Files

 develop

/

stories

/

Copy path

Directory actions

More options

Directory actions

More options

Latest commit

pyth0n1c

Merge branch 'develop' into water

Apr 21, 2025

a219deb · Apr 21, 2025

History

History

/

stories

/

Top

Folders and files

Name		Name	Last commit message	Last commit date
parent directory ..
deprecated		deprecated	remove yamls and update mapping	Apr 15, 2025
3cx_supply_chain_attack.yml		3cx_supply_chain_attack.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
abnormal_kubernetes_behavior_using_splunk_infrastructure_monitoring.yml		abnormal_kubernetes_behavior_using_splunk_infrastructure_monitoring.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
acidpour.yml		acidpour.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
acidrain.yml		acidrain.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
active_directory_discovery.yml		active_directory_discovery.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
active_directory_kerberos_attacks.yml		active_directory_kerberos_attacks.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
active_directory_lateral_movement.yml		active_directory_lateral_movement.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
active_directory_password_spraying.yml		active_directory_password_spraying.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
active_directory_privilege_escalation.yml		active_directory_privilege_escalation.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
adobe_coldfusion_arbitrary_code_execution_cve_2023_29298_cve_2023_26360.yml		adobe_coldfusion_arbitrary_code_execution_cve_2023_29298_cve_2023_26360.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
agenttesla.yml		agenttesla.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
amadey.yml		amadey.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
apache_struts_vulnerability.yml		apache_struts_vulnerability.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
apache_tomcat_session_deserialization_attacks.yml		apache_tomcat_session_deserialization_attacks.yml	Haag Story 3: Attack Analytics to the Rescue	Mar 25, 2025
apt29_diplomatic_deceptions_with_wineloader.yml		apt29_diplomatic_deceptions_with_wineloader.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
asset_tracking.yml		asset_tracking.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
asyncrat.yml		asyncrat.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
atlassian_confluence_server_and_data_center_cve_2022_26134.yml		atlassian_confluence_server_and_data_center_cve_2022_26134.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
awfulshred.yml		awfulshred.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
aws_bedrock_security.yml		aws_bedrock_security.yml	updating spls to match with output from data sources	Apr 17, 2025
aws_defense_evasion.yml		aws_defense_evasion.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
aws_iam_privilege_escalation.yml		aws_iam_privilege_escalation.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
aws_identity_and_access_management_account_takeover.yml		aws_identity_and_access_management_account_takeover.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
aws_network_acl_activity.yml		aws_network_acl_activity.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
aws_s3_bucket_security_monitoring.yml		aws_s3_bucket_security_monitoring.yml	first draft	Feb 12, 2025
aws_security_hub_alerts.yml		aws_security_hub_alerts.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
aws_user_monitoring.yml		aws_user_monitoring.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
azorult.yml		azorult.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
azure_active_directory_account_takeover.yml		azure_active_directory_account_takeover.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
azure_active_directory_persistence.yml		azure_active_directory_persistence.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
azure_active_directory_privilege_escalation.yml		azure_active_directory_privilege_escalation.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
backdoor_pingpong.yml		backdoor_pingpong.yml	adding status	Jan 28, 2025
baron_samedit_cve_2021_3156.yml		baron_samedit_cve_2021_3156.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
bishopfox_sliver_adversary_emulation_framework.yml		bishopfox_sliver_adversary_emulation_framework.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
bits_jobs.yml		bits_jobs.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
black_basta_ransomware.yml		black_basta_ransomware.yml	systembc	Mar 3, 2025
blackbyte_ransomware.yml		blackbyte_ransomware.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
blacklotus_campaign.yml		blacklotus_campaign.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
blackmatter_ransomware.yml		blackmatter_ransomware.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
blacksuit_ransomware.yml		blacksuit_ransomware.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
brand_monitoring.yml		brand_monitoring.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
braodo_stealer.yml		braodo_stealer.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
brute_ratel_c4.yml		brute_ratel_c4.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
