admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-01-20 13:07:06 -08:00
committed by GitHub
parent 76221cf4dd 69b262d1ab
commit 0b540e0bc6
23 changed files with 23 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml
+1
View File
@@ -76,4 +76,5 @@ tags:
- Processes.parent_process_name
- Processes.parent_process
risk_score: 42
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___attempt_to_delete_services.yml
+1 -1
View File
@@ -87,5 +87,5 @@ tags:
- process
- cmd_line
risk_score: 36
risk_severity: high
risk_severity: low
security_domain: endpoint
detections/endpoint/ssa___attempt_to_disable_services.yml
+1 -1
View File
@@ -86,5 +86,5 @@ tags:
- dest_user_id
- process
risk_score: 36
risk_severity: medium
risk_severity: low
security_domain: endpoint
detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
+1 -1
View File
@@ -77,5 +77,5 @@ tags:
- process
- cmd_line
risk_score: 63
risk_severity: low
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___delete_a_net_user.yml
+1 -1
View File
@@ -86,5 +86,5 @@ tags:
- process
- cmd_line
risk_score: 49
risk_severity: high
risk_severity: low
security_domain: endpoint
detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
+1 -1
View File
@@ -73,5 +73,5 @@ tags:
- process
- cmd_line
risk_score: 35
risk_severity: medium
risk_severity: low
security_domain: endpoint
detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
+1 -1
View File
@@ -68,5 +68,5 @@ tags:
- dest_device_id
- process
risk_score: 70
risk_severity: low
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___detect_rclone_command_line_usage.yml
+1
View File
@@ -88,4 +88,5 @@ tags:
- process
- cmd_line
risk_score: 35
risk_severity: low
security_domain: endpoint
detections/endpoint/ssa___disable_net_user_account.yml
+1 -1
View File
@@ -85,5 +85,5 @@ tags:
- process
- cmd_line
risk_score: 49
risk_severity: medium
risk_severity: low
security_domain: endpoint
detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml
+1
View File
@@ -85,4 +85,5 @@ tags:
- process
- cmd_line
risk_score: 72
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___excessive_number_of_office_files_copied.yml
+1
View File
@@ -46,4 +46,5 @@ tags:
- file_name
- file_path
risk_score: 72
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___fsutil_zeroing_file.yml
+1 -1
View File
@@ -78,7 +78,7 @@ tags:
- process
- cmd_line
risk_score: 54
risk_severity: high
risk_severity: medium
security_domain: endpoint
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-security.log
detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
+1 -1
View File
@@ -73,5 +73,5 @@ tags:
- process
- cmd_line
risk_score: 35
risk_severity: medium
risk_severity: low
security_domain: endpoint
detections/endpoint/ssa___high_file_deletion_frequency.yml
+1
View File
@@ -67,4 +67,5 @@ tags:
- file_name
- file_path
risk_score: 72
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
+1 -1
View File
@@ -76,5 +76,5 @@ tags:
- process
- cmd_line
risk_score: 35
risk_severity: medium
risk_severity: low
security_domain: endpoint
detections/endpoint/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml
+1 -1
View File
@@ -93,5 +93,5 @@ tags:
- dest_device_id
- authentication_method
risk_score: 72
risk_severity: high
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml
+1 -1
View File
@@ -94,5 +94,5 @@ tags:
- origin_device_id
- authentication_method
risk_score: 64
risk_severity: high
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___resize_shadowstorage_volume.yml
+1 -1
View File
@@ -85,5 +85,5 @@ tags:
- process
- cmd_line
risk_score: 64
risk_severity: high
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___sdelete_application_execution.yml
+1
View File
@@ -91,4 +91,5 @@ tags:
- process_path
- cmd_line
risk_score: 42
risk_severity: low
security_domain: endpoint
detections/endpoint/ssa___system_process_running_from_unexpected_location.yml
+1 -1
View File
@@ -272,5 +272,5 @@ tags:
- dest_user_id
- process_path
risk_score: 56
risk_severity: low
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___wbadmin_delete_system_backups.yml
+1 -1
View File
@@ -82,7 +82,7 @@ tags:
- process
- cmd_line
risk_score: 15
risk_severity: high
risk_severity: low
security_domain: endpoint
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log
detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
+1 -1
View File
@@ -74,5 +74,5 @@ tags:
- dest_user_id
- process
risk_score: 63
risk_severity: high
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml
+1
View File
@@ -96,4 +96,5 @@ tags:
- process
- cmd_line
risk_score: 80
risk_severity: high
security_domain: endpoint