issues
search
OTRF
/
ThreatHunter-Playbook
A community-driven, open-source project to share detection logic, adversary tradecraft and resources to make detection development more efficient.
MIT License
3.97k
stars
803
forks
source link
issues
Newest
Newest
Most commented
Recently updated
Oldest
Least commented
Least recently updated
Update queries to EQL
#21
bfuzzy
closed
6 years ago
0
Update to new template...etc
#20
bfuzzy
closed
6 years ago
2
typo fix and access token manipulation
#19
bfuzzy
closed
6 years ago
1
Added Query Registry using reg.exe
#18
bfuzzy
closed
6 years ago
1
Indirect Command Execution
#17
bfuzzy
closed
6 years ago
1
CMSTP_execution
#16
bfuzzy
closed
6 years ago
1
process_masquerading
#15
bfuzzy
closed
6 years ago
2
Additional msbuild.exe detection
#14
rdram0s
closed
4 years ago
3
Contact
#13
rdram0s
closed
6 years ago
2
Dead link
#12
echobb8
closed
6 years ago
1
Can you please help with this query ?
#11
KaptainKool
closed
5 years ago
1
Typo In T1117_regsvr32.xml Rule
#10
davehardy20
closed
6 years ago
1
Addressing an array of bug fixes in atomic Sysmon configs
#9
mattifestation
closed
6 years ago
1
Typo in FileCreate rule in T1138_appcompat.xml
#8
mattifestation
closed
6 years ago
0
RegistryEvent Details element is not supported in Sysmon 3.40 config schema
#7
mattifestation
closed
6 years ago
0
Typos in atomic Sysmon configs results in a failure to parse
#6
mattifestation
closed
6 years ago
1
Update T0000_office_process_creation.xml
#5
MP-blue
closed
6 years ago
1
Add new article from Sqrrl
#4
gameFace22
closed
6 years ago
1
Update remote_execution_via_services.md
#3
jatrost
closed
7 years ago
0
Detect DNS serverlevel plugin dll injection
#2
dim0x69
closed
7 years ago
0
extending in_memory_mimikatz.md with most OpenProcess() callers
#1
dim0x69
closed
7 years ago
0
Previous