SecOpsAuthPasswordSprayHost
| Updated to use Devo Cyber Data Model fields for union tables |
SecOpsAuthPasswordSprayIp
|
SecOpsCDPossibleIocIpFoundInAuthData
|
SecOpsLoginFailAttempts
|
SecOpsLoginFailCombinedSuccessed
|
SecOpsO365AuthExcessiveFailedLoginsSingleSource
|
SecOpsSimultaneouslyLoginbyIP
|
SecOpsEntityBehaviorEntropyUser
|
SecOpsEntityNewServer
|
SecOpsAzureUserAddedToRoleNonPIM
|
SecOpsAzureUserInfoDownload
|
SecOpsAWSInstancesCreatedOrDeletedO365
|
SecOpsActivityInfrequentCountryO365
|
SecOpsActivityPerformedByTerminatedUserO365
|
SecOpsAdministrativeActivityFromNonCorporateIPO365
|
SecOpsAnomalousBehaviorDiscoveredUsersO365
|
SecOpsArrowAdminFailedLogonO365
|
SecOpsAzureADThreatIntelligenceO365
|
SecOpsCloudDiscoveryAnomalyDetectionO365
|
SecOpsGroupMembershipModifiedO365
|
SecOpsMFADisabledAlertO365
|
SecOpsMaliciousOAuthAppConsentO365
|
SecOpsMalwareDetectionO365
|
SecOpsMultipleDeleteVMO365
|
SecOpsMultipleStorageDeletionActivitiesO365
|
SecOpsMultipleVMCreationActivitiesO365
|
SecOpsPermissionsAddedMailboxFolderO365
|
SecOpsRansomwareActivityO365
|
SecOpsSuspiciousEmailDeletionActivityO365
|
SecOpsSuspiciousInboxForwardingO365
|
SecOpsSuspiciousInboxManipulationRuleO365
|
SecOpsSuspiciousOAuthAppFileDownloadO365
|
SecOpsUnusualAdministrativeActivityO365
|
SecOpsUnusualFileDeletionActivityO365
|
SecOpsUnusualFileDownloadO365
|
SecOpsUnusualImpersonatedActivityO365
|
 |
SecOpsHAFNIUMUserAgentsTargetingExchangeServers
|
SecOpsLog4ShellVulnOverDomainsUnionTableConnections
|
SecOpsPossibleDnsEncodingQuery
|
SecOpsTLDFromDomainNotInMozillaTLD
|
SecOpsUnusualUseragentLength
|
SecOpsAnonymousConnection
|
SecOpsCDFWSrcIpIsPossibleIoc
|
SecOpsCDHuntFWdstIpIsPossibleIoc
|
SecOpsFWEmbargoedCountryInboundTrafficDetected
|
SecOpsFWEmbargoedCountryOutboundTrafficDetected
|
SecOpsFWExcessFirewallDenies
|
SecOpsFWExcessFirewallDeniesOutbound
|
SecOpsFWExternalSMBTrafficDetectedFirewall
|
SecOpsFWIcmpExcessivePackets
|
SecOpsFWIpScanExternal
|
SecOpsFWIpScanInternal
|
SecOpsFWIrcTrafficExternalDestination
|
SecOpsFWPortScanExternalSource
|
SecOpsFWPortScanInternalSource
|
SecOpsFWPortSweepInternalSource
|
SecOpsFWRDPExternalAccess
|
SecOpsFWSMBInboundScanningDetected
|
SecOpsFWSMBInternalScanningDetected
|
SecOpsFWSMBTrafficOutbound
|
SecOpsFWSigred
|
SecOpsFWTrafficForeignDestination
|
SecOpsFWTrafficOnUnassignedLowPort
|
SecOpsFwTftpOutboundTraffic
|
SecOpsHAFNIUMNetworkActivityTargetingExchangeServers
|
SecOpsLog4ShellVulnOverFirewallTrafficConnections
|
SecOpsPossibleTrafficMirroring
|
SecOpsRevilKaseyaNetworkActivity
|
SecOpsVNCPortOpen
|
SecOpsPossiblePortKnocking
|
SecOpsCDIocUrlSuspiciousProxyData
