FilesExpand file tree

develop

/

network

/

Copy path

Directory actions

More options

More options

Directory actions

More options

More options

Latest commit

 

History

History

History

develop

/

network

/

Copy path

Top

Folders and files

Name		Name	Last commit message	Last commit date
parent directory ..
3cx_supply_chain_attack_network_indicators.yml		3cx_supply_chain_attack_network_indicators.yml
cisco_configuration_archive_logging_analysis.yml		cisco_configuration_archive_logging_analysis.yml
cisco_ios_suspicious_privileged_account_creation.yml		cisco_ios_suspicious_privileged_account_creation.yml
cisco_network_interface_modifications.yml		cisco_network_interface_modifications.yml
cisco_privileged_account_creation_with_http_command_execution.yml		cisco_privileged_account_creation_with_http_command_execution.yml
cisco_privileged_account_creation_with_suspicious_ssh_activity.yml		cisco_privileged_account_creation_with_suspicious_ssh_activity.yml
cisco_sa___access_to_anonymizer_services.yml		cisco_sa___access_to_anonymizer_services.yml
cisco_sa___automated_web_reconnaissance_via_http_access_errors.yml		cisco_sa___automated_web_reconnaissance_via_http_access_errors.yml
cisco_sd_wan___arbitrary_file_overwrite_exploitation_activity.yml		cisco_sd_wan___arbitrary_file_overwrite_exploitation_activity.yml
cisco_sd_wan___low_frequency_rogue_peer.yml		cisco_sd_wan___low_frequency_rogue_peer.yml
cisco_sd_wan___peering_activity.yml		cisco_sd_wan___peering_activity.yml
cisco_sd_wan___uncommon_user_agent_multi_uri_activity.yml		cisco_sd_wan___uncommon_user_agent_multi_uri_activity.yml
cisco_secure_firewall___binary_file_type_download.yml		cisco_secure_firewall___binary_file_type_download.yml
cisco_secure_firewall___bits_network_activity.yml		cisco_secure_firewall___bits_network_activity.yml
cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml		cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml
cisco_secure_firewall___blocked_connection.yml		cisco_secure_firewall___blocked_connection.yml
cisco_secure_firewall___citrix_netscaler_memory_overread_attempt.yml		cisco_secure_firewall___citrix_netscaler_memory_overread_attempt.yml
cisco_secure_firewall___communication_over_suspicious_ports.yml		cisco_secure_firewall___communication_over_suspicious_ports.yml
cisco_secure_firewall___connection_to_file_sharing_domain.yml		cisco_secure_firewall___connection_to_file_sharing_domain.yml
cisco_secure_firewall___file_download_over_uncommon_port.yml		cisco_secure_firewall___file_download_over_uncommon_port.yml
cisco_secure_firewall___high_eve_threat_confidence.yml		cisco_secure_firewall___high_eve_threat_confidence.yml
cisco_secure_firewall___high_priority_intrusion_classification.yml		cisco_secure_firewall___high_priority_intrusion_classification.yml
cisco_secure_firewall___high_volume_of_intrusion_events_per_host.yml		cisco_secure_firewall___high_volume_of_intrusion_events_per_host.yml
cisco_secure_firewall___intrusion_events_by_threat_activity.yml		cisco_secure_firewall___intrusion_events_by_threat_activity.yml
cisco_secure_firewall___lumma_stealer_activity.yml		cisco_secure_firewall___lumma_stealer_activity.yml
cisco_secure_firewall___lumma_stealer_download_attempt.yml		cisco_secure_firewall___lumma_stealer_download_attempt.yml
cisco_secure_firewall___lumma_stealer_outbound_connection_attempt.yml		cisco_secure_firewall___lumma_stealer_outbound_connection_attempt.yml
cisco_secure_firewall___malware_file_downloaded.yml		cisco_secure_firewall___malware_file_downloaded.yml
cisco_secure_firewall___oracle_e_business_suite_correlation.yml		cisco_secure_firewall___oracle_e_business_suite_correlation.yml
cisco_secure_firewall___oracle_e_business_suite_exploitation.yml		cisco_secure_firewall___oracle_e_business_suite_exploitation.yml
cisco_secure_firewall___possibly_compromised_host.yml		cisco_secure_firewall___possibly_compromised_host.yml
cisco_secure_firewall___potential_data_exfiltration.yml		cisco_secure_firewall___potential_data_exfiltration.yml
cisco_secure_firewall___privileged_command_execution_via_http.yml		cisco_secure_firewall___privileged_command_execution_via_http.yml
cisco_secure_firewall___rare_snort_rule_triggered.yml		cisco_secure_firewall___rare_snort_rule_triggered.yml
cisco_secure_firewall___react_server_components_rce_attempt.yml		cisco_secure_firewall___react_server_components_rce_attempt.yml
cisco_secure_firewall___remote_access_software_usage_traffic.yml		cisco_secure_firewall___remote_access_software_usage_traffic.yml
cisco_secure_firewall___repeated_blocked_connections.yml		cisco_secure_firewall___repeated_blocked_connections.yml
cisco_secure_firewall___repeated_malware_downloads.yml		cisco_secure_firewall___repeated_malware_downloads.yml
cisco_secure_firewall___snort_rule_triggered_across_multiple_hosts.yml		cisco_secure_firewall___snort_rule_triggered_across_multiple_hosts.yml
cisco_secure_firewall___ssh_connection_to_non_standard_port.yml		cisco_secure_firewall___ssh_connection_to_non_standard_port.yml
