Mirrors/keyboardcrunch-sentinelone-queries
1
0
Fork 0
mirror of https://github.com/keyboardcrunch/sentinelone-queries synced 2026-06-08 17:07:13 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
e4aae047651c10e6123463ca18906ed61b93736a
keyboardcrunch-sentinelone-…/queries/windows
T
History
@ e4aae04765 powershell timestomp detection
2020-11-24 12:57:03 -06:00
..
account_access_removal.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
account_manipulation.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
allow_executable_through_defender_firewall.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
allow_smb_and_rdp_on_defender_firewall.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
amsi_bypass_initfailed.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
application_shimming.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
assoc_default_file_change.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
at_scheduled_task.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
bits_jobs.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
browser_extension_installation.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
bypass_user_access_control.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
change_shell_open_regkeys.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
clear_windows_event_logs.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
cmstp.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
compile_after_delivery.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
compiled_html_file.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
cor_profiler.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
deobfuscate_or_decode_files.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
disable_defender_firewall.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
disable_iis_logging.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
disable_microsoft_office_security_features.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
disable_sysmon.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
dll_search_order_hijacking.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
dll_side-loading_of_npp_gup.exe.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
edge_or_ie_cred_extraction_w_pwsh.yml
PasswordVault Browser Cred extraction rule
2020-11-24 12:42:31 -06:00
enable_guest_account_with_rdp_and_admin.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
exchange_transport_agent_cmdlet_use.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
findstr_password_extraction.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
group_policy_preference_extraction.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
image_file_execution_debugger.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
image_file_execution_options_injection.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
inhibit_system_recovery.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
invoke-maldoc.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
kill_eventlog_service_threads.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
lazagne_password_theft.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
local_account_added_windows.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
logon_scripts_windows.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
lsa_secrets.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
lsass_memory_dumping.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
malicious_documents.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
malicious_process_start_added_to_powershell_profile.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
modified_sysinternals_accesschk_chrome_password_collector.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
modify_or_create_windows_service.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
mshta.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
msiexec_remote_msi.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
netsh_helper_dll.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
non_windows_control_panel_item.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
ntds_copy.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
open_local_port_on_defender_firewall.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
outlook_vba_persistence.yml
fix date on outlook_vba_persistence rule
2020-11-24 12:10:45 -06:00
parent_pid_spoofing.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
pass_the_hash_and_pass_the_ticket.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
powershell_gui_input_capture.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
powershell_http_form_submission.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
powershell_keylogging.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
powershell_maldoc.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
powershell_time_stomping.yml
powershell timestomp detection
2020-11-24 12:57:03 -06:00
process_hollowing.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
process_injection.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
rdp_hijacking.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
registry_credential_enumeration.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
registry_run_keys.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
remove_amsi_provider_reg_key.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
scheduled_tasks_creation.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
scheduledtaskregister.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
screensaver_change.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
scripted_lateral_rdp.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
secure_delete_data_destruction.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
security_support_provider.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
service_disable.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
service_start.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
startup_folder.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
startup_shortcuts.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
unquoted_service_path_for_program.exe.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
vbs_execution_from_temp.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
web_shell_creation.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
windows_command_shell.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
windows_logon_scripts.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
windows_management_instrumentation_event_subscription.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
windows_management_instrumentation.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
windows_remote_management.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
windows_service_creation.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
windows_share_creation.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00
winlogon_helper_dll.yml
auto-generated queries from markdown notes
2020-11-23 12:08:31 -06:00