admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

new test file

Browse Source
This commit is contained in:
P4T12ICK
2021-01-18 15:22:05 +01:00
parent 27b27a5b59
commit 44bf41a678
9 changed files with 17 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/network/clients_connecting_to_multiple_dns_servers.yml → detections/deprecated/clients_connecting_to_multiple_dns_servers.yml
View File
detections/web/detect_web_traffic_to_dynamic_domain_providers.yml → detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml
+2 -1
View File
@@ -19,7 +19,8 @@ how_to_implement: 'This search requires you to be ingesting web-traffic logs. Yo
**Label:** IsDynamicDNS, **Field:** isDynDNS\
Detailed documentation on how to create a new field within Incident Review may be
found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`'
found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`
Deprecated because duplicate.'
type: ESCU
references: []
author: Bhavin Patel, Splunk
detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml → detections/experimental/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml
View File
detections/network/prohibited_network_traffic_allowed.yml → detections/experimental/network/prohibited_network_traffic_allowed.yml
View File
detections/network/protocol_or_port_mismatch.yml → detections/experimental/network/protocol_or_port_mismatch.yml
View File
detections/network/protocols_passing_authentication_in_cleartext.yml → detections/experimental/network/protocols_passing_authentication_in_cleartext.yml
View File
detections/web/sql_injection_with_long_urls.yml → detections/experimental/web/sql_injection_with_long_urls.yml
View File
detections/network/dns_query_length_with_high_standard_deviation.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: DNS Query Length With High Standard Deviation
id: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f5
version: 2
date: '2020-07-21'
version: 3
date: '2021-01-18'
description: This search allows you to identify DNS requests and compute the standard
deviation on the length of the names being resolved, then filter on two times the
standard deviation to show you those queries that are unusually large for your environment.
@@ -11,7 +11,7 @@ type: ESCU
references: []
author: Bhavin Patel, Splunk
search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution
by DNS.query DNS.record_type | `drop_dm_object_name("DNS")` | eval query_length
by DNS.query | `drop_dm_object_name("DNS")` | eval query_length
= len(query) | table query query_length record_type count | eventstats stdev(query_length)
AS stdev avg(query_length) AS avg p50(query_length) AS p50| where query_length>(avg+stdev*2)
| eval z_score=(query_length-avg)/stdev | `dns_query_length_with_high_standard_deviation_filter` '
tests/network/dns_query_length_with_high_standard_deviation.test.yml
+12
View File
@@ -0,0 +1,12 @@
name: DNS Query Length With High Standard Deviation Unit Test
tests:
- name: DNS Query Length With High Standard Deviation
file: network/dns_query_length_with_high_standard_deviation.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-24h'
latest_time: 'now'
attack_data:
- file_name: windows-sysmon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/long_dns_queries/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog