File tree

• x-pack/legacy/plugins/siem/server/lib/detection_engine/rules/prepackaged_rules
  • ece_network_detect_large_outbound_icmp_packets.json
  • ece_network_detect_long_dns_txt_record_response.json
  • ece_network_protocols_passing_authentication_in_cleartext.json
  • ece_windows_child_processes_of_spoolsvexe.json
  • ece_windows_detect_new_local_admin_account.json
  • ece_windows_detect_psexec_with_accepteula_flag.json
  • ece_windows_detect_use_of_cmdexe_to_launch_script_interpreters.json
  • ece_windows_new_external_device.json
  • ece_windows_processes_created_by_netsh.json
  • ece_windows_processes_launching_netsh.json
  • ece_windows_windows_event_log_cleared.json
  • splunk_child_processes_of_spoolsvexe.json
  • splunk_detect_large_outbound_icmp_packets.json
  • splunk_detect_long_dns_txt_record_response.json
  • splunk_detect_new_local_admin_account.json
  • splunk_detect_psexec_with_accepteula_flag.json
  • splunk_detect_use_of_cmdexe_to_launch_script_interpreters.json
  • splunk_processes_created_by_netsh.json
  • splunk_processes_launching_netsh.json
  • splunk_protocols_passing_authentication_in_cleartext.json
  • splunk_windows_event_log_cleared.json