FilesExpand file tree

develop

/

stories

/

Copy path

Directory actions

More options

More options

Directory actions

More options

More options

Latest commit

 

History

History

History

 

 

develop

/

stories

/

Copy path

Top

Folders and files

Name		Name	Last commit message	Last commit date
parent directory ..
deprecated		deprecated
Icedid.yml		Icedid.yml
active_directory_discovery.yml		active_directory_discovery.yml
active_directory_lateral_movement.yml		active_directory_lateral_movement.yml
active_directory_password_spraying.yml		active_directory_password_spraying.yml
apache_struts_vulnerability.yml		apache_struts_vulnerability.yml
asset_tracking.yml		asset_tracking.yml
aws_cross_account_activity.yml		aws_cross_account_activity.yml
aws_iam_privilege_escalation.yml		aws_iam_privilege_escalation.yml
aws_network_acl_activity.yml		aws_network_acl_activity.yml
aws_security_hub_alerts.yml		aws_security_hub_alerts.yml
aws_user_monitoring.yml		aws_user_monitoring.yml
baron_samedit_cve_2021_3156.yml		baron_samedit_cve_2021_3156.yml
bits_jobs.yml		bits_jobs.yml
brand_monitoring.yml		brand_monitoring.yml
cloud_cryptomining.yml		cloud_cryptomining.yml
cloud_federated_credential_abuse.yml		cloud_federated_credential_abuse.yml
cobalt_strike.yml		cobalt_strike.yml
coldroot_macos_rat.yml		coldroot_macos_rat.yml
collection_and_staging.yml		collection_and_staging.yml
command_and_control.yml		command_and_control.yml
container_implantation_monitoring_and_investigation.yml		container_implantation_monitoring_and_investigation.yml
credential_dumping.yml		credential_dumping.yml
data_exfiltration.yml		data_exfiltration.yml
data_protection.yml		data_protection.yml
deobfuscate_decode_files_or_information.yml		deobfuscate_decode_files_or_information.yml
detect_zerologon_attack.yml		detect_zerologon_attack.yml
dev_sec_ops.yml		dev_sec_ops.yml
dhs_report_ta18_074a.yml		dhs_report_ta18_074a.yml
disabling_security_tools.yml		disabling_security_tools.yml
dns_amplification_attacks.yml		dns_amplification_attacks.yml
dns_hijacking.yml		dns_hijacking.yml
domain_controller_impersonation_&_samaccountname_spoofing.yml		domain_controller_impersonation_&_samaccountname_spoofing.yml
domain_trust_discovery.yml		domain_trust_discovery.yml
dynamic_dns.yml		dynamic_dns.yml
emotet_malware__dhs_report_ta18_201a_.yml		emotet_malware__dhs_report_ta18_201a_.yml
f5_tmui_rce_cve_2020_5902.yml		f5_tmui_rce_cve_2020_5902.yml
fin7.yml		fin7.yml
gcp_cross_account_activity.yml		gcp_cross_account_activity.yml
hafnium_group.yml		hafnium_group.yml
hidden_cobra_malware.yml		hidden_cobra_malware.yml
information_sabotage.yml		information_sabotage.yml
ingress_tool_transfer.yml		ingress_tool_transfer.yml
jboss_vulnerability.yml		jboss_vulnerability.yml
kubernetes_scanning_activity.yml		kubernetes_scanning_activity.yml
kubernetes_sensitive_object_access_activity.yml		kubernetes_sensitive_object_access_activity.yml
log4shell_cve_2021_44228.yml		log4shell_cve_2021_44228.yml
malicious_powershell.yml		malicious_powershell.yml
masquerading___rename_system_utilities.yml		masquerading___rename_system_utilities.yml
meterpreter.yml		meterpreter.yml
microsoft_mshtml_remote_code_execution_cve_2021_40444.yml		microsoft_mshtml_remote_code_execution_cve_2021_40444.yml
monitor_for_updates.yml		monitor_for_updates.yml
netsh_abuse.yml		netsh_abuse.yml
nobelium_group.yml		nobelium_group.yml
office_365_detections.yml		office_365_detections.yml
orangeworm_attack_group.yml		orangeworm_attack_group.yml
petitpotam_ntlm_relay_on_active_directory_certificate_services.yml		petitpotam_ntlm_relay_on_active_directory_certificate_services.yml
possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.yml		possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.yml
printnightmare_cve_2021_34527.yml		printnightmare_cve_2021_34527.yml
prohibited_traffic_allowed_or_protocol_mismatch.yml		prohibited_traffic_allowed_or_protocol_mismatch.yml
proxyshell.yml		proxyshell.yml
ransomware.yml		ransomware.yml
ransomware_blackmatter.yml		ransomware_blackmatter.yml
ransomware_clop.yml		ransomware_clop.yml
ransomware_cloud.yml		ransomware_cloud.yml
ransomware_darkside.yml		ransomware_darkside.yml
ransomware_revil.yml		ransomware_revil.yml
ransomware_ryuk.yml		ransomware_ryuk.yml
ransomware_samsam.yml		ransomware_samsam.yml
remcos.yml		remcos.yml
router_and_infrastructure_security.yml		router_and_infrastructure_security.yml
signed_binary_proxy_execution_installutil.yml		signed_binary_proxy_execution_installutil.yml
silver_sparrow.yml		silver_sparrow.yml
spearphishing_attachments.yml		spearphishing_attachments.yml
sql_injection.yml		sql_injection.yml
suspicious_aws_login_activities.yml		suspicious_aws_login_activities.yml
suspicious_aws_s3_activities.yml		suspicious_aws_s3_activities.yml
suspicious_aws_traffic.yml		suspicious_aws_traffic.yml
suspicious_cloud_authentication_activities.yml		suspicious_cloud_authentication_activities.yml
suspicious_cloud_instance_activities.yml		suspicious_cloud_instance_activities.yml
suspicious_cloud_provisioning_activities.yml		suspicious_cloud_provisioning_activities.yml
suspicious_cloud_user_activities.yml		suspicious_cloud_user_activities.yml
suspicious_command_line_executions.yml		suspicious_command_line_executions.yml
suspicious_compiled_html_activity.yml		suspicious_compiled_html_activity.yml
suspicious_dns_traffic.yml		suspicious_dns_traffic.yml
suspicious_emails.yml		suspicious_emails.yml
suspicious_gcp_storage_activities.yml		suspicious_gcp_storage_activities.yml
suspicious_mshta_activity.yml		suspicious_mshta_activity.yml
suspicious_okta_activity.yml		suspicious_okta_activity.yml
suspicious_regsvcs_regasm_activity.yml		suspicious_regsvcs_regasm_activity.yml
suspicious_regsvr32_activity.yml		suspicious_regsvr32_activity.yml
suspicious_rundll32_activity.yml		suspicious_rundll32_activity.yml
suspicious_windows_registry_activities.yml		suspicious_windows_registry_activities.yml
suspicious_wmi_use.yml		suspicious_wmi_use.yml
suspicious_zoom_child_processes.yml		suspicious_zoom_child_processes.yml
trickbot.yml		trickbot.yml
trusted_developer_utilities_proxy_execution.yml		trusted_developer_utilities_proxy_execution.yml
trusted_developer_utilities_proxy_execution_msbuild.yml		trusted_developer_utilities_proxy_execution_msbuild.yml
unusual_processes.yml		unusual_processes.yml
use_of_cleartext_protocols.yml		use_of_cleartext_protocols.yml
View all files