cactus_ransomware.yml		cactus_ransomware.yml	Haag's Last Shadow: The Cactus Ransomware Chronicles	Mar 18, 2025
caddy_wiper.yml		caddy_wiper.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
chaos_ransomware.yml		chaos_ransomware.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
china_nexus_threat_activity.yml		china_nexus_threat_activity.yml	auditd_detection_updates	Feb 27, 2025
cisa_aa22_257a.yml		cisa_aa22_257a.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
cisa_aa22_264a.yml		cisa_aa22_264a.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
cisa_aa22_277a.yml		cisa_aa22_277a.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
cisa_aa22_320a.yml		cisa_aa22_320a.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
cisa_aa23_347a.yml		cisa_aa23_347a.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
cisa_aa24_241a.yml		cisa_aa24_241a.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
cisco_ios_xe_software_web_management_user_interface_vulnerability.yml		cisco_ios_xe_software_web_management_user_interface_vulnerability.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
cisco_secure_firewall_threat_defense_analytics.yml		cisco_secure_firewall_threat_defense_analytics.yml	cisco secure firewall detections - first batch	Apr 3, 2025
citrix_netscaler_adc_and_netscaler_gateway_cve_2023_4966.yml		citrix_netscaler_adc_and_netscaler_gateway_cve_2023_4966.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
citrix_netscaler_adc_cve_2023_3519.yml		citrix_netscaler_adc_cve_2023_3519.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
citrix_sharefile_rce_cve_2023_24489.yml		citrix_sharefile_rce_cve_2023_24489.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
cleo_file_transfer_software.yml		cleo_file_transfer_software.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
clop_ransomware.yml		clop_ransomware.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
cloud_cryptomining.yml		cloud_cryptomining.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
cloud_federated_credential_abuse.yml		cloud_federated_credential_abuse.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
cobalt_strike.yml		cobalt_strike.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
coldroot_macos_rat.yml		coldroot_macos_rat.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
collection_and_staging.yml		collection_and_staging.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
command_and_control.yml		command_and_control.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
compromised_linux_host.yml		compromised_linux_host.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
compromised_user_account.yml		compromised_user_account.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
compromised_windows_host.yml		compromised_windows_host.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
confluence_data_center_and_confluence_server_vulnerabilities.yml		confluence_data_center_and_confluence_server_vulnerabilities.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
connectwise_screenconnect_vulnerabilities.yml		connectwise_screenconnect_vulnerabilities.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
credential_dumping.yml		credential_dumping.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
critical_alerts.yml		critical_alerts.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
crushftp_vulnerabilities.yml		crushftp_vulnerabilities.yml	Haag's Crushed Shell: A Tale of CrushFTP Exploitation	Apr 14, 2025
crypto_stealer.yml		crypto_stealer.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
cve_2022_40684_fortinet_appliance_auth_bypass.yml		cve_2022_40684_fortinet_appliance_auth_bypass.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
cve_2023_21716_word_rtf_heap_corruption.yml		cve_2023_21716_word_rtf_heap_corruption.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
cve_2023_22515_privilege_escalation_vulnerability_confluence_data_center_and_server.yml		cve_2023_22515_privilege_escalation_vulnerability_confluence_data_center_and_server.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
cve_2023_23397_outlook_elevation_of_privilege.yml		cve_2023_23397_outlook_elevation_of_privilege.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
cve_2023_36884_office_and_windows_html_rce_vulnerability.yml		cve_2023_36884_office_and_windows_html_rce_vulnerability.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
cyclops_blink.yml		cyclops_blink.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
darkcrystal_rat.yml		darkcrystal_rat.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
darkgate_malware.yml		darkgate_malware.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
darkside_ransomware.yml		darkside_ransomware.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
data_destruction.yml		data_destruction.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
data_exfiltration.yml		data_exfiltration.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
data_protection.yml		data_protection.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
defense_evasion_or_unauthorized_access_via_sddl_tampering.yml		defense_evasion_or_unauthorized_access_via_sddl_tampering.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
deobfuscate_decode_files_or_information.yml		deobfuscate_decode_files_or_information.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
