FilesExpand file tree

develop

/

detections

/

Copy path

Directory actions

More options

More options

Directory actions

More options

More options

Latest commit

 

History

History

History

 

 

develop

/

detections

/

Copy path

Top

Folders and files

Name		Name	Last commit message	Last commit date
parent directory ..
abnormally_high_ec2_instances_launched.yml		abnormally_high_ec2_instances_launched.yml
abnormally_high_instance_termination.yml		abnormally_high_instance_termination.yml
account_harvesting.yml		account_harvesting.yml
acl_with_open_ports.yml		acl_with_open_ports.yml
activity_related_to_pass_the_hash.yml		activity_related_to_pass_the_hash.yml
add_to_untrust_cert_store.yml		add_to_untrust_cert_store.yml
anomalous_webclick.yml		anomalous_webclick.yml
api_acitivity_from_previously_unseen_user_role.yml		api_acitivity_from_previously_unseen_user_role.yml
attackers_scanning_for_vulnerable_jboss_servers.yml		attackers_scanning_for_vulnerable_jboss_servers.yml
attrib_to_hide_files.yml		attrib_to_hide_files.yml
aws_activity_from_non_approved_accounts.yml		aws_activity_from_non_approved_accounts.yml
aws_activity_in_new_region.yml		aws_activity_in_new_region.yml
aws_cloud_provisioning_from_previously_unseen_city.yml		aws_cloud_provisioning_from_previously_unseen_city.yml
aws_cloud_provisioning_from_previously_unseen_country.yml		aws_cloud_provisioning_from_previously_unseen_country.yml
aws_cloud_provisioning_from_previously_unseen_ip.yml		aws_cloud_provisioning_from_previously_unseen_ip.yml
aws_cloud_provisioning_from_previously_unseen_region.yml		aws_cloud_provisioning_from_previously_unseen_region.yml
aws_cross_account_activity_from_new_account.yml		aws_cross_account_activity_from_new_account.yml
aws_spike_acl_activity.yml		aws_spike_acl_activity.yml
badrabbit_schtasks.yml		badrabbit_schtasks.yml
batch_file_write_system32.yml		batch_file_write_system32.yml
brand_abuse_dns.yml		brand_abuse_dns.yml
brand_abuse_email.yml		brand_abuse_email.yml
brand_abuse_web.yml		brand_abuse_web.yml
change_file_association.yml		change_file_association.yml
children_of_spoolsv.yml		children_of_spoolsv.yml
clients_connecting_to_multiple_dns_servers.yml		clients_connecting_to_multiple_dns_servers.yml
cloud_compute_activity_in_new_region.yml		cloud_compute_activity_in_new_region.yml
cloud_compute_instance_created_by_previously_unseen_user.yml		cloud_compute_instance_created_by_previously_unseen_user.yml
cloud_compute_instance_created_with_previously_unseen_image_id.yml		cloud_compute_instance_created_with_previously_unseen_image_id.yml
cloud_compute_instance_created_with_previously_unseen_instance_type.yml		cloud_compute_instance_created_with_previously_unseen_instance_type.yml
common_ransomware_extensions.yml		common_ransomware_extensions.yml
common_ransomware_notes.yml		common_ransomware_notes.yml
create_hidden_shares.yml		create_hidden_shares.yml
create_local_admin_via_net.yml		create_local_admin_via_net.yml
cred_dump_via_reg.yml		cred_dump_via_reg.yml
cscript_via_cmd.yml		cscript_via_cmd.yml
delete_shadow_copies.yml		delete_shadow_copies.yml
deletion_network_acl.yml		deletion_network_acl.yml
disable_remote_uac.yml		disable_remote_uac.yml
dns_amplification_any_query.yml		dns_amplification_any_query.yml
dns_evilginx_subdomains.yml		dns_evilginx_subdomains.yml
dns_query_length_mltk.yml		dns_query_length_mltk.yml
dns_query_length_with_high_standard_deviation.yml		dns_query_length_with_high_standard_deviation.yml
dns_record_changed.yml		dns_record_changed.yml
dns_tunnelling.yml		dns_tunnelling.yml
dragonfly_schtasks.yml		dragonfly_schtasks.yml
dyn_dns_queries.yml		dyn_dns_queries.yml
dyn_dns_web_traffic.yml		dyn_dns_web_traffic.yml
ec2_instance_created_by_previously_unseen_user.yml		ec2_instance_created_by_previously_unseen_user.yml
