remove 152 public detections

splunk · Feb 26, 2025 · 2fe8bc5 · 2fe8bc5
1 parent a810c4e
commit 2fe8bc5
Show file tree

Hide file tree

Showing 151 changed files with 0 additions and 0 deletions.
diff --git a/...y_high_aws_instances_launched_by_user.yml → ...y_high_aws_instances_launched_by_user.yml b/...y_high_aws_instances_launched_by_user.yml → ...y_high_aws_instances_launched_by_user.yml
diff --git a/...aws_instances_launched_by_user___mltk.yml → ...aws_instances_launched_by_user___mltk.yml b/...aws_instances_launched_by_user___mltk.yml → ...aws_instances_launched_by_user___mltk.yml
diff --git a/...high_aws_instances_terminated_by_user.yml → ...high_aws_instances_terminated_by_user.yml b/...high_aws_instances_terminated_by_user.yml → ...high_aws_instances_terminated_by_user.yml
diff --git a/...s_instances_terminated_by_user___mltk.yml → ...s_instances_terminated_by_user___mltk.yml b/...s_instances_terminated_by_user___mltk.yml → ...s_instances_terminated_by_user___mltk.yml
diff --git a/...ecated/account_discovery_with_net_app.yml → ...ctions/account_discovery_with_net_app.yml b/...ecated/account_discovery_with_net_app.yml → ...ctions/account_discovery_with_net_app.yml
diff --git a/...ns/deprecated/asl_aws_createaccesskey.yml → ...ed/detections/asl_aws_createaccesskey.yml b/...ns/deprecated/asl_aws_createaccesskey.yml → ...ed/detections/asl_aws_createaccesskey.yml
diff --git a/...d/asl_aws_excessive_security_scanning.yml → ...s/asl_aws_excessive_security_scanning.yml b/...d/asl_aws_excessive_security_scanning.yml → ...s/asl_aws_excessive_security_scanning.yml
diff --git a/...cated/asl_aws_password_policy_changes.yml → ...tions/asl_aws_password_policy_changes.yml b/...cated/asl_aws_password_policy_changes.yml → ...tions/asl_aws_password_policy_changes.yml
diff --git a/...ated/attempt_to_stop_security_service.yml → ...ions/attempt_to_stop_security_service.yml b/...ated/attempt_to_stop_security_service.yml → ...ions/attempt_to_stop_security_service.yml
diff --git a/...ential_dump_from_registry_via_reg_exe.yml → ...ential_dump_from_registry_via_reg_exe.yml b/...ential_dump_from_registry_via_reg_exe.yml → ...ential_dump_from_registry_via_reg_exe.yml
diff --git a/...visioning_from_previously_unseen_city.yml → ...visioning_from_previously_unseen_city.yml b/...visioning_from_previously_unseen_city.yml → ...visioning_from_previously_unseen_city.yml
diff --git a/...ioning_from_previously_unseen_country.yml → ...ioning_from_previously_unseen_country.yml b/...ioning_from_previously_unseen_country.yml → ...ioning_from_previously_unseen_country.yml
diff --git a/...ing_from_previously_unseen_ip_address.yml → ...ing_from_previously_unseen_ip_address.yml b/...ing_from_previously_unseen_ip_address.yml → ...ing_from_previously_unseen_ip_address.yml
diff --git a/...sioning_from_previously_unseen_region.yml → ...sioning_from_previously_unseen_region.yml b/...sioning_from_previously_unseen_region.yml → ...sioning_from_previously_unseen_region.yml
diff --git a/...netes_cluster_sensitive_object_access.yml → ...netes_cluster_sensitive_object_access.yml b/...netes_cluster_sensitive_object_access.yml → ...netes_cluster_sensitive_object_access.yml
diff --git a/...cated/change_default_file_association.yml → ...tions/change_default_file_association.yml b/...cated/change_default_file_association.yml → ...tions/change_default_file_association.yml
diff --git a/...ts_connecting_to_multiple_dns_servers.yml → ...ts_connecting_to_multiple_dns_servers.yml b/...ts_connecting_to_multiple_dns_servers.yml → ...ts_connecting_to_multiple_dns_servers.yml
diff --git a/...d_network_access_control_list_deleted.yml → ...d_network_access_control_list_deleted.yml b/...d_network_access_control_list_deleted.yml → ...d_network_access_control_list_deleted.yml