|
SecOpsCDProxyDstIp
|
SecOpsCDProxySrcIp
|
SecOpsDynamicDNSDetected
|
SecOpsIPInsteadADomaInInURL
|
SecOpsLog4ShellVulnerabilityOverProxyConnections
|
SecOpsMultipleHTTPMethodsUsed
|
SecOpsNonStandardHTTPMethod
|
SecOpsOutboundTrafficToDeviceFlaggedAsThreat
|
SecOpsOutcomingUnauthenticatedArbitraryFileReadInVMwareVCenter
|
SecOpsPortIntoURL
|
SecOpsProxyHighRiskFileExtension
|
SecOpsProxyHttpSingleCharacterFileNameRequest
|
SecOpsREvilKaseyaWebShellsUploadConn
|
SecOpsSeveralAccessByProxy
|
SecOpsUserBlockedbyProxy
|
SecOpsHAFNIUMHashFoundFileTargetingExchangeServers
|
SecOpsREvilKaseyaHashFound
|
SecOpsRemoteDesktopProtocolScan
|
SecOpsBackupFileAccessAttempt
|
SecOpsCDIocIpSuspiciousWebData
|
SecOpsCDWebSrcIp
|
SecOpsConfigurationFileAccessAttempt
|
SecOpsCredentialsFileAccessAttempt
|
SecOpsDatabaseFileAccessAttempt
|
SecOpsDiscoveringPasswordFiles
|
SecOpsExplotationAttemptF5BigIp
|
SecOpsHAFNIUMHttpPostTargetingExchangeServers
|
SecOpsHAFNIUMWebShellsTargetingExchangeServers
|
SecOpsHTTPQueryNonStandardMethod
|
SecOpsHTTPQueryUserAgentLengthOutsize
|
SecOpsIncomingUnauthenticatedArbitraryFileReadInVMwareVCenter
|
SecOpsLog4ShellVulnerabilityOverWebServerConnections
|
SecOpsLogRelatedFileAccessAttempt
|
SecOpsMalwareFileAccessAttempt
|
SecOpsPossibleFuzzingAttack
|
SecOpsPossibleInjectionUserAgent
|
SecOpsPossiblePathTrasversalInjection
|
SecOpsPossiblePhishingKitByReferer
|
SecOpsREvilKaseyaWebShells
|
SecOpsRobotFileAskingByNoRobot
|
SecOpsSeveralError4xx
|
SecOpsSoftwareInfoAccessAttempt
|
SecOpsWebShellFileSuspicious
|
SecOpsADAccountNoExpires
|
SecOpsADPasswdNoExpires
|
SecOpsAPT29byGoogleUpdateServiceInstall
|
SecOpsAccountsCreatedRemovedWithinFourHours
|
SecOpsAppInitDLLsLoaded
|
SecOpsBlackByteRansomwareRegChangesPowershell
|
SecOpsBlackByteRansomwareRegistryChanges
|
SecOpsBlackKingdomWebshellInstalation
|
SecOpsBlankPasswordAsk
|
SecOpsBypassUserAccountControl
|
SecOpsChangesAccessibilityBinaries
|
SecOpsDLLWithNonUsualPath
|
SecOpsDeletingMassAmountOfFiles
|
SecOpsFailLogOn
|
SecOpsFsutilSuspiciousInvocation
|
SecOpsGenericRansomwareBehaviorIpScanner
|
SecOpsHAFNIUMUmServiceSuspiciousFileTargetingExchangeServers
|
SecOpsIntegrityProblem
|
SecOpsLocalUserCreation
|
SecOpsLolbinBitsadminTransfer
|
SecOpsLolbinCertocexecution
|
SecOpsLolbinCertreq
|
SecOpsLolbinCertutil
|
SecOpsLolbinConfigsecuritypolicy
|
SecOpsLolbinDatasvcutil
|
SecOpsLolbinMshta
|
SecOpsMaliciousPowerShellCommandletNames
|
SecOpsMaliciousPowerShellPrebuiltCommandlet
|
SecOpsMaliciousServiceInstallations
|
SecOpsMultipleMachineAccessedbyUser
|
SecOpsNewAccountCreated
|
SecOpsNtds
|
SecOpsOsCredentialDumpingGsecdump
