Index of /github/opensearch-project/security-analytics/src/main/resources/rules/windows/builtin/security/
../
win_aadhealth_mon_agent_regkey_access.yml 05-Aug-2023 01:06 1531
win_aadhealth_svc_agent_regkey_access.yml 05-Aug-2023 01:06 1720
win_account_backdoor_dcsync_rights.yml 05-Aug-2023 01:06 1355
win_account_discovery.yml 05-Aug-2023 01:06 1092
win_ad_object_writedac_access.yml 05-Aug-2023 01:06 674
win_ad_replication_non_machine_account.yml 05-Aug-2023 01:06 1143
win_ad_user_enumeration.yml 05-Aug-2023 01:06 1438
win_adcs_certificate_template_configuration_vul..> 05-Aug-2023 01:06 1111
win_adcs_certificate_template_configuration_vul..> 05-Aug-2023 01:06 1552
win_admin_rdp_login.yml 05-Aug-2023 01:06 907
win_admin_share_access.yml 05-Aug-2023 01:06 628
win_alert_active_directory_user_control.yml 05-Aug-2023 01:06 1019
win_alert_ad_user_backdoors.yml 05-Aug-2023 01:06 1584
win_alert_enable_weak_encryption.yml 05-Aug-2023 01:06 2514
win_alert_ruler.yml 05-Aug-2023 01:06 1085
win_apt_chafer_mar18_security.yml 05-Aug-2023 01:06 968
win_apt_slingshot.yml 05-Aug-2023 01:06 825
win_apt_wocao.yml 05-Aug-2023 01:06 955
win_atsvc_task.yml 05-Aug-2023 01:06 849
win_camera_microphone_access.yml 05-Aug-2023 01:06 963
win_dce_rpc_smb_spoolss_named_pipe.yml 05-Aug-2023 01:06 898
win_dcom_iertutil_dll_hijack.yml 05-Aug-2023 01:06 886
win_dcsync.yml 05-Aug-2023 01:06 1463
win_defender_bypass.yml 05-Aug-2023 01:06 956
win_disable_event_logging.yml 05-Aug-2023 01:06 1511
win_dpapi_domain_backupkey_extraction.yml 05-Aug-2023 01:06 680
win_dpapi_domain_masterkey_backup_attempt.yml 05-Aug-2023 01:06 711
win_etw_modification.yml 05-Aug-2023 01:06 1602
win_event_log_cleared.yml 05-Aug-2023 01:06 767
win_exploit_cve_2021_1675_printspooler_security..> 05-Aug-2023 01:06 822
win_external_device.yml 05-Aug-2023 01:06 689
win_global_catalog_enumeration.yml 05-Aug-2023 01:06 923
win_gpo_scheduledtasks.yml 05-Aug-2023 01:06 1056
win_hidden_user_creation.yml 05-Aug-2023 01:06 624
win_hybridconnectionmgr_svc_installation.yml 05-Aug-2023 01:06 762
win_impacket_psexec.yml 05-Aug-2023 01:06 766
win_impacket_secretdump.yml 05-Aug-2023 01:06 878
win_invoke_obfuscation_clip_services_security.yml 05-Aug-2023 01:06 837
win_invoke_obfuscation_obfuscated_iex_services_..> 05-Aug-2023 01:06 1327
win_invoke_obfuscation_stdin_services_security.yml 05-Aug-2023 01:06 953
win_invoke_obfuscation_var_services_security.yml 05-Aug-2023 01:06 807
win_invoke_obfuscation_via_compress_services_se..> 05-Aug-2023 01:06 961
win_invoke_obfuscation_via_rundll_services_secu..> 05-Aug-2023 01:06 825
win_invoke_obfuscation_via_stdin_services_secur..> 05-Aug-2023 01:06 845
win_invoke_obfuscation_via_use_clip_services_se..> 05-Aug-2023 01:06 718
