Analytics rules — August 09, 2026
1293 files changed, 53061 insertions, 0 deletions — view the commit on the mirror.
Analytics rule catalog exported for the first time: 1,293 detectors
This is the analytics mirror’s first export, not a day of change to an existing catalog. All 1,293 files under analytics/ are additions — nothing was modified or removed, so there is no prior baseline to diff against.
Each file is one exported detection rule. Given the size and all-additions shape of this commit, individual rules were not read; see the mirror for the full list.
Bulk change — 1,293 files. Per-file diffs are not stored for a change this size; view it on the mirror.
Changes
1293 files listed.
-
▸ ▾ Unusual cloud identity impersonation added +79 −0
analytics/unusual-cloud-identity-impersonationRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual cloud Instance Metadata Service (IMDS) access added +101 −0
analytics/unusual-cloud-instance-metadata-service-imds-accessRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual compressed file password protection added +36 −0
analytics/unusual-compressed-file-password-protectionRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual Conditional Access operation for an identity added +36 −0
analytics/unusual-conditional-access-operation-for-an-identityRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual cross projects activity added +38 −0
analytics/unusual-cross-projects-activityRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual DB process spawning a shell added +70 −0
analytics/unusual-db-process-spawning-a-shellRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual display name in From header added +55 −0
analytics/unusual-display-name-in-from-headerRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual Encrypting File System Remote call (EFSRPC) to domain controller added +66 −0
analytics/unusual-encrypting-file-system-remote-call-efsrpc-to-domain-controllerRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual exec into a Kubernetes Pod added +91 −0
analytics/unusual-exec-into-a-kubernetes-podRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual file-sharing links for mailbox owner added +40 −0
analytics/unusual-file-sharing-links-for-mailbox-ownerRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual hostname for the sending mail server in the email headers added +22 −0
analytics/unusual-hostname-for-the-sending-mail-server-in-the-email-headersRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual IAM enumeration activity by a non-user Identity added +24 −0
analytics/unusual-iam-enumeration-activity-by-a-non-user-identityRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual Identity and Access Management (IAM) activity added +56 −0
analytics/unusual-identity-and-access-management-iam-activityRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual internal access to network device management interface added +24 −0
analytics/unusual-internal-access-to-network-device-management-interfaceRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual key management activity added +24 −0
analytics/unusual-key-management-activityRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual Kubernetes dashboard communication from a pod added +36 −0
analytics/unusual-kubernetes-dashboard-communication-from-a-podRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual Kubernetes secret access added +25 −0
analytics/unusual-kubernetes-secret-accessRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual Kubernetes service account file read added +114 −0
analytics/unusual-kubernetes-service-account-file-readRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual Lolbins Process Spawned by InstallUtil.exe added +22 −0
analytics/unusual-lolbins-process-spawned-by-installutil-exeRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual multi-region AWS Resource Explorer searches added +23 −0
analytics/unusual-multi-region-aws-resource-explorer-searchesRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual Netsh PortProxy rule added +55 −0
analytics/unusual-netsh-portproxy-ruleRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual process access to ld.so.preload file added +22 −0
analytics/unusual-process-access-to-ld-so-preload-fileRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual process accessed a crypto wallet's files added +22 −0
analytics/unusual-process-accessed-a-crypto-wallet-s-filesRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual process accessed a macOS notes DB file added +36 −0
analytics/unusual-process-accessed-a-macos-notes-db-fileRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual process accessed a messaging app's files added +24 −0
analytics/unusual-process-accessed-a-messaging-app-s-filesRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual process accessed a web browser history file added +42 −0
analytics/unusual-process-accessed-a-web-browser-history-fileRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual process accessed FTP Client credentials added +22 −0
analytics/unusual-process-accessed-ftp-client-credentialsRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual process accessed the PowerShell history file added +22 −0
analytics/unusual-process-accessed-the-powershell-history-fileRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual process accessed web browser cookies added +36 −0
