Analytics rules — August 09, 2026
1293 files changed, 53061 insertions, 0 deletions — view the commit on the mirror.
Analytics rule catalog exported for the first time: 1,293 detectors
This is the analytics mirror’s first export, not a day of change to an existing catalog. All 1,293 files under analytics/ are additions — nothing was modified or removed, so there is no prior baseline to diff against.
Each file is one exported detection rule. Given the size and all-additions shape of this commit, individual rules were not read; see the mirror for the full list.
Bulk change — 1,293 files. Per-file diffs are not stored for a change this size; view it on the mirror.
Changes
1293 files listed.
-
▸ ▾ Possible code downloading from a remote host by Regsvr32 added +22 −0
analytics/possible-code-downloading-from-a-remote-host-by-regsvr32Read it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible collection of screen captures with Windows Problem Steps Recorder added +22 −0
analytics/possible-collection-of-screen-captures-with-windows-problem-steps-recorderRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible compromised machine account added +22 −0
analytics/possible-compromised-machine-accountRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible ConsentFix - OAuth Token Theft Detected added +44 −0
analytics/possible-consentfix-oauth-token-theft-detectedRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible data exfiltration over a USB storage device added +24 −0
analytics/possible-data-exfiltration-over-a-usb-storage-deviceRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible data obfuscation added +36 −0
analytics/possible-data-obfuscationRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible DCSync from a non domain controller added +101 −0
analytics/possible-dcsync-from-a-non-domain-controllerRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible Distributed File System Namespace Management (DFSNM) abuse added +23 −0
analytics/possible-distributed-file-system-namespace-management-dfsnm-abuseRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible DLL Hijack into a Microsoft process added +117 −0
analytics/possible-dll-hijack-into-a-microsoft-processRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible DLL Search Order Hijacking added +84 −0
analytics/possible-dll-search-order-hijackingRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible Email collection using Outlook RPC added +22 −0
analytics/possible-email-collection-using-outlook-rpcRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible external RDP Brute-Force added +49 −0
analytics/possible-external-rdp-brute-forceRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible GPO Enumeration added +49 −0
analytics/possible-gpo-enumerationRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible Impossible Travel Pattern - SSO added +61 −0
analytics/possible-impossible-travel-pattern-ssoRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible Insider Threat Activity added +37 −0
analytics/possible-insider-threat-activityRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible internal data exfiltration over a USB storage device added +40 −0
analytics/possible-internal-data-exfiltration-over-a-usb-storage-deviceRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible IPFS traffic was detected added +25 −0
analytics/possible-ipfs-traffic-was-detectedRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible Kerberoasting attack added +36 −0
analytics/possible-kerberoasting-attackRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible Kerberoasting without SPNs added +37 −0
analytics/possible-kerberoasting-without-spnsRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible Kerberos relay attack added +23 −0
analytics/possible-kerberos-relay-attackRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible Kerberos User Enumeration added +36 −0
analytics/possible-kerberos-user-enumerationRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible LDAP enumeration by unsigned process added +49 −0
analytics/possible-ldap-enumeration-by-unsigned-processRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible LDAP Enumeration of Microsoft Configuration Manager added +36 −0
analytics/possible-ldap-enumeration-of-microsoft-configuration-managerRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible LDAP Enumeration Tool Usage added +78 −0
analytics/possible-ldap-enumeration-tool-usageRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible malicious .NET compilation started by a commonly abused process added +22 −0
analytics/possible-malicious-net-compilation-started-by-a-commonly-abused-processRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible multistage attack in Microsoft Teams added +36 −0
analytics/possible-multistage-attack-in-microsoft-teamsRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible network service discovery via command-line tool added +22 −0
analytics/possible-network-service-discovery-via-command-line-toolRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible network sniffing attempt via tcpdump or tshark added +23 −0
analytics/possible-network-sniffing-attempt-via-tcpdump-or-tsharkRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible new DHCP server added +22 −0
analytics/possible-new-dhcp-serverRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible Pass-the-Hash added +22 −0
analytics/possible-pass-the-hashRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible path traversal via HTTP request added +63 −0
analytics/possible-path-traversal-via-http-requestRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible Persistence via group policy Registry keys added +22 −0