derusbi.yml		derusbi.yml	adding status	Jan 28, 2025
detect_zerologon_attack.yml		detect_zerologon_attack.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
dev_sec_ops.yml		dev_sec_ops.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
dhs_report_ta18_074a.yml		dhs_report_ta18_074a.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
disabling_security_tools.yml		disabling_security_tools.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
dns_amplification_attacks.yml		dns_amplification_attacks.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
dns_hijacking.yml		dns_hijacking.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
domain_trust_discovery.yml		domain_trust_discovery.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
double_zero_destructor.yml		double_zero_destructor.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
dynamic_dns.yml		dynamic_dns.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
earth_alux.yml		earth_alux.yml	Ground Control to Major Haag: Earth Alux	Apr 17, 2025
emotet_malware_dhs_report_ta18_201a.yml		emotet_malware_dhs_report_ta18_201a.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
f5_authentication_bypass_with_tmui.yml		f5_authentication_bypass_with_tmui.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
f5_big_ip_vulnerability_cve_2022_1388.yml		f5_big_ip_vulnerability_cve_2022_1388.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
f5_tmui_rce_cve_2020_5902.yml		f5_tmui_rce_cve_2020_5902.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
fin7.yml		fin7.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
flax_typhoon.yml		flax_typhoon.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
forest_blizzard.yml		forest_blizzard.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
fortinet_fortinac_cve_2022_39952.yml		fortinet_fortinac_cve_2022_39952.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
gcp_account_takeover.yml		gcp_account_takeover.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
gcp_cross_account_activity.yml		gcp_cross_account_activity.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
github_malicious_activity.yml		github_malicious_activity.yml	missing status field	Feb 6, 2025
gomir.yml		gomir.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
gozi_malware.yml		gozi_malware.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
graceful_wipe_out_attack.yml		graceful_wipe_out_attack.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
hafnium_group.yml		hafnium_group.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
handala_wiper.yml		handala_wiper.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
hermetic_wiper.yml		hermetic_wiper.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
hidden_cobra_malware.yml		hidden_cobra_malware.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
icedid.yml		icedid.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
iis_components.yml		iis_components.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
industroyer2.yml		industroyer2.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
information_sabotage.yml		information_sabotage.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
ingress_tool_transfer.yml		ingress_tool_transfer.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
insider_threat.yml		insider_threat.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
ivanti_connect_secure_vpn_vulnerabilities.yml		ivanti_connect_secure_vpn_vulnerabilities.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
ivanti_epm_vulnerabilities.yml		ivanti_epm_vulnerabilities.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
ivanti_epmm_remote_unauthenticated_access.yml		ivanti_epmm_remote_unauthenticated_access.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
ivanti_sentry_authentication_bypass_cve_2023_38035.yml		ivanti_sentry_authentication_bypass_cve_2023_38035.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
ivanti_virtual_traffic_manager_cve_2024_7593.yml		ivanti_virtual_traffic_manager_cve_2024_7593.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
jboss_vulnerability.yml		jboss_vulnerability.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
jenkins_server_vulnerabilities.yml		jenkins_server_vulnerabilities.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
jetbrains_teamcity_unauthenticated_rce.yml		jetbrains_teamcity_unauthenticated_rce.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
jetbrains_teamcity_vulnerabilities.yml		jetbrains_teamcity_vulnerabilities.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
juniper_junos_remote_code_execution.yml		juniper_junos_remote_code_execution.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
kubernetes_scanning_activity.yml		kubernetes_scanning_activity.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
kubernetes_security.yml		kubernetes_security.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
kubernetes_sensitive_object_access_activity.yml		kubernetes_sensitive_object_access_activity.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
linux_living_off_the_land.yml		linux_living_off_the_land.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
linux_persistence_techniques.yml		linux_persistence_techniques.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
