admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
github-actions[bot]
2021-02-22 23:01:55 +00:00
committed by GitHub
parent 34ad79bd55 776a72224b
commit 6385124683
48 changed files with 48 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
+1 -1
View File
@@ -31,7 +31,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1055
- T1068
- T1078
detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml
+1 -1
View File
@@ -33,7 +33,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1055
- T1068
- T1078
detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml
+1 -1
View File
@@ -28,7 +28,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1078
- T1098
- T1087
detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml
+1 -1
View File
@@ -38,7 +38,7 @@ tags:
- CIS 16
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1003
nist:
- PR.AC
detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml
+1 -1
View File
@@ -39,7 +39,7 @@ tags:
- CIS 16
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1003
nist:
- PR.AC
detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml
+1 -1
View File
@@ -35,7 +35,7 @@ tags:
- CIS 16
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1003
nist:
- PR.AC
detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml
+1 -1
View File
@@ -33,7 +33,7 @@ tags:
- CIS 16
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1003
nist:
- PR.AC
detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml
+1 -1
View File
@@ -31,7 +31,7 @@ tags:
- CIS 16
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1003
nist:
- PR.IP
detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml
+1 -1
View File
@@ -29,7 +29,7 @@ tags:
- CIS 16
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1003
- T1555
nist:
detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml
+1 -1
View File
@@ -34,7 +34,7 @@ tags:
- CIS 16
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1003
nist:
- PR.AC
detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml
+1 -1
View File
@@ -38,7 +38,7 @@ tags:
- CIS 16
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1003
nist:
- PR.IP
detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml
+1 -1
View File
@@ -34,7 +34,7 @@ tags:
- CIS 16
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1003
nist:
- PR.AC
detections/endpoint/ssa___credential_extraction_powersploit_modules.yml
+1 -1
View File
@@ -35,7 +35,7 @@ tags:
- CIS 16
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1003
nist:
- PR.AC
detections/endpoint/ssa___first_time_seen_cmd_line.yml
+1 -6
View File
@@ -37,12 +37,7 @@ tags:
kill_chain_phases:
- Command and Control
- Actions on Objectives
mitre_attack:
- Execution
- Scripting
- Persistence
- Command-Line Interface
mitre_technique_id:
mitre_attack_id:
- T1059
- T1117
- T1202
detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml
+1 -1
View File
@@ -33,7 +33,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1021
- T1113
- T1123
detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml
+1 -1
View File
@@ -28,7 +28,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1585
nist:
- PR.AC
detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
+1 -1
View File
@@ -29,7 +29,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1078
- T1098
nist:
detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml
+1 -1
View File
@@ -29,7 +29,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1070
nist:
- PR.AC
detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
+1 -1
View File
@@ -31,7 +31,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1098
- T1207
- T1484
detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
+1 -1
View File
@@ -32,7 +32,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1098
- T1207
- T1484
detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
+1 -1
View File
@@ -32,7 +32,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1053
- T1134
- T1548
detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
+1 -1
View File
@@ -29,7 +29,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1134
- T1548
nist:
detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
+1 -1
View File
@@ -32,7 +32,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1055
- T1106
- T1569
detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
+1 -1
View File
@@ -40,7 +40,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1055
- T1106
- T1569
detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
+1 -1
View File
@@ -30,7 +30,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1078
- T1098
nist:
detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
+1 -1
View File
@@ -36,7 +36,7 @@ tags:
- CIS 8
kill_chain_phases:
- Exploitation
mitre_technique_id:
mitre_attack_id:
- T1059
nist:
- PR.PT
detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml
+1 -1
View File
@@ -60,7 +60,7 @@ tags:
- CIS 8
kill_chain_phases:
- Exploitation
mitre_technique_id:
mitre_attack_id:
- T1203
- T1059
- T1053
detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
+1 -1
View File
@@ -41,7 +41,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1053
- T1068
- T1078
detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
+1 -1
View File
@@ -50,7 +50,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1078
- T1087
- T1484
detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
+1 -1
View File
@@ -29,7 +29,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1078
- T1087
- T1484
detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
+1 -1
View File
@@ -40,7 +40,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1199
- T1482
- T1590
detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
+1 -1
View File
@@ -33,7 +33,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1592
- T1590
- T1087
detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml
+1 -1
View File
@@ -28,7 +28,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1592
nist:
- PR.AC
detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
+1 -1
View File
@@ -35,7 +35,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1007
- T1012
- T1046
detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml
+1 -1
View File
@@ -28,7 +28,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1021.002
- T1135
- T1039
detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml
+1 -1
View File
@@ -33,7 +33,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1021.002
- T1135
- T1039
detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml
+1 -1
View File
@@ -34,7 +34,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1021.002
- T1135
- T1039
detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
+1 -1
View File
@@ -31,7 +31,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1589.001
- T1590.001
- T1590.003
detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml
+1 -1
View File
@@ -28,7 +28,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1595.002
- T1592.002
nist:
detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
+1 -1
View File
@@ -28,7 +28,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1068
- T1078
- T1098
detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
+1 -1
View File
@@ -33,7 +33,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1543
- T1055
- T1574
detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml
+1 -1
View File
@@ -29,7 +29,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1007
- T1046
- T1057
detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml
+1 -1
View File
@@ -34,7 +34,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1068
- T1078
- T1098
detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml
+1 -1
View File
@@ -29,7 +29,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1068
- T1078
- T1098
detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml
+1 -1
View File
@@ -28,7 +28,7 @@ tags:
- CIS 20
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1068
- T1078
- T1098
detections/endpoint/ssa___system_process_running_unexpected_location.yml
+1 -1
View File
@@ -235,7 +235,7 @@ tags:
- CIS 8
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1036
nist:
- PR.PT
detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml
+1 -1
View File
@@ -54,7 +54,7 @@ tags:
- CIS 8
kill_chain_phases:
- Exploitation
mitre_technique_id:
mitre_attack_id:
- T1059
- T1053
nist:
detections/experimental/application/detect_phishing_content___ssa.yml
+1 -1
View File
@@ -49,7 +49,7 @@ tags:
- CIS 8
kill_chain_phases:
- Actions on Objectives
mitre_technique_id:
mitre_attack_id:
- T1566
nist:
- PR.PT