|
SecOpsPassTheHashActivityLoginBehaviour
|
SecOpsPersistenceAndExecutionViaGPOScheduledTask
|
SecOpsPsExecToolExecution
|
SecOpsRansomwareBehaviorMaze
|
SecOpsRansomwareBehaviorNotPetya
|
SecOpsRansomwareBehaviorRyuk
|
SecOpsRareServiceInstalls
|
SecOpsResetPasswordAttempt
|
SecOpsRevilKaseyaRegistryKey
|
SecOpsSIGRedExploitMicrosoftWindowsDNS
|
SecOpsSecurityEnabledLocalGroupChanged
|
SecOpsSeveralPasswordChanges
|
SecOpsShadowCopiesDeletion
|
SecOpsStoneDrillServiceInstall
|
SecOpsStopSqlServicesRunning
|
SecOpsSuspiciousBehaviorAppInitDLL
|
SecOpsSuspiciousEventlogClearUsingWevtutil
|
SecOpsSuspiciousWMIExecution
|
SecOpsTurlaPNGDropperService
|
SecOpsTurlaServiceInstall
|
SecOpsUserAccountChanged
|
SecOpsWINWmiMOFProcessExecution
|
SecOpsWannaCryBehavior
|
SecOpsWermgrConnectingToIPCheckWebServices
|
SecOpsWinADDomainEnumeration
|
SecOpsWinActivateNoCloseGroupPolicyFeature
|
SecOpsWinActivateNoControlPanelGroupPolicyFeature
|
SecOpsWinActivateNoFileMenuGroupPolicyFeature
|
SecOpsWinActivateNoPropertiesMyDocumentsGroupPolicyFeature
|
SecOpsWinActivateNoSetTaskbarGroupPolicyFeature
|
SecOpsWinActivateNoTrayContextMenuGroupPolicyFeature
|
SecOpsWinAddRegistryValueToLoadSrvcInSafeModeWONetwork
|
SecOpsWinAddRegistryValueToLoadSrvcInSafeModeWithNetwork
|
SecOpsWinAdminRemoteLogon
|
SecOpsWinAdminShareSuspiciousUse
|
SecOpsWinAnonymousAccountCreated
|
SecOpsWinAppInstallerExecution
|
SecOpsWinAttackerToolsOnEndpoint
|
SecOpsWinAttemptToAddCertificateToStore
|
SecOpsWinAuditLogCleared
|
SecOpsWinAutomatedCollectionCmd
|
SecOpsWinAutomatedCollectionPowershell
|
SecOpsWinBackupCatalogDeleted
|
SecOpsWinCompressEncryptData
|
SecOpsWinCredentialDumpingNppspy
|
SecOpsWinCritServiceStopped
|
SecOpsWinCurl
|
SecOpsWinDcShadowDetected
|
SecOpsWinDefenderDownloadActivity
|
SecOpsWinDisableAntispywareRegistry
|
SecOpsWinDisableUac
|
SecOpsWinDnsExeParentProcess
|
SecOpsWinDomainTrustActivity
|
SecOpsWinExcessiveUserInteractiveLogin
|
SecOpsWinExternalDeviceInstallationDenied
|
SecOpsWinFTPScriptExecution
|
SecOpsWinFakeProcesses
|
SecOpsWinFsutilDeleteChangeJournal
|
SecOpsWinGatherVictimIdentitySAMInfo
|
SecOpsWinGoldenSamlCertificateExport
|
SecOpsWinIISWebRootProcessExecution
|
SecOpsWinIcmpExfiltration
|
SecOpsWinInvokewebrequestUse
|
SecOpsWinKerberosUserEnumeration
|
SecOpsWinLocalSystemExecuteWhoami
|
SecOpsWinLockoutsEndpoint
|
SecOpsWinLsassKeyModification
|
SecOpsWinLsassMemDump
|
SecOpsWinMapSmbShare
|
SecOpsWinMemoryCorruptionVulnerability
|
SecOpsWinMimikatzLsadump
|
SecOpsWinModifyShowCompressColorAndInfoTipRegistry
|
SecOpsWinMsiExecInstallWeb
|
SecOpsWinNetworkShareCreated
|