linux_post_exploitation.yml		linux_post_exploitation.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
linux_privilege_escalation.yml		linux_privilege_escalation.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
linux_rootkit.yml		linux_rootkit.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
living_off_the_land.yml		living_off_the_land.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
local_privilege_escalation_with_krbrelayup.yml		local_privilege_escalation_with_krbrelayup.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
lockbit_ransomware.yml		lockbit_ransomware.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
log4shell_cve_2021_44228.yml		log4shell_cve_2021_44228.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
lumma_stealer.yml		lumma_stealer.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
malicious_powershell.yml		malicious_powershell.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
masquerading___rename_system_utilities.yml		masquerading___rename_system_utilities.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
medusa_ransomware.yml		medusa_ransomware.yml	firewall_win_events	Mar 24, 2025
meduza_stealer.yml		meduza_stealer.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
metasploit.yml		metasploit.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
meterpreter.yml		meterpreter.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
microsoft_mshtml_remote_code_execution_cve_2021_40444.yml		microsoft_mshtml_remote_code_execution_cve_2021_40444.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
microsoft_sharepoint_server_elevation_of_privilege_cve_2023_29357.yml		microsoft_sharepoint_server_elevation_of_privilege_cve_2023_29357.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
microsoft_support_diagnostic_tool_vulnerability_cve_2022_30190.yml		microsoft_support_diagnostic_tool_vulnerability_cve_2022_30190.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
monitor_for_updates.yml		monitor_for_updates.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
moonpeak.yml		moonpeak.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
moveit_transfer_authentication_bypass.yml		moveit_transfer_authentication_bypass.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
moveit_transfer_critical_vulnerability.yml		moveit_transfer_critical_vulnerability.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
netsh_abuse.yml		netsh_abuse.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
network_discovery.yml		network_discovery.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
njrat.yml		njrat.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
nobelium_group.yml		nobelium_group.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
office_365_account_takeover.yml		office_365_account_takeover.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
office_365_collection_techniques.yml		office_365_collection_techniques.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
office_365_persistence_mechanisms.yml		office_365_persistence_mechanisms.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
okta_account_takeover.yml		okta_account_takeover.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
okta_mfa_exhaustion.yml		okta_mfa_exhaustion.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
openssl_cve_2022_3602.yml		openssl_cve_2022_3602.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
orangeworm_attack_group.yml		orangeworm_attack_group.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
outlook_rce_cve_2024_21378.yml		outlook_rce_cve_2024_21378.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
papercut_mf_ng_vulnerability.yml		papercut_mf_ng_vulnerability.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
petitpotam_ntlm_relay_on_active_directory_certificate_services.yml		petitpotam_ntlm_relay_on_active_directory_certificate_services.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
phemedrone_stealer.yml		phemedrone_stealer.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
php_cgi_rce_attack_on_japanese_organizations.yml		php_cgi_rce_attack_on_japanese_organizations.yml	PHP-CGI RCE Attack on Japanese Organizations	Mar 17, 2025
plugx.yml		plugx.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.yml		possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
prestige_ransomware.yml		prestige_ransomware.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
printnightmare_cve_2021_34527.yml		printnightmare_cve_2021_34527.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
prohibited_traffic_allowed_or_protocol_mismatch.yml		prohibited_traffic_allowed_or_protocol_mismatch.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
proxynotshell.yml		proxynotshell.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
proxyshell.yml		proxyshell.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
pxa_stealer.yml		pxa_stealer.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
qakbot.yml		qakbot.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
ransomware.yml		ransomware.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
ransomware_cloud.yml		ransomware_cloud.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
redline_stealer.yml		redline_stealer.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
