FilesExpand file tree

develop

/

endpoint

/

Copy path

Directory actions

More options

More options

Directory actions

More options

More options

Latest commit

 

History

History

History

 

 

develop

/

endpoint

/

Copy path

Top

Folders and files

Name		Name	Last commit message	Last commit date
parent directory ..
.untested		.untested
child_processes_of_spoolsv_exe.yml		child_processes_of_spoolsv_exe.yml
detect_baron_samedit_cve_2021_3156.yml		detect_baron_samedit_cve_2021_3156.yml
detect_baron_samedit_cve_2021_3156_segfault.yml		detect_baron_samedit_cve_2021_3156_segfault.yml
detect_baron_samedit_cve_2021_3156_via_osquery.yml		detect_baron_samedit_cve_2021_3156_via_osquery.yml
detect_computer_changed_with_anonymous_account.yml		detect_computer_changed_with_anonymous_account.yml
detect_outlook_exe_writing_a_zip_file.yml		detect_outlook_exe_writing_a_zip_file.yml
detect_rare_executables.yml		detect_rare_executables.yml
detection_of_tools_built_by_nirsoft.yml		detection_of_tools_built_by_nirsoft.yml
exchange_powershell_abuse_via_ssrf.yml		exchange_powershell_abuse_via_ssrf.yml
first_time_seen_child_process_of_zoom.yml		first_time_seen_child_process_of_zoom.yml
first_time_seen_running_windows_service.yml		first_time_seen_running_windows_service.yml
linux_stdout_redirection_to_dev_null_file.yml		linux_stdout_redirection_to_dev_null_file.yml
macos___re_opened_applications.yml		macos___re_opened_applications.yml
ms_exchange_mailbox_replication_service_writing_active_server_pages.yml		ms_exchange_mailbox_replication_service_writing_active_server_pages.yml
print_processor_registry_autostart.yml		print_processor_registry_autostart.yml
processes_tapping_keyboard_events.yml		processes_tapping_keyboard_events.yml
randomly_generated_scheduled_task_name.yml		randomly_generated_scheduled_task_name.yml
randomly_generated_windows_service_name.yml		randomly_generated_windows_service_name.yml
remote_desktop_process_running_on_system.yml		remote_desktop_process_running_on_system.yml
spike_in_file_writes.yml		spike_in_file_writes.yml
ssa___anomalous_usage_of_account_credentials.yml		ssa___anomalous_usage_of_account_credentials.yml
ssa___detect_kerberoasting.yml		ssa___detect_kerberoasting.yml
ssa___disable_defender_antivirus_registry.yml		ssa___disable_defender_antivirus_registry.yml
ssa___excessive_number_of_office_files_copied.yml		ssa___excessive_number_of_office_files_copied.yml
ssa___first_time_seen_cmd_line.yml		ssa___first_time_seen_cmd_line.yml
ssa___high_file_deletion_frequency.yml		ssa___high_file_deletion_frequency.yml
ssa___rare_parent_process_relationship_lolbas.yml		ssa___rare_parent_process_relationship_lolbas.yml
ssa___windows_wsreset_uac_bypass.yml		ssa___windows_wsreset_uac_bypass.yml
sunburst_correlation_dll_and_network_event.yml		sunburst_correlation_dll_and_network_event.yml
suspicious_curl_network_connection.yml		suspicious_curl_network_connection.yml
suspicious_plistbuddy_usage.yml		suspicious_plistbuddy_usage.yml
suspicious_plistbuddy_usage_via_osquery.yml		suspicious_plistbuddy_usage_via_osquery.yml
suspicious_sqlite3_lsquarantine_behavior.yml		suspicious_sqlite3_lsquarantine_behavior.yml
unusual_number_of_computer_service_tickets_requested.yml		unusual_number_of_computer_service_tickets_requested.yml
unusual_number_of_remote_endpoint_authentication_events.yml		unusual_number_of_remote_endpoint_authentication_events.yml
unusually_long_command_line.yml		unusually_long_command_line.yml
unusually_long_command_line___mltk.yml		unusually_long_command_line___mltk.yml
windows_java_spawning_shells.yml		windows_java_spawning_shells.yml
winrm_spawning_a_process.yml		winrm_spawning_a_process.yml
wmi_permanent_event_subscription.yml		wmi_permanent_event_subscription.yml
wmi_temporary_event_subscription.yml		wmi_temporary_event_subscription.yml
View all files