FilesExpand file tree

develop

/

detections

/

Copy path

Directory actions

More options

More options

Directory actions

More options

More options

Latest commit

 

History

History

History

 

 

develop

/

detections

/

Copy path

Top

Folders and files

Name		Name	Last commit message	Last commit date
parent directory ..
abnormally_high_aws_instances_launched_by_user.yml		abnormally_high_aws_instances_launched_by_user.yml
abnormally_high_aws_instances_launched_by_user___mltk.yml		abnormally_high_aws_instances_launched_by_user___mltk.yml
abnormally_high_aws_instances_terminated_by_user.yml		abnormally_high_aws_instances_terminated_by_user.yml
abnormally_high_aws_instances_terminated_by_user___mltk.yml		abnormally_high_aws_instances_terminated_by_user___mltk.yml
access_lsass_memory_for_dump_creation.yml		access_lsass_memory_for_dump_creation.yml
amazon_eks_kubernetes_cluster_scan_detection.yml		amazon_eks_kubernetes_cluster_scan_detection.yml
amazon_eks_kubernetes_pod_scan_detection.yml		amazon_eks_kubernetes_pod_scan_detection.yml
attempt_to_add_certificate_to_untrusted_store.yml		attempt_to_add_certificate_to_untrusted_store.yml
attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml		attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
attempt_to_stop_security_service.yml		attempt_to_stop_security_service.yml
attempted_credential_dump_from_registry_via_reg_exe.yml		attempted_credential_dump_from_registry_via_reg_exe.yml
aws_cloud_provisioning_from_previously_unseen_city.yml		aws_cloud_provisioning_from_previously_unseen_city.yml
aws_cloud_provisioning_from_previously_unseen_country.yml		aws_cloud_provisioning_from_previously_unseen_country.yml
aws_cloud_provisioning_from_previously_unseen_ip_address.yml		aws_cloud_provisioning_from_previously_unseen_ip_address.yml
aws_cloud_provisioning_from_previously_unseen_region.yml		aws_cloud_provisioning_from_previously_unseen_region.yml
aws_cross_account_activity_from_previously_unseen_account.yml		aws_cross_account_activity_from_previously_unseen_account.yml
aws_network_access_control_list_created_with_all_open_ports.yml		aws_network_access_control_list_created_with_all_open_ports.yml
aws_network_access_control_list_deleted.yml		aws_network_access_control_list_deleted.yml
batch_file_write_to_system32.yml		batch_file_write_to_system32.yml
child_processes_of_spoolsv_exe.yml		child_processes_of_spoolsv_exe.yml
clients_connecting_to_multiple_dns_servers.yml		clients_connecting_to_multiple_dns_servers.yml
cloud_compute_instance_created_by_previously_unseen_user.yml		cloud_compute_instance_created_by_previously_unseen_user.yml
cloud_compute_instance_created_with_previously_unseen_image.yml		cloud_compute_instance_created_with_previously_unseen_image.yml
cloud_compute_instance_created_with_previously_unseen_instance_type.yml		cloud_compute_instance_created_with_previously_unseen_instance_type.yml
cloud_compute_instance_started_in_previously_unused_region.yml		cloud_compute_instance_started_in_previously_unused_region.yml
common_ransomware_extensions.yml		common_ransomware_extensions.yml
common_ransomware_notes.yml		common_ransomware_notes.yml
create_local_admin_accounts_using_net_exe.yml		create_local_admin_accounts_using_net_exe.yml
create_or_delete_windows_shares_using_net_exe.yml		create_or_delete_windows_shares_using_net_exe.yml
create_remote_thread_into_lsass.yml		create_remote_thread_into_lsass.yml
creation_of_shadow_copy.yml		creation_of_shadow_copy.yml
creation_of_shadow_copy_with_wmic_and_powershell.yml		creation_of_shadow_copy_with_wmic_and_powershell.yml
credential_dumping_via_copy_command_from_shadow_copy.yml		credential_dumping_via_copy_command_from_shadow_copy.yml
credential_dumping_via_symlink_to_shadow_copy.yml		credential_dumping_via_symlink_to_shadow_copy.yml
deleting_shadow_copies.yml		deleting_shadow_copies.yml
detect_activity_related_to_pass_the_hash_attacks.yml		detect_activity_related_to_pass_the_hash_attacks.yml
detect_api_activity_from_users_without_mfa.yml		detect_api_activity_from_users_without_mfa.yml
detect_attackers_scanning_for_vulnerable_jboss_servers.yml		detect_attackers_scanning_for_vulnerable_jboss_servers.yml
detect_aws_api_activities_from_unapproved_accounts.yml		detect_aws_api_activities_from_unapproved_accounts.yml
detect_aws_console_login_by_user_from_new_city.yml		detect_aws_console_login_by_user_from_new_city.yml
detect_aws_console_login_by_user_from_new_country.yml		detect_aws_console_login_by_user_from_new_country.yml
detect_aws_console_login_by_user_from_new_region.yml		detect_aws_console_login_by_user_from_new_region.yml
detect_credential_dumping_through_lsass_access.yml		detect_credential_dumping_through_lsass_access.yml
detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml		detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml
detect_excessive_account_lockouts_from_endpoint.yml		detect_excessive_account_lockouts_from_endpoint.yml
