Merge branch 'hpot_ttp' of github.com:splunk/security_content into hpot_ttp

detections/endpoint/dns_exfiltration_using_nslookup_app.yml

@@ -34,6 +34,7 @@ tags:
   - Suspicious DNS Traffic
   - Dynamic DNS
   - Command and Control
+  - Data Exfiltration
   automated_detection_testing: passed
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log

detections/endpoint/excessive_usage_of_nslookup_app.yml

@@ -32,6 +32,7 @@ tags:
   - Suspicious DNS Traffic
   - Dynamic DNS
   - Command and Control
+  - Data Exfiltration
   automated_detection_testing: passed
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log

detections/network/multiple_archive_files_http_post_traffic.yml

@@ -34,6 +34,7 @@ references:
 tags:
   analytic_story:
   - Command and Control
+  - Data Exfiltration
   automated_detection_testing: passed
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/archive_http_post/stream_http_events.log

detections/network/plain_http_post_exfiltrated_data.yml

@@ -24,6 +24,7 @@ references:
 tags:
   analytic_story:
   - Command and Control
+  - Data Exfiltration
   automated_detection_testing: passed
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/plain_exfil_data/stream_http_events.log