ec2_instance_modified_by_previously_unseen_user.yml		ec2_instance_modified_by_previously_unseen_user.yml
ec2_instance_started_with_previously_unseen_ami.yml		ec2_instance_started_with_previously_unseen_ami.yml
ec2_instance_started_with_previously_unseen_instance_type.yml		ec2_instance_started_with_previously_unseen_instance_type.yml
email_attachments_with_spaces.yml		email_attachments_with_spaces.yml
email_files_not_in_outlook_directory.yml		email_files_not_in_outlook_directory.yml
emailserver_high_volume_outbound_traffic_to_hosts.yml		emailserver_high_volume_outbound_traffic_to_hosts.yml
excessive_dns_failures.yml		excessive_dns_failures.yml
excessive_lockouts_from_endpoint.yml		excessive_lockouts_from_endpoint.yml
excessive_user_account_lockouts.yml		excessive_user_account_lockouts.yml
execution_of_nirsoft_tools.yml		execution_of_nirsoft_tools.yml
file_write_spikes.yml		file_write_spikes.yml
first_time_seen_cmd_line.yml		first_time_seen_cmd_line.yml
first_time_seen_running_windows_service.yml		first_time_seen_running_windows_service.yml
fsutil_deleting_journals.yml		fsutil_deleting_journals.yml
hosts_file_modification.yml		hosts_file_modification.yml
hosts_receiving_high_volume_network_traffic_from_email_servers.yml		hosts_receiving_high_volume_network_traffic_from_email_servers.yml
large_icmp_outbound.yml		large_icmp_outbound.yml
lnk_executing_a_process.yml		lnk_executing_a_process.yml
local_admin_account_creation.yml		local_admin_account_creation.yml
long_dns_text_response.yml		long_dns_text_response.yml
malicious_application_shimming_via_registry.yml		malicious_application_shimming_via_registry.yml
malicious_powershell_process_connect_to_internet_with_hidden_window.yml		malicious_powershell_process_connect_to_internet_with_hidden_window.yml
malicious_powershell_process_encoded_command.yml		malicious_powershell_process_encoded_command.yml
malicious_powershell_process_execpolicy.yml		malicious_powershell_process_execpolicy.yml
malicious_powershell_process_multiple_suspicious_arguments.yml		malicious_powershell_process_multiple_suspicious_arguments.yml
malicious_powershell_process_obfuscation_techniques.yml		malicious_powershell_process_obfuscation_techniques.yml
malicious_requests_to_exploit_jboss_servers.yml		malicious_requests_to_exploit_jboss_servers.yml
mshta_launching_scripts.yml		mshta_launching_scripts.yml
netbackup_failed_backup.yml		netbackup_failed_backup.yml
netbackup_no_backups_in_time_period.yml		netbackup_no_backups_in_time_period.yml
netsh_launching_process.yml		netsh_launching_process.yml
new_aws_console_login_by_user.yml		new_aws_console_login_by_user.yml
new_aws_console_login_city_by_user.yml		new_aws_console_login_city_by_user.yml
new_aws_console_login_country_by_user.yml		new_aws_console_login_country_by_user.yml
new_aws_console_login_region_by_user.yml		new_aws_console_login_region_by_user.yml
new_connections_to_routers.yml		new_connections_to_routers.yml
new_open_s3_buckets.yml		new_open_s3_buckets.yml
new_user_accounts.yml		new_user_accounts.yml
no_win_updates_in_timeframe.yml		no_win_updates_in_timeframe.yml
open_redirect_in_splunk_web.yml		open_redirect_in_splunk_web.yml
osx_coldroot_pack.yml		osx_coldroot_pack.yml
osx_keyboard_taps.yml		osx_keyboard_taps.yml
outbound_smb_connections.yml		outbound_smb_connections.yml
outlook_writing_zip.yml		outlook_writing_zip.yml
overwrite_accessibility_binaries.yml		overwrite_accessibility_binaries.yml
password_sharing.yml		password_sharing.yml
path_interception_program.exe.yml		path_interception_program.exe.yml
port_monitor_via_registry.yml		port_monitor_via_registry.yml
powershell_get_sedebug.yml		powershell_get_sedebug.yml
powershell_read_from_lsass.yml		powershell_read_from_lsass.yml
powershell_reg_key_mod.yml		powershell_reg_key_mod.yml
View all files