eqllib-master
- .github
  - PULL_REQUEST_TEMPLATE.md
  - ISSUE_TEMPLATE
    - analytic.md
    - schema.md
    - bug_report.md
  - workflows
    - pythonpackage.yml
- utils
  - scrape-events.ps1
- Makefile
- requirements_rtd.txt
- LICENSE
- CONTRIBUTING.md
- setup.py
- data
  - normalized-atomic-red-team.json.gz
  - normalized-T1117-AtomicRed-regsvr32.json
- setup.cfg
- README.md
- tests
  - test_analytics.py
  - __init__.py
  - test_normalization.py
- .gitignore
- docs
  - licenses.rst
  - analytics.rst
  - Makefile
  - atomicblue.rst
  - make.bat
  - docutils.conf
  - matrices.rst
  - schemas.rst
  - index.rst
  - conf.py
  - schemas
    - car.rst
    - sysmon.rst
  - _templates
    - analytic.rst
    - data-source.rst
    - links.rst
    - analytic-groups.rst
    - matrix.rst
  - _static
    - atomicblue.css
    - searchtools.js
  - guides
    - cli.rst
    - sysmon.rst
    - index.rst
  - resources.rst
- eqllib
  - analytics
    - lateral-movement
      - T1028-incoming-remote-powershell.toml
      - T1076-remote-desktop-protocol-hijack.toml
      - T1077-net-use-hidden.toml
      - T1077-windows-hidden-shares-net.toml
      - T1021-remote-terminal-session.toml
      - T1037-logon-scripts-registry.toml
    - defense-evasion
      - T1151-processes-trailing-space.toml
      - T1126-disconnecting-from-network-shares-net.toml
      - T1144-potential-gatekeeper-bypass.toml
      - T1197-bitsadmin-ps-download.toml
      - T1197-bitsadmin-download.toml
      - T1117-scrobj-load.toml
      - T1070-wevtutil-clear.toml
      - T1196-control-panel-items.toml
      - T1070-indicator-removal-on-host.toml
      - T1191-msft-connection-mgr-uac-bypass.toml
      - T1130-root-cert-install.toml
      - T1216-proxied-exec-signed-scripts.toml
      - T1140-certutil-decode.toml
      - T1089-unload-sysmon-driver.toml
      - T1093-parent-child-mismatch.toml
      - T1223-compiled-html-file.toml
      - T1158-hidden-files-attrib.toml
      - T1222-windows-file-permissions-modification.toml
      - T1191-execution-cmstp.toml
      - T1070-fsutil-deletejournal.toml
      - T1202-indirect-cmd-exec.toml
      - T1055-code-injection-ld.so.preload.toml
      - T1036-process-unusual-extensions.toml
      - T1096-ads-file-create.toml
    - impact
      - T1489-stopping-services-net.toml
      - T1490-wmic-shadow-delete.toml
      - T1490-bcdedit-modification.toml
      - T1490-vssadmin-delete.toml
      - T1489-stop-services-sc.toml
    - discovery
      - T1018-net-view.toml
      - T1482-domain-trust-discovery-nltest.toml
      - T1016-windows-discovery-of-network-environment-built-in-tools.toml
      - T1087-account-discovery-built-in-tools.toml
      - T1124-net-time-remote.toml
      - T1016-discovery-of-network-environment-built-in-tools.toml
      - T1482-domain-trust-discovery.toml
      - T1033-system-owner-and-user-discovery.toml
      - T1082-linux-system-information-discovery.toml
      - T1082-systeminfo.toml
      - T1082-system-information-discovery.toml
      - T1057-process-discovery-built-in-applications.toml
      - T1049-system-network-connections-discovery-nix.toml
      - T1057-process-discovery.toml
      - T1069-discovery-of-domain-groups.toml
      - T1135-net-share.toml
      - T1135-net-view-remote.toml
      - T1201-password-policy-enumeration-linux.toml
      - T1087-discovery-commands-rundll32-remote-access-tool.toml
      - T1046-network-service-scanning-port.toml
      - T1018-remote-system-discovery-commands-windows.toml
      - T1049-net-use.toml
    - exfiltration
      - T1002-rar-compression.toml
    - privilege-escalation
      - T1088-bypassuac-compmgmtlauncher.toml
      - T1088-bypassuac-wsreset-exec.toml