SecOpsWinNewPsDrive
|
SecOpsWinOfficeBrowserLaunchingShell
|
SecOpsWinPermissionGroupDiscovery
|
SecOpsWinPotentialPassTheHash
|
SecOpsWinPowerSettings
|
SecOpsWinPowershellKeyloggin
|
SecOpsWinPowershellProcessDiscovery
|
SecOpsWinPowershellSetExecutionPolicyBypass
|
SecOpsWinRcloneExecution
|
SecOpsWinRegUtilityHiveExport
|
SecOpsWinRegistryModificationActivateNoRunGroupPolicy
|
SecOpsWinRegistryModificationDisableCMDApp
|
SecOpsWinRegistryModificationDisableChangePasswdFeature
|
SecOpsWinRegistryModificationDisableLockWSFeature
|
SecOpsWinRegistryModificationDisableLogOffButton
|
SecOpsWinRegistryModificationDisableNotificationCenter
|
SecOpsWinRegistryModificationDisableRegistryTool
|
SecOpsWinRegistryModificationDisableShutdownButton
|
SecOpsWinRegistryModificationDisableTaskmgr
|
SecOpsWinRegistryModificationGlobalFolderOptions
|
SecOpsWinRegistryModificationHideClockGroupPolicyFeature
|
SecOpsWinRegistryModificationHideSCAHealth
|
SecOpsWinRegistryModificationHideSCANetwork
|
SecOpsWinRegistryModificationHideSCAPower
|
SecOpsWinRegistryModificationHideSCAVolume
|
SecOpsWinRegistryModificationIExplorerSecZone
|
SecOpsWinRegistryModificationNewTrustedSite
|
SecOpsWinRegistryModificationNoDesktopGroupPolicy
|
SecOpsWinRegistryModificationNoFindGroupPolicyFeature
|
SecOpsWinRegistryModificationPowershellLoggingDisabled
|
SecOpsWinRegistryModificationRunKeyAdded
|
SecOpsWinRegistryModificationStoreLogonCred
|
SecOpsWinRegistryQuery
|
SecOpsWinRemoteSystemDiscovery
|
SecOpsWinRunasCommandExecution
|
SecOpsWinSamStopped
|
SecOpsWinScheduledTaskCreation
|
SecOpsWinSchtasksForcedReboot
|
SecOpsWinSchtasksRemoteSystem
|
SecOpsWinSensitiveFiles
|
SecOpsWinServiceCreatedNonStandardPath
|
SecOpsWinShadowCopyDetected
|
SecOpsWinSmtpExfiltration
|
SecOpsWinSpoolsvExeAbnormalProcessSpawn
|
SecOpsWinSuspiciousExternalDeviceInstallation
|
SecOpsWinSuspiciousWritesToRecycleBin
|
SecOpsWinSysInfoGatheringUsingDxdiag
|
SecOpsWinSysInternalsActivityDetected
|
SecOpsWinSysTimeDiscovery
|
SecOpsWinTFTPExecution
|
SecOpsWinUserAddedPrivlegedSecGroup
|
SecOpsWinUserAddedSelfToSecGroup
|
SecOpsWinUserAddedToLocalSecurityEnabledGroup
|
SecOpsWinUserCreationAbnormalNamingConvention
|
SecOpsWinUserCredentialDumpRegistry
|
SecOpsWinWMIPermanentEventSubscription
|
SecOpsWinWMIReconRunningProcessOrSrvcs
|
SecOpsWinWebclientClassUse
|
SecOpsWinWifiCredHarvestNetsh
|
SecOpsWinWmiExecVbsScript
|
SecOpsWinWmiLaunchingShell
|
SecOpsWinWmiProcessCallCreate
|
SecOpsWinWmiScriptExecution
|
SecOpsWinWmiTemporaryEventSubscription
|
SecOpsWinWmiprvseSpawningProcess
|
SecOpsMoveitWebShell
|
SecOpsWinDnsExcessiveEmptyOrRefusedQueries
|