diff --git a/...mdline_tool_not_executed_in_cmd_shell.yml → ...mdline_tool_not_executed_in_cmd_shell.yml b/...mdline_tool_not_executed_in_cmd_shell.yml → ...mdline_tool_not_executed_in_cmd_shell.yml
diff --git a/...ed/correlation_by_repository_and_risk.yml → ...ns/correlation_by_repository_and_risk.yml b/...ed/correlation_by_repository_and_risk.yml → ...ns/correlation_by_repository_and_risk.yml
diff --git a/...precated/correlation_by_user_and_risk.yml → ...tections/correlation_by_user_and_risk.yml b/...precated/correlation_by_user_and_risk.yml → ...tections/correlation_by_user_and_risk.yml
diff --git a/...te_local_admin_accounts_using_net_exe.yml → ...te_local_admin_accounts_using_net_exe.yml b/...te_local_admin_accounts_using_net_exe.yml → ...te_local_admin_accounts_using_net_exe.yml
diff --git a/...ions/deprecated/deleting_of_net_users.yml → ...ated/detections/deleting_of_net_users.yml b/...ions/deprecated/deleting_of_net_users.yml → ...ated/detections/deleting_of_net_users.yml
diff --git a/...vity_related_to_pass_the_hash_attacks.yml → ...vity_related_to_pass_the_hash_attacks.yml b/...vity_related_to_pass_the_hash_attacks.yml → ...vity_related_to_pass_the_hash_attacks.yml
diff --git a/...t_api_activity_from_users_without_mfa.yml → ...t_api_activity_from_users_without_mfa.yml b/...t_api_activity_from_users_without_mfa.yml → ...t_api_activity_from_users_without_mfa.yml
diff --git a/...i_activities_from_unapproved_accounts.yml → ...i_activities_from_unapproved_accounts.yml b/...i_activities_from_unapproved_accounts.yml → ...i_activities_from_unapproved_accounts.yml
diff --git a/...t_critical_alerts_from_security_tools.yml → ...t_critical_alerts_from_security_tools.yml b/...t_critical_alerts_from_security_tools.yml → ...t_critical_alerts_from_security_tools.yml
diff --git a/...o_phishing_sites_leveraging_evilginx2.yml → ...o_phishing_sites_leveraging_evilginx2.yml b/...o_phishing_sites_leveraging_evilginx2.yml → ...o_phishing_sites_leveraging_evilginx2.yml
diff --git a/...d/detect_long_dns_txt_record_response.yml → ...s/detect_long_dns_txt_record_response.yml b/...d/detect_long_dns_txt_record_response.yml → ...s/detect_long_dns_txt_record_response.yml
diff --git a/...d/detect_mimikatz_using_loaded_images.yml → ...s/detect_mimikatz_using_loaded_images.yml b/...d/detect_mimikatz_using_loaded_images.yml → ...s/detect_mimikatz_using_loaded_images.yml
diff --git a/...atz_via_powershell_and_eventcode_4703.yml → ...atz_via_powershell_and_eventcode_4703.yml b/...atz_via_powershell_and_eventcode_4703.yml → ...atz_via_powershell_and_eventcode_4703.yml
diff --git a/.../detect_new_api_calls_from_user_roles.yml → .../detect_new_api_calls_from_user_roles.yml b/.../detect_new_api_calls_from_user_roles.yml → .../detect_new_api_calls_from_user_roles.yml
diff --git a/...ted/detect_new_user_aws_console_login.yml → ...ons/detect_new_user_aws_console_login.yml b/...ted/detect_new_user_aws_console_login.yml → ...ons/detect_new_user_aws_console_login.yml
diff --git a/...ystem_network_configuration_discovery.yml → ...ystem_network_configuration_discovery.yml b/...ystem_network_configuration_discovery.yml → ...ystem_network_configuration_discovery.yml
diff --git a/...ated/detect_spike_in_aws_api_activity.yml → ...ions/detect_spike_in_aws_api_activity.yml b/...ated/detect_spike_in_aws_api_activity.yml → ...ions/detect_spike_in_aws_api_activity.yml
diff --git a/.../detect_spike_in_network_acl_activity.yml → .../detect_spike_in_network_acl_activity.yml b/.../detect_spike_in_network_acl_activity.yml → .../detect_spike_in_network_acl_activity.yml
diff --git a/...tect_spike_in_security_group_activity.yml → ...tect_spike_in_security_group_activity.yml b/...tect_spike_in_security_group_activity.yml → ...tect_spike_in_security_group_activity.yml