detect_excessive_user_account_lockouts.yml		detect_excessive_user_account_lockouts.yml
detect_hosts_connecting_to_dynamic_domain_providers.yml		detect_hosts_connecting_to_dynamic_domain_providers.yml
detect_large_outbound_icmp_packets.yml		detect_large_outbound_icmp_packets.yml
detect_long_dns_txt_record_response.yml		detect_long_dns_txt_record_response.yml
detect_malicious_requests_to_exploit_jboss_servers.yml		detect_malicious_requests_to_exploit_jboss_servers.yml
detect_mimikatz_using_loaded_images.yml		detect_mimikatz_using_loaded_images.yml
detect_mimikatz_via_powershell_and_eventcode_4703.yml		detect_mimikatz_via_powershell_and_eventcode_4703.yml
detect_mshta_exe_running_scripts_in_command_line_arguments.yml		detect_mshta_exe_running_scripts_in_command_line_arguments.yml
detect_new_api_calls_from_user_roles.yml		detect_new_api_calls_from_user_roles.yml
detect_new_local_admin_account.yml		detect_new_local_admin_account.yml
detect_new_login_attempts_to_routers.yml		detect_new_login_attempts_to_routers.yml
detect_new_open_s3_buckets.yml		detect_new_open_s3_buckets.yml
detect_new_user_aws_console_login.yml		detect_new_user_aws_console_login.yml
detect_new_user_aws_console_login___dm.yml		detect_new_user_aws_console_login___dm.yml
detect_oulook_exe_writing_a__zip_file.yml		detect_oulook_exe_writing_a__zip_file.yml
detect_outbound_smb_traffic.yml		detect_outbound_smb_traffic.yml
detect_path_interception_by_creation_of_program_exe.yml		detect_path_interception_by_creation_of_program_exe.yml
detect_processes_used_for_system_network_configuration_discovery.yml		detect_processes_used_for_system_network_configuration_discovery.yml
detect_prohibited_applications_spawning_cmd_exe.yml		detect_prohibited_applications_spawning_cmd_exe.yml
detect_psexec_with_accepteula_flag.yml		detect_psexec_with_accepteula_flag.yml
detect_rare_executables.yml		detect_rare_executables.yml
detect_s3_access_from_a_new_ip.yml		detect_s3_access_from_a_new_ip.yml
detect_spike_in_aws_api_activity.yml		detect_spike_in_aws_api_activity.yml
detect_spike_in_blocked_outbound_traffic_from_your_aws.yml		detect_spike_in_blocked_outbound_traffic_from_your_aws.yml
detect_spike_in_network_acl_activity.yml		detect_spike_in_network_acl_activity.yml
detect_spike_in_s3_bucket_deletion.yml		detect_spike_in_s3_bucket_deletion.yml
detect_spike_in_security_group_activity.yml		detect_spike_in_security_group_activity.yml
detect_unauthorized_assets_by_mac_address.yml		detect_unauthorized_assets_by_mac_address.yml
detect_usb_device_insertion.yml		detect_usb_device_insertion.yml
detect_use_of_cmd_exe_to_launch_script_interpreters.yml		detect_use_of_cmd_exe_to_launch_script_interpreters.yml
detect_web_traffic_to_dynamic_domain_providers.yml		detect_web_traffic_to_dynamic_domain_providers.yml
detection_of_dns_tunnels.yml		detection_of_dns_tunnels.yml
detection_of_tools_built_by_nirsoft.yml		detection_of_tools_built_by_nirsoft.yml
disabling_remote_user_account_control.yml		disabling_remote_user_account_control.yml
dns_query_length_outliers___mltk.yml		dns_query_length_outliers___mltk.yml
dns_query_length_with_high_standard_deviation.yml		dns_query_length_with_high_standard_deviation.yml
dns_query_requests_resolved_by_unauthorized_dns_servers.yml		dns_query_requests_resolved_by_unauthorized_dns_servers.yml
dns_record_changed.yml		dns_record_changed.yml
dump_lsass_via_comsvcs_dll.yml		dump_lsass_via_comsvcs_dll.yml
ec2_instance_modified_with_previously_unseen_user.yml		ec2_instance_modified_with_previously_unseen_user.yml
ec2_instance_started_in_previously_unseen_region.yml		ec2_instance_started_in_previously_unseen_region.yml
ec2_instance_started_with_previously_unseen_ami.yml		ec2_instance_started_with_previously_unseen_ami.yml
ec2_instance_started_with_previously_unseen_instance_type.yml		ec2_instance_started_with_previously_unseen_instance_type.yml
ec2_instance_started_with_previously_unseen_user.yml		ec2_instance_started_with_previously_unseen_user.yml
email_attachments_with_lots_of_spaces.yml		email_attachments_with_lots_of_spaces.yml
email_files_written_outside_of_the_outlook_directory.yml		email_files_written_outside_of_the_outlook_directory.yml
email_servers_sending_high_volume_traffic_to_hosts.yml		email_servers_sending_high_volume_traffic_to_hosts.yml
excessive_dns_failures.yml		excessive_dns_failures.yml
execution_of_file_with_multiple_extensions.yml		execution_of_file_with_multiple_extensions.yml
execution_of_file_with_spaces_before_extension.yml		execution_of_file_with_spaces_before_extension.yml
extended_period_without_successful_netbackup_backups.yml		extended_period_without_successful_netbackup_backups.yml
file_with_samsam_extension.yml		file_with_samsam_extension.yml
first_time_seen_child_process_of_zoom.yml		first_time_seen_child_process_of_zoom.yml
first_time_seen_command_line_argument.yml		first_time_seen_command_line_argument.yml
first_time_seen_running_windows_service.yml		first_time_seen_running_windows_service.yml
View all files