remcos.yml		remcos.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
remote_monitoring_and_management_software.yml		remote_monitoring_and_management_software.yml	Update remote_monitoring_and_management_software.yml	Feb 6, 2025
reverse_network_proxy.yml		reverse_network_proxy.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
revil_ransomware.yml		revil_ransomware.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
rhysida_ransomware.yml		rhysida_ransomware.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
router_and_infrastructure_security.yml		router_and_infrastructure_security.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
ryuk_ransomware.yml		ryuk_ransomware.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
salt_typhoon.yml		salt_typhoon.yml	renamed_earth_erties	Mar 19, 2025
samaccountname_spoofing_and_domain_controller_impersonation.yml		samaccountname_spoofing_and_domain_controller_impersonation.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
samsam_ransomware.yml		samsam_ransomware.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
sandworm_tools.yml		sandworm_tools.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
scheduled_tasks.yml		scheduled_tasks.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
seashell_blizzard.yml		seashell_blizzard.yml	Update seashell_blizzard.yml	Mar 28, 2025
security_solution_tampering.yml		security_solution_tampering.yml	Update security_solution_tampering.yml	Jan 29, 2025
shrinklocker.yml		shrinklocker.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
signed_binary_proxy_execution_installutil.yml		signed_binary_proxy_execution_installutil.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
silver_sparrow.yml		silver_sparrow.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
snake_keylogger.yml		snake_keylogger.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
snake_malware.yml		snake_malware.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
snappybee.yml		snappybee.yml	headless_bee	Feb 7, 2025
sneaky_active_directory_persistence_tricks.yml		sneaky_active_directory_persistence_tricks.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
spearphishing_attachments.yml		spearphishing_attachments.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
spring4shell_cve_2022_22965.yml		spring4shell_cve_2022_22965.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
sql_injection.yml		sql_injection.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
sql_server_abuse.yml		sql_server_abuse.yml	Haag's SQL Server Story Time: Tales of SQLCMD and Suspicious Queries 📚	Feb 14, 2025
storm_2460_clfs_zero_day_exploitation.yml		storm_2460_clfs_zero_day_exploitation.yml	The Haag Identity: Storm-2460 CLFS Zero Day	Apr 17, 2025
subvert_trust_controls_sip_and_trust_provider_hijacking.yml		subvert_trust_controls_sip_and_trust_provider_hijacking.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
suspicious_aws_login_activities.yml		suspicious_aws_login_activities.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
suspicious_aws_s3_activities.yml		suspicious_aws_s3_activities.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
suspicious_aws_traffic.yml		suspicious_aws_traffic.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
suspicious_cloud_authentication_activities.yml		suspicious_cloud_authentication_activities.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
suspicious_cloud_instance_activities.yml		suspicious_cloud_instance_activities.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
suspicious_cloud_provisioning_activities.yml		suspicious_cloud_provisioning_activities.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
suspicious_cloud_user_activities.yml		suspicious_cloud_user_activities.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
suspicious_command_line_executions.yml		suspicious_command_line_executions.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
suspicious_compiled_html_activity.yml		suspicious_compiled_html_activity.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
suspicious_dns_traffic.yml		suspicious_dns_traffic.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
suspicious_emails.yml		suspicious_emails.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
suspicious_gcp_storage_activities.yml		suspicious_gcp_storage_activities.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
suspicious_mshta_activity.yml		suspicious_mshta_activity.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
suspicious_okta_activity.yml		suspicious_okta_activity.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
suspicious_regsvcs_regasm_activity.yml		suspicious_regsvcs_regasm_activity.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
suspicious_regsvr32_activity.yml		suspicious_regsvr32_activity.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
suspicious_rundll32_activity.yml		suspicious_rundll32_activity.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
suspicious_windows_registry_activities.yml		suspicious_windows_registry_activities.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
suspicious_wmi_use.yml		suspicious_wmi_use.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
suspicious_zoom_child_processes.yml		suspicious_zoom_child_processes.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
