FilesExpand file tree

main

/

cross-platform

/

Copy path

Directory actions

More options

More options

Directory actions

More options

More options

Latest commit

 

History

History

History

 

 

main

/

cross-platform

/

Copy path

Top

Folders and files

Name		Name	Last commit message	Last commit date
parent directory ..
command_and_control_curl_wget_spawn_via_nodejs_parent.toml		command_and_control_curl_wget_spawn_via_nodejs_parent.toml
command_and_control_genai_process_suspicious_tld_connection.toml		command_and_control_genai_process_suspicious_tld_connection.toml
command_and_control_genai_process_unusual_domain.toml		command_and_control_genai_process_unusual_domain.toml
command_and_control_google_drive_malicious_file_download.toml		command_and_control_google_drive_malicious_file_download.toml
command_and_control_non_standard_ssh_port.toml		command_and_control_non_standard_ssh_port.toml
command_and_control_pan_elastic_defend_c2.toml		command_and_control_pan_elastic_defend_c2.toml
command_and_control_socks_fortigate_endpoint.toml		command_and_control_socks_fortigate_endpoint.toml
command_and_control_suricata_elastic_defend_c2.toml		command_and_control_suricata_elastic_defend_c2.toml
credential_access_cookies_chromium_browsers_debugging.toml		credential_access_cookies_chromium_browsers_debugging.toml
credential_access_forced_authentication_pipes.toml		credential_access_forced_authentication_pipes.toml
credential_access_genai_process_sensitive_file_access.toml		credential_access_genai_process_sensitive_file_access.toml
credential_access_gitleaks_execution.toml		credential_access_gitleaks_execution.toml
credential_access_multi_could_secrets_via_api.toml		credential_access_multi_could_secrets_via_api.toml
credential_access_trufflehog_execution.toml		credential_access_trufflehog_execution.toml
defense_evasion_agent_spoofing_mismatched_id.toml		defense_evasion_agent_spoofing_mismatched_id.toml
defense_evasion_agent_spoofing_multiple_hosts.toml		defense_evasion_agent_spoofing_multiple_hosts.toml
defense_evasion_deleting_websvr_access_logs.toml		defense_evasion_deleting_websvr_access_logs.toml
defense_evasion_deletion_of_bash_command_line_history.toml		defense_evasion_deletion_of_bash_command_line_history.toml
defense_evasion_elastic_agent_service_terminated.toml		defense_evasion_elastic_agent_service_terminated.toml
defense_evasion_encoding_rot13_python_script.toml		defense_evasion_encoding_rot13_python_script.toml
defense_evasion_genai_config_modification.toml		defense_evasion_genai_config_modification.toml
defense_evasion_genai_process_compiling_executables.toml		defense_evasion_genai_process_compiling_executables.toml
defense_evasion_genai_process_encoding_prior_to_network_activity.toml		defense_evasion_genai_process_encoding_prior_to_network_activity.toml
defense_evasion_masquerading_space_after_filename.toml		defense_evasion_masquerading_space_after_filename.toml
defense_evasion_potential_http_downgrade_attack.toml		defense_evasion_potential_http_downgrade_attack.toml
defense_evasion_processes_with_trailing_spaces.toml		defense_evasion_processes_with_trailing_spaces.toml
defense_evasion_timestomp_touch.toml		defense_evasion_timestomp_touch.toml
defense_evasion_whitespace_padding_command_line.toml		defense_evasion_whitespace_padding_command_line.toml
discovery_security_software_grep.toml		discovery_security_software_grep.toml
discovery_virtual_machine_fingerprinting_grep.toml		discovery_virtual_machine_fingerprinting_grep.toml
discovery_web_server_local_file_inclusion_activity.toml		discovery_web_server_local_file_inclusion_activity.toml
discovery_web_server_remote_file_inclusion_activity.toml		discovery_web_server_remote_file_inclusion_activity.toml
execution_aws_ec2_lolbin_via_ssm.toml		execution_aws_ec2_lolbin_via_ssm.toml
execution_aws_ssm_sendcommand_with_command_parameters.toml		execution_aws_ssm_sendcommand_with_command_parameters.toml
execution_git_exploit_cve_2025_48384.toml		execution_git_exploit_cve_2025_48384.toml
execution_nodejs_pre_or_post_install_script_execution.toml		execution_nodejs_pre_or_post_install_script_execution.toml
execution_pentest_eggshell_remote_admin_tool.toml		execution_pentest_eggshell_remote_admin_tool.toml
