Skip to content

endpoint

Directory actions

More options

Directory actions

More options

Sorry, we had to truncate this directory to 1,000 files. 518 entries were omitted from the list. Latest commit info may be omitted.

Latest commit

 

History

History

endpoint

Folders and files

NameName
Last commit message
Last commit date

parent directory

..
7zip_commandline_to_smb_share_path.yml
7zip_commandline_to_smb_share_path.yml
 
 
access_lsass_memory_for_dump_creation.yml
access_lsass_memory_for_dump_creation.yml
 
 
active_directory_lateral_movement_identified.yml
active_directory_lateral_movement_identified.yml
 
 
active_directory_privilege_escalation_identified.yml
active_directory_privilege_escalation_identified.yml
 
 
active_setup_registry_autostart.yml
active_setup_registry_autostart.yml
 
 
add_defaultuser_and_password_in_registry.yml
add_defaultuser_and_password_in_registry.yml
 
 
add_or_set_windows_defender_exclusion.yml
add_or_set_windows_defender_exclusion.yml
 
 
adsisearcher_account_discovery.yml
adsisearcher_account_discovery.yml
 
 
advanced_ip_or_port_scanner_execution.yml
advanced_ip_or_port_scanner_execution.yml
 
 
allow_file_and_printing_sharing_in_firewall.yml
allow_file_and_printing_sharing_in_firewall.yml
 
 
allow_inbound_traffic_by_firewall_rule_registry.yml
allow_inbound_traffic_by_firewall_rule_registry.yml
 
 
allow_inbound_traffic_in_firewall_rule.yml
allow_inbound_traffic_in_firewall_rule.yml
 
 
allow_network_discovery_in_firewall.yml
allow_network_discovery_in_firewall.yml
 
 
allow_operation_with_consent_admin.yml
allow_operation_with_consent_admin.yml
 
 
anomalous_usage_of_7zip.yml
anomalous_usage_of_7zip.yml
 
 
attacker_tools_on_endpoint.yml
attacker_tools_on_endpoint.yml
 
 
auto_admin_logon_registry_entry.yml
auto_admin_logon_registry_entry.yml
 
 
batch_file_write_to_system32.yml
batch_file_write_to_system32.yml
 
 
bcdedit_command_back_to_normal_mode_boot.yml
bcdedit_command_back_to_normal_mode_boot.yml
 
 
bcdedit_failure_recovery_modification.yml
bcdedit_failure_recovery_modification.yml
 
 
bits_job_persistence.yml
bits_job_persistence.yml
 
 
bitsadmin_download_file.yml
bitsadmin_download_file.yml
 
 
certutil_exe_certificate_extraction.yml
certutil_exe_certificate_extraction.yml
 
 
certutil_with_decode_argument.yml
certutil_with_decode_argument.yml
 
 
change_to_safe_mode_with_network_config.yml
change_to_safe_mode_with_network_config.yml
 
 
check_elevated_cmd_using_whoami.yml
check_elevated_cmd_using_whoami.yml
 
 
cisco_isovalent___access_to_cloud_metadata_service.yml
cisco_isovalent___access_to_cloud_metadata_service.yml
 
 
cisco_isovalent___cron_job_creation.yml
cisco_isovalent___cron_job_creation.yml
 
 
cisco_isovalent___curl_execution_with_insecure_flags.yml
cisco_isovalent___curl_execution_with_insecure_flags.yml
 
 
cisco_isovalent___kprobe_spike.yml
cisco_isovalent___kprobe_spike.yml
 
 
cisco_isovalent___late_process_execution.yml
cisco_isovalent___late_process_execution.yml
 
 
cisco_isovalent___non_allowlisted_image_use.yml
cisco_isovalent___non_allowlisted_image_use.yml
 
 
cisco_isovalent___nsenter_usage_in_kubernetes_pod.yml
cisco_isovalent___nsenter_usage_in_kubernetes_pod.yml
 
