Eric Forte 94c73e3ad7 [FR] Minor Typo Fixes (#5784)

2026-03-06 16:12:45 -06:00

..

createremotethread_by_source_process_with_low_occurrence.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

detect_dll_hijack_via_masquerading_as_microsoft_native_libraries.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

detect_masquerading_attempts_as_native_windows_binaries.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

detect_rare_dll_sideload_by_occurrence.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

detect_rare_lsass_process_access_attempts.toml

[FR] Minor Typo Fixes (#5784)

2026-03-06 16:12:45 -06:00

domain_names_queried_via_lolbins_and_with_low_occurrence_frequency.toml

[FR] Minor Typo Fixes (#5784)

2026-03-06 16:12:45 -06:00

drivers_load_with_low_occurrence_frequency.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

excessive_rdp_network_activity_by_source_host_and_user.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

excessive_smb_network_activity_by_process_id.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

executable_file_creation_by_an_unusual_microsoft_binary.toml

[FR] Minor Typo Fixes (#5784)

2026-03-06 16:12:45 -06:00

execution_via_network_logon_by_occurrence_frequency_by_top_source_ip.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

execution_via_remote_services_by_client_address.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

execution_via_startup_with_low_occurrence_frequency.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

execution_via_windows_management_instrumentation_by_occurrence_frequency_by_unique_agent.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

execution_via_windows_scheduled_task_with_low_occurrence_frequency.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

execution_via_windows_services_with_low_occurrence_frequency.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

high_count_of_network_connection_over_extended_period_by_process.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

libraries_loaded_by_svchost_with_low_occurrence_frequency.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

microsoft_office_child_processes_with_low_occurrence_frequency.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

network_discovery_via_sensitive_ports_by_unusual_process.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

pe_file_transfer_via_smb_admin_shares_by_agent.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

persistence_via_run_key_with_low_occurrence_frequency.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

persistence_via_startup_with_low_occurrence_frequency.toml

[Hunt] Remove Default Namespace from indexes (#4866)

2025-07-03 11:08:29 -03:00

potential_exfiltration_by_process_total_egress_bytes.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

rundll32_execution_aggregated_by_cmdline.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

scheduled_task_creation_by_action_via_registry.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

scheduled_tasks_creation_for_unique_hosts_by_task_command.toml

[Hunt] Remove Default Namespace from indexes (#4866)

2025-07-03 11:08:29 -03:00

suspicious_base64_encoded_powershell_commands.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

suspicious_dns_txt_record_lookups_by_process.toml

[New Hunt] Add AWS Hunting Queries to Shared Hunting Library (#3988)

2024-09-04 10:08:44 -04:00

unique_windows_services_creation_by_servicefilename.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

windows_command_and_scripting_interpreter_from_unusual_parent.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00

windows_logon_activity_by_source_ip.toml

[New Hunt] Add Initial Linux Hunting Files (#3847)

2024-07-05 20:01:12 +02:00