      - T1182-appcert-dlls-registry-modification.toml
      - T1088-bypassuac-fodhelper-exec.toml
      - T1150-plist-modification.toml
      - T1053-schtask-create.toml
      - T1038-dll-hijacking-known.toml
      - T1088-bypassuac-eventvwr-registry.toml
      - T1013-port-monitor.toml
      - T1053-interactive-at-job.toml
      - T1050-escalation-service-cmd.toml
      - T1160-launch-daemon-persistence.toml
      - T1088-bypassuac-eventvwr-exec.toml
    - collection
      - T1005-txt-files-with-command-line-redirection.toml
      - T1074-common-archiver-commands.toml
      - T1123-powershell-audio-collect.toml
      - T1114-outlook-archive-access.toml
      - T1123-soundrecorder-collect.toml
      - T1115-clipboard-pbpaste.toml
    - actors
      - GAMAREDON GROUP
        G0047-persistence-startup-folder-file-write.toml
        G0047-registry-modification-remove-vba-warning-disable.toml
        G0047-persistence-startup-folder-execution.toml
        G0047-ms-office-template-injection.toml
        G0047-dynamic-dns-non-browser-process.toml
    - execution
      - T1168-local-job-scheduling-paths.toml
      - T1047-wmi-execution-via-vba-macro.toml
      - T1118-installutil-process.toml
      - T1170-mshta-network.toml
      - T1154-trap-signals.toml
      - T1173-executable-written-and-executed-via-dde-and-ms-office.toml
      - T1168-local-job-scheduling-process.toml
      - T1170-mshta-ms-office-descendant.toml
      - T1035-execution-of-existing-service-command.toml
      - T1047-wmic-remote-process.toml
      - T1117-regsvr32-scrobj.toml
    - persistence
      - T1209-persistence-time-providers.toml
      - T1137-office-application-startup-template-reg.toml
      - T1136-net-user-add.toml
      - T1137-office-application-startup-template-file.toml
      - T1128-registry-netsh.toml
      - T1101-ssp-registry-modification.toml
      - T1159-process-launch-agent.toml
      - T1215-linux-ko-creations.toml
      - T1060-shell-folders.toml
      - T1163-rc-common.toml
      - T1501-systemd-service.toml
      - T1031-service-path-mod-sc.toml
      - T1015-accessibility-debugger.toml
      - T1131-lsa-authentication-package.toml
      - T1180-screensaver-persistence.toml
      - T1176-suspicious-files-browser-extensions.toml
      - T1122-com-hijack.toml
      - T1215-mac-kernel-modules-kextload.toml
      - T1042-file-handler.toml
      - T1138-shim-db.toml
      - T1156-bash-profile-bashrc-mod.toml
      - T1164-mac-resumed-application.toml
      - T1103-appinit.toml
      - T1053-scheduled-task-creation-via-vba-macro.toml
      - T1037-reg-logon-script.toml
      - T1060-run-keys.toml
      - T1004-winlogon-helper-dll-reg.toml
    - credential-access
      - T1003-ntdsutil-dump-ntds.toml
      - T1003-credential-dumping-via-credential-vault-dll.toml
      - T1003-lsass-memory-dump.toml
      - T1003-reg-dump.toml
      - T1081-windows-findstr-password.toml
      - T1174-password-filter-dll.toml
      - T1003-procdump-dump-lsass.toml
      - T1081-linux-creds-in-files.toml
      - T1003-credential-enumeration-via-credential-vault-cli.toml
  - sources
    - endgame.toml
    - car.toml
    - sysmon.toml
  - attack.py
  - normalization.py
  - functions.py
  - schemas.py
  - __main__.py
  - __init__.py
  - main.py
  - utils.py
  - loader.py
  - domains
    - security.toml
- MANIFEST.in

EQL Analytics Library

Getting Started

The Event Query Language Analytics Library (eqllib) is a library of event based analytics, written in EQL to detect adversary behaviors identified in MITRE ATT&CK™.

Get started with EQL on your own computer
Explore the analytics that map to ATT&CK.
Learn how to write queries in EQL syntax
Browse our schemas and existing normalizations