analytics/possible-persistence-via-group-policy-registry-keysRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible phishing attack via Microsoft Teams added +63 −0
analytics/possible-phishing-attack-via-microsoft-teamsRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible Privilege Escalation using Delegated MSA account added +37 −0
analytics/possible-privilege-escalation-using-delegated-msa-accountRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible RDP session hijacking using tscon.exe added +22 −0
analytics/possible-rdp-session-hijacking-using-tscon-exeRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible Search For Password Files added +22 −0
analytics/possible-search-for-password-filesRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible SPN enumeration added +36 −0
analytics/possible-spn-enumerationRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible TGT reuse from different hosts (pass the ticket) added +36 −0
analytics/possible-tgt-reuse-from-different-hosts-pass-the-ticketRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible use of a networking driver for network sniffing added +52 −0
analytics/possible-use-of-a-networking-driver-for-network-sniffingRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible use of IPFS was detected added +41 −0
analytics/possible-use-of-ipfs-was-detectedRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Possible webshell file written by a web server process added +70 −0
analytics/possible-webshell-file-written-by-a-web-server-processRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Potential creation of persistent cloud credentials added +26 −0
analytics/potential-creation-of-persistent-cloud-credentialsRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Potential DCSync by an unusual user added +41 −0
analytics/potential-dcsync-by-an-unusual-userRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Potential denial of wallet abusing AI services added +40 −0
analytics/potential-denial-of-wallet-abusing-ai-servicesRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Potential extraction of NAA Account Credentials in Microsoft Configuration Manager added +43 −0
analytics/potential-extraction-of-naa-account-credentials-in-microsoft-configuration-managerRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Potential kubelet impersonation attempt added +36 −0
analytics/potential-kubelet-impersonation-attemptRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Potential NTLM Relay Attack against a Microsoft Configuration Manager Site Server added +40 −0
analytics/potential-ntlm-relay-attack-against-a-microsoft-configuration-manager-site-serverRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Potential NTLM Relay Attack added +70 −0
analytics/potential-ntlm-relay-attackRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Potential Okta access limit breach added +40 −0
analytics/potential-okta-access-limit-breachRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Potential Phishing has been detected added +80 −0
analytics/potential-phishing-has-been-detectedRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Potential SCCM credential harvesting using WMI detected added +70 −0
analytics/potential-sccm-credential-harvesting-using-wmi-detectedRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Potential spoofing of internal domain spotted added +24 −0
analytics/potential-spoofing-of-internal-domain-spottedRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ PowerShell Initiates a Network Connection to GitHub added +36 −0
analytics/powershell-initiates-a-network-connection-to-githubRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ PowerShell pfx certificate extraction added +36 −0
analytics/powershell-pfx-certificate-extractionRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ PowerShell runs suspicious base64-encoded commands added +49 −0
analytics/powershell-runs-suspicious-base64-encoded-commandsRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ PowerShell suspicious flags added +22 −0
analytics/powershell-suspicious-flagsRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ PowerShell used to export mailbox contents added +23 −0
analytics/powershell-used-to-export-mailbox-contentsRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ PowerShell used to remove mailbox export request logs added +23 −0
analytics/powershell-used-to-remove-mailbox-export-request-logsRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Privileged certificate request via certificate template added +50 −0
analytics/privileged-certificate-request-via-certificate-templateRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Privileged role used by Azure application added +23 −0
analytics/privileged-role-used-by-azure-applicationRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Procdump executed from an atypical directory added +24 −0
analytics/procdump-executed-from-an-atypical-directoryRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ PsExec was executed with a suspicious command line added +85 −0
analytics/psexec-was-executed-with-a-suspicious-command-lineRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Punycode characters detected in URL(s) added +24 −0
analytics/punycode-characters-detected-in-url-sRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Python HTTP server started added +22 −0
analytics/python-http-server-startedRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Quarantined email released to recipients added +62 −0
analytics/quarantined-email-released-to-recipientsRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Random-Looking Domain Names added +23 −0