cisco_secure_firewall___ssh_connection_to_sshd_operns.yml		cisco_secure_firewall___ssh_connection_to_sshd_operns.yml
cisco_secure_firewall___static_tundra_smart_install_abuse.yml		cisco_secure_firewall___static_tundra_smart_install_abuse.yml
cisco_secure_firewall___veeam_cve_2023_27532_exploitation_activity.yml		cisco_secure_firewall___veeam_cve_2023_27532_exploitation_activity.yml
cisco_secure_firewall___wget_or_curl_download.yml		cisco_secure_firewall___wget_or_curl_download.yml
cisco_smart_install_oversized_packet_detection.yml		cisco_smart_install_oversized_packet_detection.yml
cisco_smart_install_port_discovery_and_status.yml		cisco_smart_install_port_discovery_and_status.yml
cisco_snmp_community_string_configuration_changes.yml		cisco_snmp_community_string_configuration_changes.yml
cisco_tftp_server_configuration_for_data_exfiltration.yml		cisco_tftp_server_configuration_for_data_exfiltration.yml
detect_arp_poisoning.yml		detect_arp_poisoning.yml
detect_dns_query_to_decommissioned_s3_bucket.yml		detect_dns_query_to_decommissioned_s3_bucket.yml
detect_hosts_connecting_to_dynamic_domain_providers.yml		detect_hosts_connecting_to_dynamic_domain_providers.yml
detect_ipv6_network_infrastructure_threats.yml		detect_ipv6_network_infrastructure_threats.yml
detect_outbound_ldap_traffic.yml		detect_outbound_ldap_traffic.yml
detect_outbound_smb_traffic.yml		detect_outbound_smb_traffic.yml
detect_port_security_violation.yml		detect_port_security_violation.yml
detect_remote_access_software_usage_dns.yml		detect_remote_access_software_usage_dns.yml
detect_remote_access_software_usage_traffic.yml		detect_remote_access_software_usage_traffic.yml
detect_rogue_dhcp_server.yml		detect_rogue_dhcp_server.yml
detect_snicat_sni_exfiltration.yml		detect_snicat_sni_exfiltration.yml
detect_software_download_to_network_device.yml		detect_software_download_to_network_device.yml
detect_traffic_mirroring.yml		detect_traffic_mirroring.yml
detect_unauthorized_assets_by_mac_address.yml		detect_unauthorized_assets_by_mac_address.yml
detect_windows_dns_sigred_via_splunk_stream.yml		detect_windows_dns_sigred_via_splunk_stream.yml
detect_windows_dns_sigred_via_zeek.yml		detect_windows_dns_sigred_via_zeek.yml
detect_zerologon_via_zeek.yml		detect_zerologon_via_zeek.yml
dns_kerberos_coercion.yml		dns_kerberos_coercion.yml
dns_query_length_with_high_standard_deviation.yml		dns_query_length_with_high_standard_deviation.yml
excessive_dns_failures.yml		excessive_dns_failures.yml
f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml		f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml
hosts_receiving_high_volume_of_network_traffic_from_email_server.yml		hosts_receiving_high_volume_of_network_traffic_from_email_server.yml
http_c2_framework_user_agent.yml		http_c2_framework_user_agent.yml
http_malware_user_agent.yml		http_malware_user_agent.yml
http_post_request_with_encoded_payload.yml		http_post_request_with_encoded_payload.yml
http_pua_user_agent.yml		http_pua_user_agent.yml
http_rmm_user_agent.yml		http_rmm_user_agent.yml
internal_horizontal_port_scan.yml		internal_horizontal_port_scan.yml
internal_horizontal_port_scan_nmap_top_20.yml		internal_horizontal_port_scan_nmap_top_20.yml
internal_vertical_port_scan.yml		internal_vertical_port_scan.yml
internal_vulnerability_scan.yml		internal_vulnerability_scan.yml
large_volume_of_dns_any_queries.yml		large_volume_of_dns_any_queries.yml
ngrok_reverse_proxy_on_network.yml		ngrok_reverse_proxy_on_network.yml
prohibited_network_traffic_allowed.yml		prohibited_network_traffic_allowed.yml
protocol_or_port_mismatch.yml		protocol_or_port_mismatch.yml
protocols_passing_authentication_in_cleartext.yml		protocols_passing_authentication_in_cleartext.yml
remote_desktop_network_traffic.yml		remote_desktop_network_traffic.yml
rundll32_dnsquery.yml		rundll32_dnsquery.yml
smb_traffic_spike.yml		smb_traffic_spike.yml
ssl_certificates_with_punycode.yml		ssl_certificates_with_punycode.yml
suspicious_process_dns_query_known_abuse_web_services.yml		suspicious_process_dns_query_known_abuse_web_services.yml
suspicious_process_with_discord_dns_query.yml		suspicious_process_with_discord_dns_query.yml
tor_traffic.yml		tor_traffic.yml
unusual_ssh_client_banner.yml		unusual_ssh_client_banner.yml
wermgr_process_connecting_to_ip_check_web_services.yml		wermgr_process_connecting_to_ip_check_web_services.yml
windows_abused_web_services.yml		windows_abused_web_services.yml
windows_ad_replication_service_traffic.yml		windows_ad_replication_service_traffic.yml
windows_ad_rogue_domain_controller_network_activity.yml		windows_ad_rogue_domain_controller_network_activity.yml
windows_dns_query_request_by_telegram_bot_api.yml		windows_dns_query_request_by_telegram_bot_api.yml
windows_gather_victim_network_info_through_ip_check_web_services.yml		windows_gather_victim_network_info_through_ip_check_web_services.yml
windows_multi_hop_proxy_tor_website_query.yml		windows_multi_hop_proxy_tor_website_query.yml
windows_remote_desktop_network_bruteforce_attempt.yml		windows_remote_desktop_network_bruteforce_attempt.yml
View all files