analytics/unusual-process-accessed-web-browser-cookiesRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual process accessed web browser credentials added +49 −0
analytics/unusual-process-accessed-web-browser-credentialsRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual process executed by AWS Systems Manager added +22 −0
analytics/unusual-process-executed-by-aws-systems-managerRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual Process Spawned by Nginx in Ingress-Nginx pod added +40 −0
analytics/unusual-process-spawned-by-nginx-in-ingress-nginx-podRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual resource access by Azure application added +37 −0
analytics/unusual-resource-access-by-azure-applicationRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual resource modification by newly seen IAM user added +73 −0
analytics/unusual-resource-modification-by-newly-seen-iam-userRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual secret management activity added +25 −0
analytics/unusual-secret-management-activityRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual sender IP subnet added +49 −0
analytics/unusual-sender-ip-subnetRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual SSH activity that resembles SSH proxy added +63 −0
analytics/unusual-ssh-activity-that-resembles-ssh-proxyRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual SSH Activity added +50 −0
analytics/unusual-ssh-activityRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual URL(s) sent by a brand were observed in the email added +24 −0
analytics/unusual-url-s-sent-by-a-brand-were-observed-in-the-emailRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual use of a 'SysInternals' tool added +62 −0
analytics/unusual-use-of-a-sysinternals-toolRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual user account enablement added +37 −0
analytics/unusual-user-account-enablementRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual user account unlock added +37 −0
analytics/unusual-user-account-unlockRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual user-agent for a cloud identity added +44 −0
analytics/unusual-user-agent-for-a-cloud-identityRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unusual weak authentication by user added +22 −0
analytics/unusual-weak-authentication-by-userRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Unverified domain added to Azure AD added +36 −0
analytics/unverified-domain-added-to-azure-adRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Upload pattern that resembles Peer to Peer traffic added +27 −0
analytics/upload-pattern-that-resembles-peer-to-peer-trafficRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Usage of homograph characters detected in an email attachment(s) name added +40 −0
analytics/usage-of-homograph-characters-detected-in-an-email-attachment-s-nameRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Usage of homograph characters detected in an email's from header added +23 −0
analytics/usage-of-homograph-characters-detected-in-an-email-s-from-headerRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Usage of homograph characters detected in an email added +23 −0
analytics/usage-of-homograph-characters-detected-in-an-emailRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ User accessed multiple O365 AIP sensitive files added +23 −0
analytics/user-accessed-multiple-o365-aip-sensitive-filesRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ User accessed SaaS resource via anonymous link added +50 −0
analytics/user-accessed-saas-resource-via-anonymous-linkRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ User account delegation change added +50 −0
analytics/user-account-delegation-changeRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ User added a new device to Okta Verify instance added +38 −0
analytics/user-added-a-new-device-to-okta-verify-instanceRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ User added SID History to an account added +39 −0
analytics/user-added-sid-history-to-an-accountRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ User added to a group and removed added +56 −0
analytics/user-added-to-a-group-and-removedRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ User added to the SMS Admins local group added +41 −0
analytics/user-added-to-the-sms-admins-local-groupRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ User and Group Enumeration via SAMR added +23 −0
analytics/user-and-group-enumeration-via-samrRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ User attempted to connect from a suspicious country added +61 −0
analytics/user-attempted-to-connect-from-a-suspicious-countryRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ User collected remote shared files in an archive added +23 −0
analytics/user-collected-remote-shared-files-in-an-archiveRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ User discovery via WMI query execution added +73 −0
analytics/user-discovery-via-wmi-query-executionRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ User exported multiple messages in Microsoft Teams via Graph API added +62 −0
analytics/user-exported-multiple-messages-in-microsoft-teams-via-graph-apiRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ User installed an application in Microsoft Teams via Graph API added +36 −0