swift_slicer.yml		swift_slicer.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
sysaid_on_prem_software_cve_2023_47246_vulnerability.yml		sysaid_on_prem_software_cve_2023_47246_vulnerability.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
systembc.yml		systembc.yml	systembc	Feb 28, 2025
termite_ransomware.yml		termite_ransomware.yml	medusa_ransomware	Apr 1, 2025
text4shell_cve_2022_42889.yml		text4shell_cve_2022_42889.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
trickbot.yml		trickbot.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
trusted_developer_utilities_proxy_execution.yml		trusted_developer_utilities_proxy_execution.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
trusted_developer_utilities_proxy_execution_msbuild.yml		trusted_developer_utilities_proxy_execution_msbuild.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
unusual_processes.yml		unusual_processes.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
use_of_cleartext_protocols.yml		use_of_cleartext_protocols.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
valleyrat.yml		valleyrat.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
vanhelsing_ransomware.yml		vanhelsing_ransomware.yml	Update vanhelsing_ransomware.yml	Mar 28, 2025
vmware_aria_operations_vrealize_cve_2023_20887.yml		vmware_aria_operations_vrealize_cve_2023_20887.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
vmware_esxi_ad_integration_authentication_bypass_cve_2024_37085.yml		vmware_esxi_ad_integration_authentication_bypass_cve_2024_37085.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
vmware_server_side_injection_and_privilege_escalation.yml		vmware_server_side_injection_and_privilege_escalation.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
volt_typhoon.yml		volt_typhoon.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
warzone_rat.yml		warzone_rat.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
water_gamayun.yml		water_gamayun.yml	Water Gamayun	Apr 17, 2025
whispergate.yml		whispergate.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
windealer_rat.yml		windealer_rat.yml	adding status	Jan 28, 2025
windows_applocker.yml		windows_applocker.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
windows_attack_surface_reduction.yml		windows_attack_surface_reduction.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
windows_audit_policy_tampering.yml		windows_audit_policy_tampering.yml	Update windows_audit_policy_tampering.yml	Feb 19, 2025
windows_bootkits.yml		windows_bootkits.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
windows_certificate_services.yml		windows_certificate_services.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
windows_defense_evasion_tactics.yml		windows_defense_evasion_tactics.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
windows_discovery_techniques.yml		windows_discovery_techniques.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
windows_dns_sigred_cve_2020_1350.yml		windows_dns_sigred_cve_2020_1350.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
windows_drivers.yml		windows_drivers.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
windows_error_reporting_service_elevation_of_privilege_vulnerability.yml		windows_error_reporting_service_elevation_of_privilege_vulnerability.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
windows_file_extension_and_association_abuse.yml		windows_file_extension_and_association_abuse.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
windows_log_manipulation.yml		windows_log_manipulation.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
windows_persistence_techniques.yml		windows_persistence_techniques.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
windows_post_exploitation.yml		windows_post_exploitation.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
windows_privilege_escalation.yml		windows_privilege_escalation.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
windows_registry_abuse.yml		windows_registry_abuse.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
windows_service_abuse.yml		windows_service_abuse.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
windows_system_binary_proxy_execution_msiexec.yml		windows_system_binary_proxy_execution_msiexec.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
winrar_spoofing_attack_cve_2023_38831.yml		winrar_spoofing_attack_cve_2023_38831.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
winter_vivern.yml		winter_vivern.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
wordpress_vulnerabilities.yml		wordpress_vulnerabilities.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
ws_ftp_server_critical_vulnerabilities.yml		ws_ftp_server_critical_vulnerabilities.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
xmrig.yml		xmrig.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
xorddos.yml		xorddos.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
zdi_can_25373_windows_shortcut_exploit_abused_as_zero_day.yml		zdi_can_25373_windows_shortcut_exploit_abused_as_zero_day.yml	fixor	Apr 1, 2025
zscaler_browser_proxy_threats.yml		zscaler_browser_proxy_threats.yml	Add status deprecated/production to all stories and baselines as appr…	Jan 25, 2025
View all files