diff --git a/...eprecated/detect_usb_device_insertion.yml → ...etections/detect_usb_device_insertion.yml b/...eprecated/detect_usb_device_insertion.yml → ...etections/detect_usb_device_insertion.yml
diff --git a/...b_traffic_to_dynamic_domain_providers.yml → ...b_traffic_to_dynamic_domain_providers.yml b/...b_traffic_to_dynamic_domain_providers.yml → ...b_traffic_to_dynamic_domain_providers.yml
diff --git a/...ated/detect_webshell_exploit_behavior.yml → ...ions/detect_webshell_exploit_behavior.yml b/...ated/detect_webshell_exploit_behavior.yml → ...ions/detect_webshell_exploit_behavior.yml
diff --git a/...s/deprecated/detection_of_dns_tunnels.yml → ...d/detections/detection_of_dns_tunnels.yml b/...s/deprecated/detection_of_dns_tunnels.yml → ...d/detections/detection_of_dns_tunnels.yml
diff --git a/...deprecated/disabling_net_user_account.yml → ...detections/disabling_net_user_account.yml b/...deprecated/disabling_net_user_account.yml → ...detections/disabling_net_user_account.yml
diff --git a/..._resolved_by_unauthorized_dns_servers.yml → ..._resolved_by_unauthorized_dns_servers.yml b/..._resolved_by_unauthorized_dns_servers.yml → ..._resolved_by_unauthorized_dns_servers.yml
diff --git a/detections/deprecated/dns_record_changed.yml → deprecated/detections/dns_record_changed.yml b/detections/deprecated/dns_record_changed.yml → deprecated/detections/dns_record_changed.yml
diff --git a/...domain_account_discovery_with_net_app.yml → ...domain_account_discovery_with_net_app.yml b/...domain_account_discovery_with_net_app.yml → ...domain_account_discovery_with_net_app.yml
diff --git a/...cated/domain_group_discovery_with_net.yml → ...tions/domain_group_discovery_with_net.yml b/...cated/domain_group_discovery_with_net.yml → ...tions/domain_group_discovery_with_net.yml
diff --git a/...ecated/dump_lsass_via_procdump_rename.yml → ...ctions/dump_lsass_via_procdump_rename.yml b/...ecated/dump_lsass_via_procdump_rename.yml → ...ctions/dump_lsass_via_procdump_rename.yml
diff --git a/..._modified_with_previously_unseen_user.yml → ..._modified_with_previously_unseen_user.yml b/..._modified_with_previously_unseen_user.yml → ..._modified_with_previously_unseen_user.yml
diff --git a/...e_started_in_previously_unseen_region.yml → ...e_started_in_previously_unseen_region.yml b/...e_started_in_previously_unseen_region.yml → ...e_started_in_previously_unseen_region.yml
diff --git a/...ce_started_with_previously_unseen_ami.yml → ...ce_started_with_previously_unseen_ami.yml b/...ce_started_with_previously_unseen_ami.yml → ...ce_started_with_previously_unseen_ami.yml
diff --git a/..._with_previously_unseen_instance_type.yml → ..._with_previously_unseen_instance_type.yml b/..._with_previously_unseen_instance_type.yml → ..._with_previously_unseen_instance_type.yml
diff --git a/...e_started_with_previously_unseen_user.yml → ...e_started_with_previously_unseen_user.yml b/...e_started_with_previously_unseen_user.yml → ...e_started_with_previously_unseen_user.yml
diff --git a/...ted/elevated_group_discovery_with_net.yml → ...ons/elevated_group_discovery_with_net.yml b/...ted/elevated_group_discovery_with_net.yml → ...ons/elevated_group_discovery_with_net.yml
diff --git a/.../deprecated/excel_spawning_powershell.yml → .../detections/excel_spawning_powershell.yml b/.../deprecated/excel_spawning_powershell.yml → .../detections/excel_spawning_powershell.yml
diff --git a/...ed/excel_spawning_windows_script_host.yml → ...ns/excel_spawning_windows_script_host.yml b/...ed/excel_spawning_windows_script_host.yml → ...ns/excel_spawning_windows_script_host.yml
diff --git a/...ecated/excessive_service_stop_attempt.yml → ...ctions/excessive_service_stop_attempt.yml b/...ecated/excessive_service_stop_attempt.yml → ...ctions/excessive_service_stop_attempt.yml
