From 477221da99c58befce41bcf2a34399d0b2cdbdf9 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 18 Jan 2021 15:46:53 +0100 Subject: [PATCH] detection testing --- .../dns_query_requests_resolved_by_unauthorized_dns_servers.yml | 0 .../high_number_of_login_failures_from_a_single_source.yml | 2 +- .../{application => deprecated}/open_redirect_in_splunk_web.yml | 0 .../splunk_enterprise_information_disclosure.yml | 0 .../{ => experimental}/network/excessive_dns_failures.yml | 0 .../network/large_volume_of_dns_any_queries.yml | 0 6 files changed, 1 insertion(+), 1 deletion(-) rename detections/{network => deprecated}/dns_query_requests_resolved_by_unauthorized_dns_servers.yml (100%) rename detections/{cloud => deprecated}/high_number_of_login_failures_from_a_single_source.yml (96%) rename detections/{application => deprecated}/open_redirect_in_splunk_web.yml (100%) rename detections/{application => deprecated}/splunk_enterprise_information_disclosure.yml (100%) rename detections/{ => experimental}/network/excessive_dns_failures.yml (100%) rename detections/{ => experimental}/network/large_volume_of_dns_any_queries.yml (100%) diff --git a/detections/network/dns_query_requests_resolved_by_unauthorized_dns_servers.yml b/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml similarity index 100% rename from detections/network/dns_query_requests_resolved_by_unauthorized_dns_servers.yml rename to detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml diff --git a/detections/cloud/high_number_of_login_failures_from_a_single_source.yml b/detections/deprecated/high_number_of_login_failures_from_a_single_source.yml similarity index 96% rename from detections/cloud/high_number_of_login_failures_from_a_single_source.yml rename to detections/deprecated/high_number_of_login_failures_from_a_single_source.yml index 04d49c1634..333ac9e390 100644 --- a/detections/cloud/high_number_of_login_failures_from_a_single_source.yml +++ b/detections/deprecated/high_number_of_login_failures_from_a_single_source.yml @@ -2,7 +2,7 @@ name: High Number of Login Failures from a single source id: 7f398cfb-918d-41f4-8db8-2e2474e02222 version: 1 date: '2020-12-16' -description: This search will detect more than 5 login failures in Office365 Azure Active Directory from a single source IP address. Please adjust the threshold value of 5 as suited for your environment. +description: This search will detect more than 5 login failures in Office365 Azure Active Directory from a single source IP address. Please adjust the threshold value of 5 as suited for your environment. Deprecated because duplicate. type: ESCU author: Bhavin Patel, Splunk search: '`o365_management_activity` Operation=UserLoginFailed record_type=AzureActiveDirectoryStsLogon app=AzureActiveDirectory diff --git a/detections/application/open_redirect_in_splunk_web.yml b/detections/deprecated/open_redirect_in_splunk_web.yml similarity index 100% rename from detections/application/open_redirect_in_splunk_web.yml rename to detections/deprecated/open_redirect_in_splunk_web.yml diff --git a/detections/application/splunk_enterprise_information_disclosure.yml b/detections/deprecated/splunk_enterprise_information_disclosure.yml similarity index 100% rename from detections/application/splunk_enterprise_information_disclosure.yml rename to detections/deprecated/splunk_enterprise_information_disclosure.yml diff --git a/detections/network/excessive_dns_failures.yml b/detections/experimental/network/excessive_dns_failures.yml similarity index 100% rename from detections/network/excessive_dns_failures.yml rename to detections/experimental/network/excessive_dns_failures.yml diff --git a/detections/network/large_volume_of_dns_any_queries.yml b/detections/experimental/network/large_volume_of_dns_any_queries.yml similarity index 100% rename from detections/network/large_volume_of_dns_any_queries.yml rename to detections/experimental/network/large_volume_of_dns_any_queries.yml