analytics/random-looking-domain-namesRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare access to known advertising domains added +56 −0
analytics/rare-access-to-known-advertising-domainsRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare AppID usage to a rare destination added +54 −0
analytics/rare-appid-usage-to-a-rare-destinationRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare binary connected to a rare cloud resource added +49 −0
analytics/rare-binary-connected-to-a-rare-cloud-resourceRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare binary connected to a rare external host added +49 −0
analytics/rare-binary-connected-to-a-rare-external-hostRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare communication over email ports to external email server by unsigned process added +22 −0
analytics/rare-communication-over-email-ports-to-external-email-server-by-unsigned-processRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare connection to external IP address or host by an application using RMI-IIOP or LDAP protocol added +75 −0
analytics/rare-connection-to-external-ip-address-or-host-by-an-application-using-rmi-iiop-or-ldap-protocolRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare DCOM RPC activity added +37 −0
analytics/rare-dcom-rpc-activityRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare DLP rule match by user added +38 −0
analytics/rare-dlp-rule-match-by-userRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare file transfer over SMB protocol added +22 −0
analytics/rare-file-transfer-over-smb-protocolRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare LDAP enumeration added +22 −0
analytics/rare-ldap-enumerationRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare LOLBIN Process Execution by User added +22 −0
analytics/rare-lolbin-process-execution-by-userRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare machine account creation added +23 −0
analytics/rare-machine-account-creationRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare MS-Update Server was detected added +36 −0
analytics/rare-ms-update-server-was-detectedRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare MS-Update traffic over HTTP added +23 −0
analytics/rare-ms-update-traffic-over-httpRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare NTLM Access By User To Host added +23 −0
analytics/rare-ntlm-access-by-user-to-hostRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare NTLM Usage by User added +23 −0
analytics/rare-ntlm-usage-by-userRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare process accessed a Keychain file added +92 −0
analytics/rare-process-accessed-a-keychain-fileRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare process created an SSH session to an uncommon cloud resource added +24 −0
analytics/rare-process-created-an-ssh-session-to-an-uncommon-cloud-resourceRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare process created an SSH session to an uncommon external host added +64 −0
analytics/rare-process-created-an-ssh-session-to-an-uncommon-external-hostRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare process executed by an AppleScript added +22 −0
analytics/rare-process-executed-by-an-applescriptRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare process execution by user added +22 −0
analytics/rare-process-execution-by-userRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare process execution in organization added +22 −0
analytics/rare-process-execution-in-organizationRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare process spawned by srvany.exe added +22 −0
analytics/rare-process-spawned-by-srvany-exeRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare process with VNC server capabilities started added +24 −0
analytics/rare-process-with-vnc-server-capabilities-startedRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare RDP session to a remote host added +38 −0
analytics/rare-rdp-session-to-a-remote-hostRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare Remote Service (SVCCTL) RPC activity added +63 −0
analytics/rare-remote-service-svcctl-rpc-activityRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare scheduled task created added +77 −0
analytics/rare-scheduled-task-createdRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare Scheduled Task RPC activity from a rarely seen host added +25 −0
analytics/rare-scheduled-task-rpc-activity-from-a-rarely-seen-hostRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare Scheduled Task RPC activity added +71 −0
analytics/rare-scheduled-task-rpc-activityRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare security product signed executable executed in the network added +22 −0
analytics/rare-security-product-signed-executable-executed-in-the-networkRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare service DLL was added to the registry added +55 −0
analytics/rare-service-dll-was-added-to-the-registryRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare signature signed executable executed in the network added +75 −0
analytics/rare-signature-signed-executable-executed-in-the-networkRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare SMB session to a remote host added +38 −0
analytics/rare-smb-session-to-a-remote-hostRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.
-
▸ ▾ Rare SMTP/S Session added +24 −0
analytics/rare-smtp-s-sessionRead it here → This file's diff on GitHub ↗
Generated by the mirror — not a documentation page, so no diff is kept. The counts above still say how much moved.
Diffs are not stored for a change this size — view it on the mirror.