diff --git a/...deprecated/excessive_usage_of_net_app.yml → ...detections/excessive_usage_of_net_app.yml b/...deprecated/excessive_usage_of_net_app.yml → ...detections/excessive_usage_of_net_app.yml
diff --git a/..._of_file_with_spaces_before_extension.yml → ..._of_file_with_spaces_before_extension.yml b/..._of_file_with_spaces_before_extension.yml → ..._of_file_with_spaces_before_extension.yml
diff --git a/..._without_successful_netbackup_backups.yml → ..._without_successful_netbackup_backups.yml b/..._without_successful_netbackup_backups.yml → ..._without_successful_netbackup_backups.yml
diff --git a/...precated/extraction_of_registry_hives.yml → ...tections/extraction_of_registry_hives.yml b/...precated/extraction_of_registry_hives.yml → ...tections/extraction_of_registry_hives.yml
diff --git a/...first_time_seen_command_line_argument.yml → ...first_time_seen_command_line_argument.yml b/...first_time_seen_command_line_argument.yml → ...first_time_seen_command_line_argument.yml
diff --git a/...ounts_with_high_risk_roles_by_project.yml → ...ounts_with_high_risk_roles_by_project.yml b/...ounts_with_high_risk_roles_by_project.yml → ...ounts_with_high_risk_roles_by_project.yml
diff --git a/...k_permissions_by_resource_and_account.yml → ...k_permissions_by_resource_and_account.yml b/...k_permissions_by_resource_and_account.yml → ...k_permissions_by_resource_and_account.yml
diff --git a/...precated/gcp_detect_oauth_token_abuse.yml → ...tections/gcp_detect_oauth_token_abuse.yml b/...precated/gcp_detect_oauth_token_abuse.yml → ...tections/gcp_detect_oauth_token_abuse.yml
diff --git a/...gcp_kubernetes_cluster_scan_detection.yml → ...gcp_kubernetes_cluster_scan_detection.yml b/...gcp_kubernetes_cluster_scan_detection.yml → ...gcp_kubernetes_cluster_scan_detection.yml
diff --git a/...deprecated/identify_new_user_accounts.yml → ...detections/identify_new_user_accounts.yml b/...deprecated/identify_new_user_accounts.yml → ...detections/identify_new_user_accounts.yml
diff --git a/...t_most_active_service_accounts_by_pod.yml → ...t_most_active_service_accounts_by_pod.yml b/...t_most_active_service_accounts_by_pod.yml → ...t_most_active_service_accounts_by_pod.yml
diff --git a/..._detect_rbac_authorization_by_account.yml → ..._detect_rbac_authorization_by_account.yml b/..._detect_rbac_authorization_by_account.yml → ..._detect_rbac_authorization_by_account.yml
diff --git a/...etes_aws_detect_sensitive_role_access.yml → ...etes_aws_detect_sensitive_role_access.yml b/...etes_aws_detect_sensitive_role_access.yml → ...etes_aws_detect_sensitive_role_access.yml
diff --git a/...ice_accounts_forbidden_failure_access.yml → ...ice_accounts_forbidden_failure_access.yml b/...ice_accounts_forbidden_failure_access.yml → ...ice_accounts_forbidden_failure_access.yml
diff --git a/...ive_service_accounts_by_pod_namespace.yml → ...ive_service_accounts_by_pod_namespace.yml b/...ive_service_accounts_by_pod_namespace.yml → ...ive_service_accounts_by_pod_namespace.yml
diff --git a/..._detect_rbac_authorization_by_account.yml → ..._detect_rbac_authorization_by_account.yml b/..._detect_rbac_authorization_by_account.yml → ..._detect_rbac_authorization_by_account.yml
diff --git a/..._azure_detect_sensitive_object_access.yml → ..._azure_detect_sensitive_object_access.yml b/..._azure_detect_sensitive_object_access.yml → ..._azure_detect_sensitive_object_access.yml
diff --git a/...es_azure_detect_sensitive_role_access.yml → ...es_azure_detect_sensitive_role_access.yml b/...es_azure_detect_sensitive_role_access.yml → ...es_azure_detect_sensitive_role_access.yml
diff --git a/...ice_accounts_forbidden_failure_access.yml → ...ice_accounts_forbidden_failure_access.yml b/...ice_accounts_forbidden_failure_access.yml → ...ice_accounts_forbidden_failure_access.yml
