From 197e73cd61634bf4ffe67a63ed6bf680861db30a Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 15 Jun 2021 15:51:08 +0200 Subject: [PATCH] de --- detections/endpoint/dns_exfiltration_using_nslookup_app.yml | 2 +- detections/endpoint/excessive_usage_of_nslookup_app.yml | 2 +- detections/network/multiple_archive_files_http_post_traffic.yml | 2 +- detections/network/plain_http_post_exfiltrated_data.yml | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml index c2d667c55a..0e2e70d158 100644 --- a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml +++ b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml @@ -34,7 +34,7 @@ tags: - Suspicious DNS Traffic - Dynamic DNS - Command and Control - - data exfiltration + - Data Exfiltration automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index 5a8a23379d..502cb9aa07 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -32,7 +32,7 @@ tags: - Suspicious DNS Traffic - Dynamic DNS - Command and Control - - data exfiltration + - Data Exfiltration automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log diff --git a/detections/network/multiple_archive_files_http_post_traffic.yml b/detections/network/multiple_archive_files_http_post_traffic.yml index 1e3d457f48..5680b6cebb 100644 --- a/detections/network/multiple_archive_files_http_post_traffic.yml +++ b/detections/network/multiple_archive_files_http_post_traffic.yml @@ -34,7 +34,7 @@ references: tags: analytic_story: - Command and Control - - data exfiltration + - Data Exfiltration automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/archive_http_post/stream_http_events.log diff --git a/detections/network/plain_http_post_exfiltrated_data.yml b/detections/network/plain_http_post_exfiltrated_data.yml index 59cf952dd1..540090ea25 100644 --- a/detections/network/plain_http_post_exfiltrated_data.yml +++ b/detections/network/plain_http_post_exfiltrated_data.yml @@ -24,7 +24,7 @@ references: tags: analytic_story: - Command and Control - - data exfiltration + - Data Exfiltration automated_detection_testing: passed dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/plain_exfil_data/stream_http_events.log