From 638c176a445c815a4683c8bac23804d8287fac74 Mon Sep 17 00:00:00 2001 From: ljstella Date: Thu, 15 Aug 2024 15:38:15 -0500 Subject: [PATCH] network detections --- detections/network/detect_arp_poisoning.yml | 6 +++--- detections/network/detect_port_security_violation.yml | 2 +- detections/network/detect_rogue_dhcp_server.yml | 6 +++--- detections/network/detect_traffic_mirroring.yml | 6 +++--- .../detect_windows_dns_sigred_via_splunk_stream.yml | 8 ++++---- 5 files changed, 14 insertions(+), 14 deletions(-) diff --git a/detections/network/detect_arp_poisoning.yml b/detections/network/detect_arp_poisoning.yml index 2dae82e3f5..38f16d21b7 100644 --- a/detections/network/detect_arp_poisoning.yml +++ b/detections/network/detect_arp_poisoning.yml @@ -1,7 +1,7 @@ name: Detect ARP Poisoning id: b44bebd6-bd39-467b-9321-73971bcd1aac -version: 2 -date: '2024-05-12' +version: 3 +date: '2024-08-14' author: Mikael Bjerkeland, Splunk status: experimental type: TTP @@ -46,7 +46,7 @@ tags: - name: dest type: Other role: - - Other + - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/network/detect_port_security_violation.yml b/detections/network/detect_port_security_violation.yml index 3df84d3efe..7b27e91ce7 100644 --- a/detections/network/detect_port_security_violation.yml +++ b/detections/network/detect_port_security_violation.yml @@ -46,7 +46,7 @@ tags: - name: dest type: Other role: - - Other + - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/network/detect_rogue_dhcp_server.yml b/detections/network/detect_rogue_dhcp_server.yml index a9254f53b9..c89cfe41fe 100644 --- a/detections/network/detect_rogue_dhcp_server.yml +++ b/detections/network/detect_rogue_dhcp_server.yml @@ -1,7 +1,7 @@ name: Detect Rogue DHCP Server id: 6e1ada88-7a0d-4ac1-92c6-03d354686079 -version: 2 -date: '2024-05-28' +version: 3 +date: '2024-08-14' author: Mikael Bjerkeland, Splunk status: experimental type: TTP @@ -42,7 +42,7 @@ tags: - name: dest type: Other role: - - Other + - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/network/detect_traffic_mirroring.yml b/detections/network/detect_traffic_mirroring.yml index 6905c3e69a..2b83def6ef 100644 --- a/detections/network/detect_traffic_mirroring.yml +++ b/detections/network/detect_traffic_mirroring.yml @@ -1,7 +1,7 @@ name: Detect Traffic Mirroring id: 42b3b753-5925-49c5-9742-36fa40a73990 -version: 2 -date: '2024-05-09' +version: 3 +date: '2024-08-14' author: Mikael Bjerkeland, Splunk status: experimental type: TTP @@ -45,7 +45,7 @@ tags: - name: dest type: Other role: - - Other + - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/network/detect_windows_dns_sigred_via_splunk_stream.yml b/detections/network/detect_windows_dns_sigred_via_splunk_stream.yml index 6dc617e251..2a0c5b23b1 100644 --- a/detections/network/detect_windows_dns_sigred_via_splunk_stream.yml +++ b/detections/network/detect_windows_dns_sigred_via_splunk_stream.yml @@ -1,7 +1,7 @@ name: Detect Windows DNS SIGRed via Splunk Stream id: babd8d10-d073-11ea-87d0-0242ac130003 -version: 2 -date: '2024-05-28' +version: 3 +date: '2024-08-14' author: Shannon Davis, Splunk status: experimental type: TTP @@ -36,10 +36,10 @@ tags: mitre_attack_id: - T1203 observable: - - name: dest + - name: flow_id type: Other role: - - Other + - Victim product: - Splunk Enterprise - Splunk Enterprise Security