yml
osquery_pack___coldroot_detection.yml		osquery_pack___coldroot_detection.yml
previously_seen_api_call_per_user_roles_in_cloudtrail.yml		previously_seen_api_call_per_user_roles_in_cloudtrail.yml
previously_seen_aws_provisioning_activity_sources.yml		previously_seen_aws_provisioning_activity_sources.yml
previously_seen_ec2_amis.yml		previously_seen_ec2_amis.yml
previously_seen_ec2_instance_types.yml		previously_seen_ec2_instance_types.yml
previously_seen_ec2_launches_by_user.yml		previously_seen_ec2_launches_by_user.yml
previously_seen_users_in_cloudtrail.yml		previously_seen_users_in_cloudtrail.yml
processes_created_by_netsh.yml		processes_created_by_netsh.yml
prohibited_software_on_endpoint.yml		prohibited_software_on_endpoint.yml
reg_exe_used_to_hide_files_directories_via_registry_keys.yml		reg_exe_used_to_hide_files_directories_via_registry_keys.yml
remote_registry_key_modifications.yml		remote_registry_key_modifications.yml
scheduled_tasks_used_in_badrabbit_ransomware.yml		scheduled_tasks_used_in_badrabbit_ransomware.yml
spectre_and_meltdown_vulnerable_systems.yml		spectre_and_meltdown_vulnerable_systems.yml
splunk_enterprise_information_disclosure.yml		splunk_enterprise_information_disclosure.yml
ssa___applying_stolen_credentials_via_mimikatz_modules.yml		ssa___applying_stolen_credentials_via_mimikatz_modules.yml
ssa___applying_stolen_credentials_via_powersploit_modules.yml		ssa___applying_stolen_credentials_via_powersploit_modules.yml
ssa___assess_credential_strength_via_dsinternals_modules.yml		ssa___assess_credential_strength_via_dsinternals_modules.yml
ssa___credential_extraction_dsinternals_conversion_modules.yml		ssa___credential_extraction_dsinternals_conversion_modules.yml
ssa___credential_extraction_dsinternals_modules.yml		ssa___credential_extraction_dsinternals_modules.yml
ssa___credential_extraction_fgdump_cachedump_s_option.yml		ssa___credential_extraction_fgdump_cachedump_s_option.yml
ssa___credential_extraction_fgdump_cachedump_v_option.yml		ssa___credential_extraction_fgdump_cachedump_v_option.yml
ssa___credential_extraction_getaddbaccount_from_dump.yml		ssa___credential_extraction_getaddbaccount_from_dump.yml
ssa___credential_extraction_lazagne_command_options.yml		ssa___credential_extraction_lazagne_command_options.yml
ssa___credential_extraction_mimikatz_modules.yml		ssa___credential_extraction_mimikatz_modules.yml
ssa___credential_extraction_ms_debuggers_kernel_peek.yml		ssa___credential_extraction_ms_debuggers_kernel_peek.yml
ssa___credential_extraction_ms_debuggers_z_option.yml		ssa___credential_extraction_ms_debuggers_z_option.yml
ssa___credential_extraction_powersploit_modules.yml		ssa___credential_extraction_powersploit_modules.yml
ssa___detect_pass_hash.yml		ssa___detect_pass_hash.yml
ssa___illegal_access_user_content_via_powersploit_modules.yml		ssa___illegal_access_user_content_via_powersploit_modules.yml
ssa___illegal_account_creation_via_powersploit_modules.yml		ssa___illegal_account_creation_via_powersploit_modules.yml
ssa___illegal_account_enable_disable_via_dsinternals_modules.yml		ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
ssa___illegal_log_deletion_via_mimikatz_modules.yml		ssa___illegal_log_deletion_via_mimikatz_modules.yml
ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml		ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
View all files