diff --git a/...azure_detect_suspicious_kubectl_calls.yml → ...azure_detect_suspicious_kubectl_calls.yml b/...azure_detect_suspicious_kubectl_calls.yml → ...azure_detect_suspicious_kubectl_calls.yml
diff --git a/...kubernetes_azure_pod_scan_fingerprint.yml → ...kubernetes_azure_pod_scan_fingerprint.yml b/...kubernetes_azure_pod_scan_fingerprint.yml → ...kubernetes_azure_pod_scan_fingerprint.yml
diff --git a/...ted/kubernetes_azure_scan_fingerprint.yml → ...ons/kubernetes_azure_scan_fingerprint.yml b/...ted/kubernetes_azure_scan_fingerprint.yml → ...ons/kubernetes_azure_scan_fingerprint.yml
diff --git a/...t_most_active_service_accounts_by_pod.yml → ...t_most_active_service_accounts_by_pod.yml b/...t_most_active_service_accounts_by_pod.yml → ...t_most_active_service_accounts_by_pod.yml
diff --git a/...detect_rbac_authorizations_by_account.yml → ...detect_rbac_authorizations_by_account.yml b/...detect_rbac_authorizations_by_account.yml → ...detect_rbac_authorizations_by_account.yml
diff --git a/...es_gcp_detect_sensitive_object_access.yml → ...es_gcp_detect_sensitive_object_access.yml b/...es_gcp_detect_sensitive_object_access.yml → ...es_gcp_detect_sensitive_object_access.yml
diff --git a/...etes_gcp_detect_sensitive_role_access.yml → ...etes_gcp_detect_sensitive_role_access.yml b/...etes_gcp_detect_sensitive_role_access.yml → ...etes_gcp_detect_sensitive_role_access.yml
diff --git a/...ice_accounts_forbidden_failure_access.yml → ...ice_accounts_forbidden_failure_access.yml b/...ice_accounts_forbidden_failure_access.yml → ...ice_accounts_forbidden_failure_access.yml
diff --git a/...s_gcp_detect_suspicious_kubectl_calls.yml → ...s_gcp_detect_suspicious_kubectl_calls.yml b/...s_gcp_detect_suspicious_kubectl_calls.yml → ...s_gcp_detect_suspicious_kubectl_calls.yml
diff --git a/...ecated/linux_auditd_find_private_keys.yml → ...ctions/linux_auditd_find_private_keys.yml b/...ecated/linux_auditd_find_private_keys.yml → ...ctions/linux_auditd_find_private_keys.yml
diff --git a/...ated/local_account_discovery_with_net.yml → ...ions/local_account_discovery_with_net.yml b/...ated/local_account_discovery_with_net.yml → ...ions/local_account_discovery_with_net.yml
diff --git a/...eprecated/monitor_dns_for_brand_abuse.yml → ...etections/monitor_dns_for_brand_abuse.yml b/...eprecated/monitor_dns_for_brand_abuse.yml → ...etections/monitor_dns_for_brand_abuse.yml
diff --git a/.../mshtml_module_load_in_office_product.yml → .../mshtml_module_load_in_office_product.yml b/.../mshtml_module_load_in_office_product.yml → .../mshtml_module_load_in_office_product.yml
diff --git a/..._invalid_credentials_from_the_same_ip.yml → ..._invalid_credentials_from_the_same_ip.yml b/..._invalid_credentials_from_the_same_ip.yml → ..._invalid_credentials_from_the_same_ip.yml
diff --git a/...s/deprecated/net_localgroup_discovery.yml → ...d/detections/net_localgroup_discovery.yml b/...s/deprecated/net_localgroup_discovery.yml → ...d/detections/net_localgroup_discovery.yml
diff --git a/...network_connection_discovery_with_net.yml → ...network_connection_discovery_with_net.yml b/...network_connection_discovery_with_net.yml → ...network_connection_discovery_with_net.yml
diff --git a/...365_suspicious_admin_email_forwarding.yml → ...365_suspicious_admin_email_forwarding.yml b/...365_suspicious_admin_email_forwarding.yml → ...365_suspicious_admin_email_forwarding.yml
diff --git a/...ted/o365_suspicious_rights_delegation.yml → ...ons/o365_suspicious_rights_delegation.yml b/...ted/o365_suspicious_rights_delegation.yml → ...ons/o365_suspicious_rights_delegation.yml
diff --git a/...o365_suspicious_user_email_forwarding.yml → ...o365_suspicious_user_email_forwarding.yml b/...o365_suspicious_user_email_forwarding.yml → ...o365_suspicious_user_email_forwarding.yml