win_invoke_obfuscation_via_use_mshta_services_s..> 05-Aug-2023 01:06 814
win_invoke_obfuscation_via_use_rundll32_service..> 05-Aug-2023 01:06 929
win_invoke_obfuscation_via_var_services_securit..> 05-Aug-2023 01:06 773
win_iso_mount.yml 05-Aug-2023 01:06 1154
win_lm_namedpipe.yml 05-Aug-2023 01:06 1287
win_lolbas_execution_of_nltest.yml 05-Aug-2023 01:06 1046
win_lsass_access_non_system_account.yml 05-Aug-2023 01:06 1893
win_mal_wceaux_dll.yml 05-Aug-2023 01:06 688
win_metasploit_authentication.yml 05-Aug-2023 01:06 889
win_net_ntlm_downgrade.yml 05-Aug-2023 01:06 1050
win_net_share_obj_susp_desktop_ini.yml 05-Aug-2023 01:06 921
win_new_or_renamed_user_account_with_dollar_sig..> 05-Aug-2023 01:06 679
win_not_allowed_rdp_access.yml 05-Aug-2023 01:06 831
win_overpass_the_hash.yml 05-Aug-2023 01:06 811
win_pass_the_hash.yml 05-Aug-2023 01:06 1026
win_pass_the_hash_2.yml 05-Aug-2023 01:06 1176
win_petitpotam_network_share.yml 05-Aug-2023 01:06 975
win_petitpotam_susp_tgt_request.yml 05-Aug-2023 01:06 1778
win_possible_dc_shadow.yml 05-Aug-2023 01:06 1016
win_privesc_cve_2020_1472.yml 05-Aug-2023 01:06 1005
win_protected_storage_service_access.yml 05-Aug-2023 01:06 721
win_rare_schtasks_creations.yml 05-Aug-2023 01:06 938
win_rdp_bluekeep_poc_scanner.yml 05-Aug-2023 01:06 738
win_rdp_localhost_login.yml 05-Aug-2023 01:06 698
win_rdp_reverse_tunnel.yml 05-Aug-2023 01:06 1248
win_register_new_logon_process_by_rubeus.yml 05-Aug-2023 01:06 739
win_remote_powershell_session.yml 05-Aug-2023 01:06 765
win_remote_registry_management_using_reg_utilit..> 05-Aug-2023 01:06 863
win_sam_registry_hive_handle_request.yml 05-Aug-2023 01:06 734
win_samaccountname_spoofing_cve_2021_42287.yml 05-Aug-2023 01:06 801
win_scheduled_task_deletion.yml 05-Aug-2023 01:06 1497
win_scm_database_handle_failure.yml 05-Aug-2023 01:06 797
win_scm_database_privileged_operation.yml 05-Aug-2023 01:06 815
win_scrcons_remote_wmi_scripteventconsumer.yml 05-Aug-2023 01:06 809
win_security_cobaltstrike_service_installs.yml 05-Aug-2023 01:06 1421
win_security_mal_creddumper.yml 05-Aug-2023 01:06 1170
win_security_mal_service_installs.yml 05-Aug-2023 01:06 1068
win_security_metasploit_or_impacket_smb_psexec_..> 05-Aug-2023 01:06 1353
win_security_meterpreter_or_cobaltstrike_getsys..> 05-Aug-2023 01:06 1904
win_security_powershell_script_installed_as_ser..> 05-Aug-2023 01:06 711
win_security_tap_driver_installation.yml 05-Aug-2023 01:06 678
win_security_wmi_persistence.yml 05-Aug-2023 01:06 912
win_smb_file_creation_admin_shares.yml 05-Aug-2023 01:06 878
win_susp_add_domain_trust.yml 05-Aug-2023 01:06 464
win_susp_add_sid_history.yml 05-Aug-2023 01:06 856
win_susp_codeintegrity_check_failure.yml 05-Aug-2023 01:06 494
