mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Branch was auto-updated.
This commit is contained in:
@@ -11,5 +11,9 @@ sidebar:
|
||||
| Name | Detections | Type |
|
||||
| --------| ---------- | ----------- |
|
||||
{% for playbook in playbooks -%}
|
||||
{% if playbook.tags.detections -%}
|
||||
| [{{ playbook.name }}](/playbooks/{{ playbook.name|lower|replace(' ', '_') }}/)|{% for detection in playbook.tags.detections -%}{% for d in detections -%}{% if d.name == detection -%}[{{ detection }}](/detections/{{ d.type }}/{{detection|lower|replace(" ", "_")}}){% endif -%}{%- endfor -%}{%- endfor -%} | {{ playbook.type }} |
|
||||
{% else -%}
|
||||
| [{{ playbook.name }}](/playbooks/{{ playbook.name|lower|replace(' ', '_') }}/)| None | {{ playbook.type }} |
|
||||
{% endif -%}
|
||||
{%- endfor -%}
|
||||
|
||||
@@ -10,4 +10,4 @@ sidebar:
|
||||
|
||||
| Name | Detections | Type |
|
||||
| --------| ---------- | ----------- |
|
||||
| [Ransomware Investigate and Contain](/playbooks/ransomware_investigate_and_contain/)|[Conti Common Exec parameter](/detections/TTP/conti_common_exec_parameter)| Response |
|
||||
| [Ransomware Investigate and Contain](/playbooks/ransomware_investigate_and_contain/)|[Conti Common Exec parameter](/detections/TTP/conti_common_exec_parameter)| Response |
|
||||
|
||||
-1
@@ -59,7 +59,6 @@ This detection identifies reconnaissance of credential stores and use of CryptoA
|
||||
|
||||
| ID | Technique | Tactic |
|
||||
| ----------- | ----------- | ----------- |
|
||||
| [T1098](https://attack.mitre.org/techniques/T1098/) | Account Manipulation | Persistence |
|
||||
| [T1590.001](https://attack.mitre.org/techniques/T1590/001/) | Domain Properties | Reconnaissance |
|
||||
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Persistence, Privilege Escalation, Initial Access |
|
||||
| [T1589.001](https://attack.mitre.org/techniques/T1589/001/) | Credentials | Reconnaissance |
|
||||
|
||||
Reference in New Issue
Block a user