diff --git a/...ed/office_application_drop_executable.yml → ...ns/office_application_drop_executable.yml b/...ed/office_application_drop_executable.yml → ...ns/office_application_drop_executable.yml
diff --git a/...ce_application_spawn_regsvr32_process.yml → ...ce_application_spawn_regsvr32_process.yml b/...ce_application_spawn_regsvr32_process.yml → ...ce_application_spawn_regsvr32_process.yml
diff --git a/...ce_application_spawn_rundll32_process.yml → ...ce_application_spawn_rundll32_process.yml b/...ce_application_spawn_rundll32_process.yml → ...ce_application_spawn_rundll32_process.yml
diff --git a/...ffice_document_creating_schedule_task.yml → ...ffice_document_creating_schedule_task.yml b/...ffice_document_creating_schedule_task.yml → ...ffice_document_creating_schedule_task.yml
diff --git a/.../office_document_executing_macro_code.yml → .../office_document_executing_macro_code.yml b/.../office_document_executing_macro_code.yml → .../office_document_executing_macro_code.yml
diff --git a/...ent_spawned_child_process_to_download.yml → ...ent_spawned_child_process_to_download.yml b/...ent_spawned_child_process_to_download.yml → ...ent_spawned_child_process_to_download.yml
diff --git a/...ated/office_product_spawn_cmd_process.yml → ...ions/office_product_spawn_cmd_process.yml b/...ated/office_product_spawn_cmd_process.yml → ...ions/office_product_spawn_cmd_process.yml
diff --git a/...ted/office_product_spawning_bitsadmin.yml → ...ons/office_product_spawning_bitsadmin.yml b/...ted/office_product_spawning_bitsadmin.yml → ...ons/office_product_spawning_bitsadmin.yml
diff --git a/...ated/office_product_spawning_certutil.yml → ...ions/office_product_spawning_certutil.yml b/...ated/office_product_spawning_certutil.yml → ...ions/office_product_spawning_certutil.yml
diff --git a/...recated/office_product_spawning_mshta.yml → ...ections/office_product_spawning_mshta.yml b/...recated/office_product_spawning_mshta.yml → ...ections/office_product_spawning_mshta.yml
diff --git a/...product_spawning_rundll32_with_no_dll.yml → ...product_spawning_rundll32_with_no_dll.yml b/...product_spawning_rundll32_with_no_dll.yml → ...product_spawning_rundll32_with_no_dll.yml
diff --git a/..._product_spawning_windows_script_host.yml → ..._product_spawning_windows_script_host.yml b/..._product_spawning_windows_script_host.yml → ..._product_spawning_windows_script_host.yml
diff --git a/...precated/office_product_spawning_wmic.yml → ...tections/office_product_spawning_wmic.yml b/...precated/office_product_spawning_wmic.yml → ...tections/office_product_spawning_wmic.yml
diff --git a/...ted/office_product_writing_cab_or_inf.yml → ...ons/office_product_writing_cab_or_inf.yml b/...ted/office_product_writing_cab_or_inf.yml → ...ons/office_product_writing_cab_or_inf.yml
diff --git a/...ns/deprecated/office_spawning_control.yml → ...ed/detections/office_spawning_control.yml b/...ns/deprecated/office_spawning_control.yml → ...ed/detections/office_spawning_control.yml
diff --git a/...ns/deprecated/okta_account_locked_out.yml → ...ed/detections/okta_account_locked_out.yml b/...ns/deprecated/okta_account_locked_out.yml → ...ed/detections/okta_account_locked_out.yml
diff --git a/...eprecated/okta_account_lockout_events.yml → ...etections/okta_account_lockout_events.yml b/...eprecated/okta_account_lockout_events.yml → ...etections/okta_account_lockout_events.yml
diff --git a/...s/deprecated/okta_failed_sso_attempts.yml → ...d/detections/okta_failed_sso_attempts.yml b/...s/deprecated/okta_failed_sso_attempts.yml → ...d/detections/okta_failed_sso_attempts.yml
diff --git a/...login_failure_with_high_unknown_users.yml → ...login_failure_with_high_unknown_users.yml b/...login_failure_with_high_unknown_users.yml → ...login_failure_with_high_unknown_users.yml