 
cisco_isovalent___pods_running_offensive_tools.yml
cisco_isovalent___pods_running_offensive_tools.yml
 
 
cisco_isovalent___potential_escape_to_host.yml
cisco_isovalent___potential_escape_to_host.yml
 
 
cisco_isovalent___shell_execution.yml
cisco_isovalent___shell_execution.yml
 
 
cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml
cisco_nvm___browser_spawned_unix_shell_with_external_connection.yml
 
 
cisco_nvm___curl_execution_with_insecure_flags.yml
cisco_nvm___curl_execution_with_insecure_flags.yml
 
 
cisco_nvm___installation_of_typosquatted_python_package.yml
cisco_nvm___installation_of_typosquatted_python_package.yml
 
 
cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml
cisco_nvm___mshtml_or_mshta_network_execution_without_url_in_cli.yml
 
 
cisco_nvm___non_network_binary_making_network_connection.yml
cisco_nvm___non_network_binary_making_network_connection.yml
 
 
cisco_nvm___osascript_network_connection_for_a_long_duration.yml
cisco_nvm___osascript_network_connection_for_a_long_duration.yml
 
 
cisco_nvm___outbound_connection_to_suspicious_port.yml
cisco_nvm___outbound_connection_to_suspicious_port.yml
 
 
cisco_nvm___rclone_execution_with_network_activity.yml
cisco_nvm___rclone_execution_with_network_activity.yml
 
 
cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml
cisco_nvm___rundll32_abuse_of_mshtml_dll_for_payload_download.yml
 
 
cisco_nvm___susp_script_from_archive_triggering_network_activity.yml
cisco_nvm___susp_script_from_archive_triggering_network_activity.yml
 
 
cisco_nvm___suspicious_download_from_file_sharing_website.yml
cisco_nvm___suspicious_download_from_file_sharing_website.yml
 
 
cisco_nvm___suspicious_file_download_via_headless_browser.yml
cisco_nvm___suspicious_file_download_via_headless_browser.yml
 
 
cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml
cisco_nvm___suspicious_network_connection_from_process_with_no_args.yml
 
 
cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml
cisco_nvm___suspicious_network_connection_initiated_via_msxsl.yml
 
 
cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml
cisco_nvm___suspicious_network_connection_to_ip_lookup_service_api.yml
 
 
cisco_nvm___webserver_download_from_file_sharing_website.yml
cisco_nvm___webserver_download_from_file_sharing_website.yml
 
 
clear_unallocated_sector_using_cipher_app.yml
clear_unallocated_sector_using_cipher_app.yml
 
 
clop_common_exec_parameter.yml
clop_common_exec_parameter.yml
 
 
clop_ransomware_known_service_name.yml
clop_ransomware_known_service_name.yml
 
 
cmd_carry_out_string_command_parameter.yml
cmd_carry_out_string_command_parameter.yml
 
 
cmd_echo_pipe___escalation.yml
cmd_echo_pipe___escalation.yml
 
 
cmlua_or_cmstplua_uac_bypass.yml
cmlua_or_cmstplua_uac_bypass.yml
 
 
common_ransomware_extensions.yml
common_ransomware_extensions.yml
 
 
common_ransomware_notes.yml
common_ransomware_notes.yml
 
 
connectwise_screenconnect_path_traversal.yml
connectwise_screenconnect_path_traversal.yml
 
 
connectwise_screenconnect_path_traversal_windows_sacl.yml
connectwise_screenconnect_path_traversal_windows_sacl.yml
 
 
conti_common_exec_parameter.yml
conti_common_exec_parameter.yml
 
 
control_loading_from_world_writable_directory.yml
control_loading_from_world_writable_directory.yml
 
 
create_or_delete_windows_shares_using_net_exe.yml
create_or_delete_windows_shares_using_net_exe.yml
 
 
create_remote_thread_in_shell_application.yml
create_remote_thread_in_shell_application.yml
 
