FilesExpand file tree

develop

/

detections

/

Copy path

Directory actions

More options

More options

Directory actions

More options

More options

Latest commit

 

History

History

History

 

 

develop

/

detections

/

Copy path

Top

Folders and files

Name		Name	Last commit message	Last commit date
parent directory ..
abnormally_high_aws_instances_launched_by_user.yml		abnormally_high_aws_instances_launched_by_user.yml
abnormally_high_aws_instances_launched_by_user___mltk.yml		abnormally_high_aws_instances_launched_by_user___mltk.yml
abnormally_high_aws_instances_terminated_by_user.yml		abnormally_high_aws_instances_terminated_by_user.yml
abnormally_high_aws_instances_terminated_by_user___mltk.yml		abnormally_high_aws_instances_terminated_by_user___mltk.yml
abnormally_high_number_of_cloud_infrastructure_api_calls.yml		abnormally_high_number_of_cloud_infrastructure_api_calls.yml
abnormally_high_number_of_cloud_instances_destroyed.yml		abnormally_high_number_of_cloud_instances_destroyed.yml
abnormally_high_number_of_cloud_instances_launched.yml		abnormally_high_number_of_cloud_instances_launched.yml
abnormally_high_number_of_cloud_security_group_api_calls.yml		abnormally_high_number_of_cloud_security_group_api_calls.yml
account_discovery_with_net_app.yml		account_discovery_with_net_app.yml
any_powershell_downloadfile.yml		any_powershell_downloadfile.yml
any_powershell_downloadstring.yml		any_powershell_downloadstring.yml
asl_aws_createaccesskey.yml		asl_aws_createaccesskey.yml
asl_aws_excessive_security_scanning.yml		asl_aws_excessive_security_scanning.yml
asl_aws_password_policy_changes.yml		asl_aws_password_policy_changes.yml
attempt_to_add_certificate_to_untrusted_store.yml		attempt_to_add_certificate_to_untrusted_store.yml
attempt_to_stop_security_service.yml		attempt_to_stop_security_service.yml
attempted_credential_dump_from_registry_via_reg_exe.yml		attempted_credential_dump_from_registry_via_reg_exe.yml
aws_cloud_provisioning_from_previously_unseen_city.yml		aws_cloud_provisioning_from_previously_unseen_city.yml
aws_cloud_provisioning_from_previously_unseen_country.yml		aws_cloud_provisioning_from_previously_unseen_country.yml
aws_cloud_provisioning_from_previously_unseen_ip_address.yml		aws_cloud_provisioning_from_previously_unseen_ip_address.yml
aws_cloud_provisioning_from_previously_unseen_region.yml		aws_cloud_provisioning_from_previously_unseen_region.yml
aws_cross_account_activity_from_previously_unseen_account.yml		aws_cross_account_activity_from_previously_unseen_account.yml
aws_detect_attach_to_role_policy.yml		aws_detect_attach_to_role_policy.yml
aws_detect_permanent_key_creation.yml		aws_detect_permanent_key_creation.yml
aws_detect_role_creation.yml		aws_detect_role_creation.yml
aws_detect_sts_assume_role_abuse.yml		aws_detect_sts_assume_role_abuse.yml
aws_detect_sts_get_session_token_abuse.yml		aws_detect_sts_get_session_token_abuse.yml
aws_eks_kubernetes_cluster_sensitive_object_access.yml		aws_eks_kubernetes_cluster_sensitive_object_access.yml
aws_saml_access_by_provider_user_and_principal.yml		aws_saml_access_by_provider_user_and_principal.yml
certutil_download_with_urlcache_and_split_arguments.yml		certutil_download_with_urlcache_and_split_arguments.yml
certutil_download_with_verifyctl_and_split_arguments.yml		certutil_download_with_verifyctl_and_split_arguments.yml
change_default_file_association.yml		change_default_file_association.yml
chcp_command_execution.yml		chcp_command_execution.yml
cisco_secure_application_alerts.yml		cisco_secure_application_alerts.yml
clients_connecting_to_multiple_dns_servers.yml		clients_connecting_to_multiple_dns_servers.yml
cloud_network_access_control_list_deleted.yml		cloud_network_access_control_list_deleted.yml
cmdline_tool_not_executed_in_cmd_shell.yml		cmdline_tool_not_executed_in_cmd_shell.yml
cobalt_strike_named_pipes.yml		cobalt_strike_named_pipes.yml
correlation_by_repository_and_risk.yml		correlation_by_repository_and_risk.yml
correlation_by_user_and_risk.yml		correlation_by_user_and_risk.yml
create_local_admin_accounts_using_net_exe.yml		create_local_admin_accounts_using_net_exe.yml
curl_download_and_bash_execution.yml		curl_download_and_bash_execution.yml
deleting_of_net_users.yml		deleting_of_net_users.yml
detect_activity_related_to_pass_the_hash_attacks.yml		detect_activity_related_to_pass_the_hash_attacks.yml
detect_api_activity_from_users_without_mfa.yml		detect_api_activity_from_users_without_mfa.yml
detect_aws_api_activities_from_unapproved_accounts.yml		detect_aws_api_activities_from_unapproved_accounts.yml
detect_critical_alerts_from_security_tools.yml		detect_critical_alerts_from_security_tools.yml
detect_dga_domains_using_pretrained_model_in_dsdl.yml		detect_dga_domains_using_pretrained_model_in_dsdl.yml
detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml		detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml
detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml		detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml
detect_large_outbound_icmp_packets.yml		detect_large_outbound_icmp_packets.yml
detect_long_dns_txt_record_response.yml		detect_long_dns_txt_record_response.yml
detect_mimikatz_using_loaded_images.yml		detect_mimikatz_using_loaded_images.yml
detect_mimikatz_via_powershell_and_eventcode_4703.yml		detect_mimikatz_via_powershell_and_eventcode_4703.yml
detect_new_api_calls_from_user_roles.yml		detect_new_api_calls_from_user_roles.yml
detect_new_user_aws_console_login.yml		detect_new_user_aws_console_login.yml
detect_processes_used_for_system_network_configuration_discovery.yml		detect_processes_used_for_system_network_configuration_discovery.yml
detect_risky_spl_using_pretrained_ml_model.yml		detect_risky_spl_using_pretrained_ml_model.yml
detect_rundll32_application_control_bypass___advpack.yml		detect_rundll32_application_control_bypass___advpack.yml
detect_rundll32_application_control_bypass___setupapi.yml		detect_rundll32_application_control_bypass___setupapi.yml
detect_rundll32_application_control_bypass___syssetup.yml		detect_rundll32_application_control_bypass___syssetup.yml
detect_spike_in_aws_api_activity.yml		detect_spike_in_aws_api_activity.yml
detect_spike_in_network_acl_activity.yml		detect_spike_in_network_acl_activity.yml
detect_spike_in_security_group_activity.yml		detect_spike_in_security_group_activity.yml
detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml		detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml
detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml		detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml
detect_usb_device_insertion.yml		detect_usb_device_insertion.yml
detect_web_traffic_to_dynamic_domain_providers.yml		detect_web_traffic_to_dynamic_domain_providers.yml
detect_webshell_exploit_behavior.yml		detect_webshell_exploit_behavior.yml
detection_of_dns_tunnels.yml		detection_of_dns_tunnels.yml
disabling_net_user_account.yml		disabling_net_user_account.yml
dns_query_length_outliers___mltk.yml		dns_query_length_outliers___mltk.yml
dns_query_requests_resolved_by_unauthorized_dns_servers.yml		dns_query_requests_resolved_by_unauthorized_dns_servers.yml
dns_record_changed.yml		dns_record_changed.yml
domain_account_discovery_with_net_app.yml		domain_account_discovery_with_net_app.yml
domain_group_discovery_with_net.yml		domain_group_discovery_with_net.yml
dump_lsass_via_procdump_rename.yml		dump_lsass_via_procdump_rename.yml
ec2_instance_modified_with_previously_unseen_user.yml		ec2_instance_modified_with_previously_unseen_user.yml
ec2_instance_started_in_previously_unseen_region.yml		ec2_instance_started_in_previously_unseen_region.yml
ec2_instance_started_with_previously_unseen_ami.yml		ec2_instance_started_with_previously_unseen_ami.yml
ec2_instance_started_with_previously_unseen_instance_type.yml		ec2_instance_started_with_previously_unseen_instance_type.yml
ec2_instance_started_with_previously_unseen_user.yml		ec2_instance_started_with_previously_unseen_user.yml
elevated_group_discovery_with_net.yml		elevated_group_discovery_with_net.yml
excel_spawning_powershell.yml		excel_spawning_powershell.yml
excel_spawning_windows_script_host.yml		excel_spawning_windows_script_host.yml
excessive_service_stop_attempt.yml		excessive_service_stop_attempt.yml
excessive_usage_of_net_app.yml		excessive_usage_of_net_app.yml
execution_of_file_with_spaces_before_extension.yml		execution_of_file_with_spaces_before_extension.yml
extended_period_without_successful_netbackup_backups.yml		extended_period_without_successful_netbackup_backups.yml
extraction_of_registry_hives.yml		extraction_of_registry_hives.yml
first_time_seen_command_line_argument.yml		first_time_seen_command_line_argument.yml
gcp_detect_accounts_with_high_risk_roles_by_project.yml		gcp_detect_accounts_with_high_risk_roles_by_project.yml
gcp_detect_high_risk_permissions_by_resource_and_account.yml		gcp_detect_high_risk_permissions_by_resource_and_account.yml
gcp_detect_oauth_token_abuse.yml		gcp_detect_oauth_token_abuse.yml
gcp_kubernetes_cluster_scan_detection.yml		gcp_kubernetes_cluster_scan_detection.yml
github_actions_disable_security_workflow.yml		github_actions_disable_security_workflow.yml
github_commit_changes_in_master.yml		github_commit_changes_in_master.yml
github_commit_in_develop.yml		github_commit_in_develop.yml
github_dependabot_alert.yml		github_dependabot_alert.yml
github_pull_request_from_unknown_user.yml		github_pull_request_from_unknown_user.yml
View all files