diff --git a/...nsight_suspected_passwordspray_attack.yml → ...nsight_suspected_passwordspray_attack.yml b/...nsight_suspected_passwordspray_attack.yml → ...nsight_suspected_passwordspray_attack.yml
diff --git a/...okta_two_or_more_rejected_okta_pushes.yml → ...okta_two_or_more_rejected_okta_pushes.yml b/...okta_two_or_more_rejected_okta_pushes.yml → ...okta_two_or_more_rejected_okta_pushes.yml
diff --git a/...ted/osquery_pack___coldroot_detection.yml → ...ons/osquery_pack___coldroot_detection.yml b/...ted/osquery_pack___coldroot_detection.yml → ...ons/osquery_pack___coldroot_detection.yml
diff --git a/...ed/password_policy_discovery_with_net.yml → ...ns/password_policy_discovery_with_net.yml b/...ed/password_policy_discovery_with_net.yml → ...ns/password_policy_discovery_with_net.yml
diff --git a/...deprecated/processes_created_by_netsh.yml → ...detections/processes_created_by_netsh.yml b/...deprecated/processes_created_by_netsh.yml → ...detections/processes_created_by_netsh.yml
diff --git a/...cated/prohibited_software_on_endpoint.yml → ...tions/prohibited_software_on_endpoint.yml b/...cated/prohibited_software_on_endpoint.yml → ...tions/prohibited_software_on_endpoint.yml
diff --git a/...e_files_directories_via_registry_keys.yml → ...e_files_directories_via_registry_keys.yml b/...e_files_directories_via_registry_keys.yml → ...e_files_directories_via_registry_keys.yml
diff --git a/...ted/remote_registry_key_modifications.yml → ...ons/remote_registry_key_modifications.yml b/...ted/remote_registry_key_modifications.yml → ...ons/remote_registry_key_modifications.yml
diff --git a/...ated/remote_system_discovery_with_net.yml → ...ions/remote_system_discovery_with_net.yml b/...ated/remote_system_discovery_with_net.yml → ...ions/remote_system_discovery_with_net.yml
diff --git a/...ed_tasks_used_in_badrabbit_ransomware.yml → ...ed_tasks_used_in_badrabbit_ransomware.yml b/...ed_tasks_used_in_badrabbit_ransomware.yml → ...ed_tasks_used_in_badrabbit_ransomware.yml
diff --git a/...ectre_and_meltdown_vulnerable_systems.yml → ...ectre_and_meltdown_vulnerable_systems.yml b/...ectre_and_meltdown_vulnerable_systems.yml → ...ectre_and_meltdown_vulnerable_systems.yml
diff --git a/...spicious_changes_to_file_associations.yml → ...spicious_changes_to_file_associations.yml b/...spicious_changes_to_file_associations.yml → ...spicious_changes_to_file_associations.yml
diff --git a/...ecated/suspicious_email___uba_anomaly.yml → ...ctions/suspicious_email___uba_anomaly.yml b/...ecated/suspicious_email___uba_anomaly.yml → ...ctions/suspicious_email___uba_anomaly.yml
diff --git a/...ions/deprecated/suspicious_file_write.yml → ...ated/detections/suspicious_file_write.yml b/...ions/deprecated/suspicious_file_write.yml → ...ated/detections/suspicious_file_write.yml
diff --git a/...ous_powershell_command_line_arguments.yml → ...ous_powershell_command_line_arguments.yml b/...ous_powershell_command_line_arguments.yml → ...ous_powershell_command_line_arguments.yml
diff --git a/...deprecated/suspicious_rundll32_rename.yml → ...detections/suspicious_rundll32_rename.yml b/...deprecated/suspicious_rundll32_rename.yml → ...detections/suspicious_rundll32_rename.yml
diff --git a/...s_writes_to_system_volume_information.yml → ...s_writes_to_system_volume_information.yml b/...s_writes_to_system_volume_information.yml → ...s_writes_to_system_volume_information.yml
diff --git a/...ecated/uncommon_processes_on_endpoint.yml → ...ctions/uncommon_processes_on_endpoint.yml b/...ecated/uncommon_processes_on_endpoint.yml → ...ctions/uncommon_processes_on_endpoint.yml
diff --git a/...ecated/unsigned_image_loaded_by_lsass.yml → ...ctions/unsigned_image_loaded_by_lsass.yml b/...ecated/unsigned_image_loaded_by_lsass.yml → ...ctions/unsigned_image_loaded_by_lsass.yml
