Mirrors/keyboardcrunch-sentinelone-queries
1
0
Fork 0
mirror of https://github.com/keyboardcrunch/sentinelone-queries synced 2026-06-08 17:07:13 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
e1fdca6dfa7a9b6ab526e0b4926d1c5a260afd7b
keyboardcrunch-sentinelone-…/queries/windows
T
History
keyboardcrunch e1fdca6dfa changed to arg detection vs file detection
2021-06-08 14:07:33 -05:00
..
account_access_removal.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
account_manipulation.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
allow_executable_through_defender_firewall.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
allow_smb_and_rdp_on_defender_firewall.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
amsi_bypass_initfailed.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
application_shimming.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
assoc_default_file_change.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
at_scheduled_task.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
batchfile_execution_from_temp.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
bits_jobs.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
browser_extension_installation.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
bypass_user_access_control.yml
removed tactic from titles
2020-12-06 00:34:46 -06:00
change_shell_open_regkeys.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
clear_windows_event_logs.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
cmstp_signed_binary_proxy_execution.yml
changed to arg detection vs file detection
2021-06-08 14:07:33 -05:00
compiled_html_file.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
cor_profiler.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
csc_compile_after_delivery.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
deobfuscate_or_decode_files.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
disable_defender_firewall.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
disable_iis_logging.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
disable_microsoft_office_security_features.yml
removed tactic from titles
2020-12-06 00:34:46 -06:00
disable_or_modify_service_execution.yml
Create disable_or_modify_service_execution.yml
2020-12-18 13:39:22 -06:00
disable_sysmon.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
dll_search_order_hijacking.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
dll_sideloading_of_npp_gup.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
edge_or_ie_cred_extraction_w_pwsh.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
enable_guest_account_with_rdp_and_admin.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
exchange_transport_agent_cmdlet_use.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
findstr_password_extraction.yml
removed tactic from titles
2020-12-06 00:34:46 -06:00
group_policy_preference_extraction.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
image_file_execution_debugger.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
image_file_execution_options_injection.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
inhibit_system_recovery.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
invoke-maldoc.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
kerberoasting.yml
Add detection for kerberoasting
2021-03-17 20:21:25 -05:00
kill_eventlog_service_threads.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
lazagne_password_theft.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
local_account_added_windows.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
logon_scripts_windows.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
lsa_secrets_extraction.yml
removed tactic from titles
2020-12-06 00:34:46 -06:00
lsass_memory_dumping.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
malicious_documents.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
malicious_process_start_added_to_powershell_profile.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
modified_sysinternals_accesschk.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
modify_or_create_windows_service.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
mshta.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
msiexec_remote_msi.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
netsh_helper_dll.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
network_sniffing.yml
T1040 Network Sniffing
2021-03-17 19:20:55 -05:00
non_windows_control_panel_item.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
ntds_copy.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
open_local_port_on_defender_firewall.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
os_credential_dumping.yml
Removed LSASSMemoryAccessed due to HIGH FP
2021-03-17 20:09:19 -05:00
outlook_vba_persistence.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
parent_pid_spoofing.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
pass_the_hash_and_pass_the_ticket.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
powershell_download_cradles.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
powershell_gui_input_capture.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
powershell_http_form_submission.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
powershell_keylogging.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
powershell_time_stomping.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
process_hollowing.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
process_injection.yml
removed tactic from titles
2020-12-06 00:34:46 -06:00
rdp_hijacking.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
registry_credential_enumeration.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
registry_run_keys.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
remove_amsi_provider_reg_key.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
rundll32_possible_cobalt_strike.yml
fixed missing os
2020-12-06 00:58:24 -06:00
scheduled_tasks_creation.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
scheduledtaskregister.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
screensaver_change.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
scripted_lateral_rdp.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
secure_delete_data_destruction.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
security_support_provider.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
service_created.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
service_disabled.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
service_started.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
startup_folder_persistence.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
startup_shortcuts.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
unquoted_service_path_for_program.exe.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
vbs_execution_from_temp.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
web_shell_creation.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
windows_logon_scripts.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
windows_management_instrumentation_event_subscription.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
windows_management_instrumentation.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
windows_remote_management_execution.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
windows_service_creation.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
windows_share_creation.yml
Cleaned up signature descriptions and metadata.
2020-12-05 21:45:38 -06:00
winlogon_helper_dll.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00