 
create_remote_thread_into_lsass.yml
create_remote_thread_into_lsass.yml
 
 
creation_of_lsass_dump_with_taskmgr.yml
creation_of_lsass_dump_with_taskmgr.yml
 
 
creation_of_shadow_copy.yml
creation_of_shadow_copy.yml
 
 
creation_of_shadow_copy_with_wmic_and_powershell.yml
creation_of_shadow_copy_with_wmic_and_powershell.yml
 
 
credential_dumping_via_copy_command_from_shadow_copy.yml
credential_dumping_via_copy_command_from_shadow_copy.yml
 
 
credential_dumping_via_symlink_to_shadow_copy.yml
credential_dumping_via_symlink_to_shadow_copy.yml
 
 
crowdstrike_admin_weak_password_policy.yml
crowdstrike_admin_weak_password_policy.yml
 
 
crowdstrike_admin_with_duplicate_password.yml
crowdstrike_admin_with_duplicate_password.yml
 
 
crowdstrike_falcon_stream_alerts.yml
crowdstrike_falcon_stream_alerts.yml
 
 
crowdstrike_high_identity_risk_severity.yml
crowdstrike_high_identity_risk_severity.yml
 
 
crowdstrike_medium_identity_risk_severity.yml
crowdstrike_medium_identity_risk_severity.yml
 
 
crowdstrike_medium_severity_alert.yml
crowdstrike_medium_severity_alert.yml
 
 
crowdstrike_multiple_low_severity_alerts.yml
crowdstrike_multiple_low_severity_alerts.yml
 
 
crowdstrike_privilege_escalation_for_non_admin_user.yml
crowdstrike_privilege_escalation_for_non_admin_user.yml
 
 
crowdstrike_user_weak_password_policy.yml
crowdstrike_user_weak_password_policy.yml
 
 
crowdstrike_user_with_duplicate_password.yml
crowdstrike_user_with_duplicate_password.yml
 
 
csc_net_on_the_fly_compilation.yml
csc_net_on_the_fly_compilation.yml
 
 
curl_execution_with_percent_encoded_url.yml
curl_execution_with_percent_encoded_url.yml
 
 
delete_shadowcopy_with_powershell.yml
delete_shadowcopy_with_powershell.yml
 
 
deleting_shadow_copies.yml
deleting_shadow_copies.yml
 
 
detect_azurehound_command_line_arguments.yml
detect_azurehound_command_line_arguments.yml
 
 
detect_azurehound_file_modifications.yml
detect_azurehound_file_modifications.yml
 
 
detect_baron_samedit_cve_2021_3156.yml
detect_baron_samedit_cve_2021_3156.yml
 
 
detect_baron_samedit_cve_2021_3156_segfault.yml
detect_baron_samedit_cve_2021_3156_segfault.yml
 
 
detect_baron_samedit_cve_2021_3156_via_osquery.yml
detect_baron_samedit_cve_2021_3156_via_osquery.yml
 
 
detect_certify_command_line_arguments.yml
detect_certify_command_line_arguments.yml
 
 
detect_certify_with_powershell_script_block_logging.yml
detect_certify_with_powershell_script_block_logging.yml
 
 
detect_certipy_file_modifications.yml
detect_certipy_file_modifications.yml
 
 
detect_computer_changed_with_anonymous_account.yml
detect_computer_changed_with_anonymous_account.yml
 
 
detect_copy_of_shadowcopy_with_script_block_logging.yml
detect_copy_of_shadowcopy_with_script_block_logging.yml
 
 
detect_credential_dumping_through_lsass_access.yml
detect_credential_dumping_through_lsass_access.yml
 
 
detect_empire_with_powershell_script_block_logging.yml
detect_empire_with_powershell_script_block_logging.yml
 
 
detect_excessive_account_lockouts_from_endpoint.yml
detect_excessive_account_lockouts_from_endpoint.yml
 
 
detect_excessive_user_account_lockouts.yml
detect_excessive_user_account_lockouts.yml