execution_potential_widespread_malware_infection.toml		execution_potential_widespread_malware_infection.toml
execution_privileged_container_creation_with_host_reference.toml		execution_privileged_container_creation_with_host_reference.toml
execution_register_github_actions_runner.toml		execution_register_github_actions_runner.toml
execution_revershell_via_shell_cmd.toml		execution_revershell_via_shell_cmd.toml
execution_suspicious_java_netcon_childproc.toml		execution_suspicious_java_netcon_childproc.toml
execution_via_github_actions_runner.toml		execution_via_github_actions_runner.toml
execution_via_github_runner_with_runner_tracking_id_tampering_via_env_vars.toml		execution_via_github_runner_with_runner_tracking_id_tampering_via_env_vars.toml
guided_onboarding_sample_rule.toml		guided_onboarding_sample_rule.toml
impact_hosts_file_modified.toml		impact_hosts_file_modified.toml
initial_access_azure_o365_with_network_alert.toml		initial_access_azure_o365_with_network_alert.toml
initial_access_execution_susp_react_serv_child.toml		initial_access_execution_susp_react_serv_child.toml
initial_access_exfiltration_new_usb_device_mounted.toml		initial_access_exfiltration_new_usb_device_mounted.toml
initial_access_file_upload_followed_by_get_request.toml		initial_access_file_upload_followed_by_get_request.toml
initial_access_ollama_api_external_access.toml		initial_access_ollama_api_external_access.toml
initial_access_zoom_meeting_with_no_passcode.toml		initial_access_zoom_meeting_with_no_passcode.toml
multiple_alerts_by_host_ip_and_source_ip.toml		multiple_alerts_by_host_ip_and_source_ip.toml
multiple_alerts_different_tactics_host.toml		multiple_alerts_different_tactics_host.toml
multiple_alerts_edr_elastic_defend_by_host.toml		multiple_alerts_edr_elastic_defend_by_host.toml
multiple_alerts_edr_elastic_same_process_tree.toml		multiple_alerts_edr_elastic_same_process_tree.toml
multiple_alerts_elastic_defend_netsecurity_by_host.toml		multiple_alerts_elastic_defend_netsecurity_by_host.toml
multiple_alerts_email_elastic_defend_correlation.toml		multiple_alerts_email_elastic_defend_correlation.toml
multiple_alerts_from_different_modules_by_dstip.toml		multiple_alerts_from_different_modules_by_dstip.toml
multiple_alerts_from_different_modules_by_srcip.toml		multiple_alerts_from_different_modules_by_srcip.toml
multiple_alerts_from_different_modules_by_user.toml		multiple_alerts_from_different_modules_by_user.toml
multiple_alerts_involving_user.toml		multiple_alerts_involving_user.toml
multiple_alerts_risky_host_esql.toml		multiple_alerts_risky_host_esql.toml
multiple_alerts_same_tactic_by_host.toml		multiple_alerts_same_tactic_by_host.toml
multiple_external_edr_alerts_by_host.toml		multiple_external_edr_alerts_by_host.toml
newly_observed_elastic_defend_alert.toml		newly_observed_elastic_defend_alert.toml
newly_observed_elastic_detection_rule.toml		newly_observed_elastic_detection_rule.toml
persistence_credential_access_modify_auth_module_or_config.toml		persistence_credential_access_modify_auth_module_or_config.toml
persistence_shell_profile_modification.toml		persistence_shell_profile_modification.toml
persistence_ssh_authorized_keys_modification.toml		persistence_ssh_authorized_keys_modification.toml
persistence_web_server_potential_command_injection.toml		persistence_web_server_potential_command_injection.toml
privilege_escalation_echo_nopasswd_sudoers.toml		privilege_escalation_echo_nopasswd_sudoers.toml
privilege_escalation_setuid_setgid_bit_set_via_chmod.toml		privilege_escalation_setuid_setgid_bit_set_via_chmod.toml
privilege_escalation_sudo_buffer_overflow.toml		privilege_escalation_sudo_buffer_overflow.toml
privilege_escalation_sudoers_file_mod.toml		privilege_escalation_sudoers_file_mod.toml
privilege_escalation_trap_execution.toml		privilege_escalation_trap_execution.toml
reconnaissance_web_server_discovery_or_fuzzing_activity.toml		reconnaissance_web_server_discovery_or_fuzzing_activity.toml
reconnaissance_web_server_unusual_spike_in_error_logs.toml		reconnaissance_web_server_unusual_spike_in_error_logs.toml
reconnaissance_web_server_unusual_spike_in_error_response_codes.toml		reconnaissance_web_server_unusual_spike_in_error_response_codes.toml
reconnaissance_web_server_unusual_user_agents.toml		reconnaissance_web_server_unusual_user_agents.toml
View all files