diff --git a/...ecated/unsuccessful_netbackup_backups.yml → ...ctions/unsuccessful_netbackup_backups.yml b/...ecated/unsuccessful_netbackup_backups.yml → ...ctions/unsuccessful_netbackup_backups.yml
diff --git a/...ecated/web_fraud___account_harvesting.yml → ...ctions/web_fraud___account_harvesting.yml b/...ecated/web_fraud___account_harvesting.yml → ...ctions/web_fraud___account_harvesting.yml
diff --git a/...web_fraud___anomalous_user_clickspeed.yml → ...web_fraud___anomalous_user_clickspeed.yml b/...web_fraud___anomalous_user_clickspeed.yml → ...web_fraud___anomalous_user_clickspeed.yml
diff --git a/...ud___password_sharing_across_accounts.yml → ...ud___password_sharing_across_accounts.yml b/...ud___password_sharing_across_accounts.yml → ...ud___password_sharing_across_accounts.yml
diff --git a/...ows_command_shell_fetch_env_variables.yml → ...ows_command_shell_fetch_env_variables.yml b/...ows_command_shell_fetch_env_variables.yml → ...ows_command_shell_fetch_env_variables.yml
diff --git a/...ndows_connhost_exe_started_forcefully.yml → ...ndows_connhost_exe_started_forcefully.yml b/...ndows_connhost_exe_started_forcefully.yml → ...ndows_connhost_exe_started_forcefully.yml
diff --git a/...ndows_dll_search_order_hijacking_hunt.yml → ...ndows_dll_search_order_hijacking_hunt.yml b/...ndows_dll_search_order_hijacking_hunt.yml → ...ndows_dll_search_order_hijacking_hunt.yml
diff --git a/...cated/windows_hosts_file_modification.yml → ...tions/windows_hosts_file_modification.yml b/...cated/windows_hosts_file_modification.yml → ...tions/windows_hosts_file_modification.yml
diff --git a/.../windows_lateral_tool_transfer_remcom.yml → .../windows_lateral_tool_transfer_remcom.yml b/.../windows_lateral_tool_transfer_remcom.yml → .../windows_lateral_tool_transfer_remcom.yml
diff --git a/...d/windows_modify_registry_reg_restore.yml → ...s/windows_modify_registry_reg_restore.yml b/...d/windows_modify_registry_reg_restore.yml → ...s/windows_modify_registry_reg_restore.yml
diff --git a/...dows_msiexec_with_network_connections.yml → ...dows_msiexec_with_network_connections.yml b/...dows_msiexec_with_network_connections.yml → ...dows_msiexec_with_network_connections.yml
diff --git a/...ws_network_share_interaction_with_net.yml → ...ws_network_share_interaction_with_net.yml b/...ws_network_share_interaction_with_net.yml → ...ws_network_share_interaction_with_net.yml
diff --git a/.../windows_office_product_spawning_msdt.yml → .../windows_office_product_spawning_msdt.yml b/.../windows_office_product_spawning_msdt.yml → .../windows_office_product_spawning_msdt.yml
diff --git a/...cated/windows_query_registry_reg_save.yml → ...tions/windows_query_registry_reg_save.yml b/...cated/windows_query_registry_reg_save.yml → ...tions/windows_query_registry_reg_save.yml
diff --git a/...vice_stop_via_net__and_sc_application.yml → ...vice_stop_via_net__and_sc_application.yml b/...vice_stop_via_net__and_sc_application.yml → ...vice_stop_via_net__and_sc_application.yml
diff --git a/...d_account_with_never_expires_password.yml → ...d_account_with_never_expires_password.yml b/...d_account_with_never_expires_password.yml → ...d_account_with_never_expires_password.yml
diff --git a/...tions/deprecated/winword_spawning_cmd.yml → ...cated/detections/winword_spawning_cmd.yml b/...tions/deprecated/winword_spawning_cmd.yml → ...cated/detections/winword_spawning_cmd.yml
diff --git a/...eprecated/winword_spawning_powershell.yml → ...etections/winword_spawning_powershell.yml b/...eprecated/winword_spawning_powershell.yml → ...etections/winword_spawning_powershell.yml
diff --git a/.../winword_spawning_windows_script_host.yml → .../winword_spawning_windows_script_host.yml b/.../winword_spawning_windows_script_host.yml → .../winword_spawning_windows_script_host.yml