analytics/user-installed-an-application-in-microsoft-teams-via-graph-apiRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ User moved Exchange sent messages to deleted items added +36 −0
analytics/user-moved-exchange-sent-messages-to-deleted-itemsRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ User sent messages in Microsoft Teams to multiple conversations via Graph API added +36 −0
analytics/user-sent-messages-in-microsoft-teams-to-multiple-conversations-via-graph-apiRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ User set insecure CA registry setting for global SANs added +22 −0
analytics/user-set-insecure-ca-registry-setting-for-global-sansRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ User signed in to an application via Power Automate for the first time added +40 −0
analytics/user-signed-in-to-an-application-via-power-automate-for-the-first-timeRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ VM Detection attempt on Linux added +54 −0
analytics/vm-detection-attempt-on-linuxRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ VM Detection attempt added +23 −0
analytics/vm-detection-attemptRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ VPN access with an abnormal operating system added +50 −0
analytics/vpn-access-with-an-abnormal-operating-systemRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ VPN login attempt by a honey user added +37 −0
analytics/vpn-login-attempt-by-a-honey-userRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ VPN login Brute-Force attempt added +59 −0
analytics/vpn-login-brute-force-attemptRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ VPN login by a dormant user added +23 −0
analytics/vpn-login-by-a-dormant-userRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ VPN login by a service account added +37 −0
analytics/vpn-login-by-a-service-accountRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ VPN Login Password Spray added +53 −0
analytics/vpn-login-password-sprayRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ VPN login with a machine account added +37 −0
analytics/vpn-login-with-a-machine-accountRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Vulnerable certificate template loaded added +50 −0
analytics/vulnerable-certificate-template-loadedRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Wbadmin deleted files in quiet mode added +22 −0
analytics/wbadmin-deleted-files-in-quiet-modeRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Weakly-Encrypted Kerberos TGT Response added +41 −0
analytics/weakly-encrypted-kerberos-tgt-responseRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Weakly-Encrypted Kerberos Ticket Requested added +37 −0
analytics/weakly-encrypted-kerberos-ticket-requestedRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Web server CGO executed a process following a potential Webshell dropped added +22 −0
analytics/web-server-cgo-executed-a-process-following-a-potential-webshell-droppedRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Web server CGO executed an uncommon process added +40 −0
analytics/web-server-cgo-executed-an-uncommon-processRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ WebDAV drive mounted from net.exe over HTTPS added +22 −0
analytics/webdav-drive-mounted-from-net-exe-over-httpsRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Well-known brand in sender headers with header inconsistencies added +22 −0
analytics/well-known-brand-in-sender-headers-with-header-inconsistenciesRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Windows CGO, actor and action processes with anomalous characteristics added +36 −0
analytics/windows-cgo-actor-and-action-processes-with-anomalous-characteristicsRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Windows CGO, actor process and action module with anomalous characteristics added +36 −0
analytics/windows-cgo-actor-process-and-action-module-with-anomalous-characteristicsRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Windows Event Log was cleared using wevtutil.exe added +49 −0
analytics/windows-event-log-was-cleared-using-wevtutil-exeRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Windows event logs were cleared with PowerShell added +62 −0
analytics/windows-event-logs-were-cleared-with-powershellRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Windows Installer exploitation for local privilege escalation added +22 −0
analytics/windows-installer-exploitation-for-local-privilege-escalationRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Windows LOLBIN executable connected to a rare external host added +49 −0
analytics/windows-lolbin-executable-connected-to-a-rare-external-hostRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ WmiPrvSe.exe Rare Child Command Line added +42 −0
analytics/wmiprvse-exe-rare-child-command-lineRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Wscript/Cscript loads .NET DLLs added +22 −0
analytics/wscript-cscript-loads-net-dllsRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Wsmprovhost.exe Rare Child Process added +24 −0
analytics/wsmprovhost-exe-rare-child-processRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ X-Forefront-Antispam-Report has flagged this email as a potential threat added +282 −0
analytics/x-forefront-antispam-report-has-flagged-this-email-as-a-potential-threatRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.