win_susp_dsrm_password_change.yml 05-Aug-2023 01:06 666
win_susp_eventlog_cleared.yml 05-Aug-2023 01:06 1092
win_susp_failed_logon_reasons.yml 05-Aug-2023 01:06 1642
win_susp_failed_logon_source.yml 05-Aug-2023 01:06 1278
win_susp_failed_logons_explicit_credentials.yml 05-Aug-2023 01:06 864
win_susp_failed_logons_single_process.yml 05-Aug-2023 01:06 1040
win_susp_failed_logons_single_source.yml 05-Aug-2023 01:06 773
win_susp_failed_logons_single_source2.yml 05-Aug-2023 01:06 832
win_susp_failed_logons_single_source_kerberos.yml 05-Aug-2023 01:06 1013
win_susp_failed_logons_single_source_kerberos2.yml 05-Aug-2023 01:06 1003
win_susp_failed_logons_single_source_kerberos3.yml 05-Aug-2023 01:06 1000
win_susp_failed_logons_single_source_ntlm.yml 05-Aug-2023 01:06 1002
win_susp_failed_logons_single_source_ntlm2.yml 05-Aug-2023 01:06 1013
win_susp_failed_remote_logons_single_source.yml 05-Aug-2023 01:06 910
win_susp_interactive_logons.yml 05-Aug-2023 01:06 692
win_susp_kerberos_manipulation.yml 05-Aug-2023 01:06 987
win_susp_krbrelayup.yml 05-Aug-2023 01:06 968
win_susp_ldap_dataexchange.yml 05-Aug-2023 01:06 1084
win_susp_local_anon_logon_created.yml 05-Aug-2023 01:06 823
win_susp_logon_explicit_credentials.yml 05-Aug-2023 01:06 996
win_susp_lsass_dump.yml 05-Aug-2023 01:06 664
win_susp_lsass_dump_generic.yml 05-Aug-2023 01:06 2991
win_susp_multiple_files_renamed_or_deleted.yml 05-Aug-2023 01:06 1042
win_susp_net_recon_activity.yml 05-Aug-2023 01:06 1092
win_susp_opened_encrypted_zip.yml 05-Aug-2023 01:06 801
win_susp_opened_encrypted_zip_filename.yml 05-Aug-2023 01:06 960
win_susp_opened_encrypted_zip_outlook.yml 05-Aug-2023 01:06 734
win_susp_outbound_kerberos_connection.yml 05-Aug-2023 01:06 761
win_susp_psexec.yml 05-Aug-2023 01:06 995
win_susp_raccess_sensitive_fext.yml 05-Aug-2023 01:06 1020
win_susp_rc4_kerberos.yml 05-Aug-2023 01:06 861
win_susp_rottenpotato.yml 05-Aug-2023 01:06 768
win_susp_samr_pwset.yml 05-Aug-2023 01:06 807
win_susp_sdelete.yml 05-Aug-2023 01:06 852
win_susp_time_modification.yml 05-Aug-2023 01:06 1338
win_susp_wmi_login.yml 05-Aug-2023 01:06 479
win_svcctl_remote_service.yml 05-Aug-2023 01:06 804
win_syskey_registry_access.yml 05-Aug-2023 01:06 718
win_sysmon_channel_reference_deletion.yml 05-Aug-2023 01:06 1204
win_transferring_files_with_credential_data_via..> 05-Aug-2023 01:06 1017
win_user_added_to_local_administrators.yml 05-Aug-2023 01:06 916
win_user_couldnt_call_privileged_service_lsareg..> 05-Aug-2023 01:06 1020
win_user_creation.yml 05-Aug-2023 01:06 830
win_user_driver_loaded.yml 05-Aug-2023 01:06 2025
win_vssaudit_secevent_source_registration.yml 05-Aug-2023 01:06 973
win_wmiprvse_wbemcomn_dll_hijack.yml 05-Aug-2023 01:06 892