admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
Bhavin Patel
2024-10-22 17:02:09 -07:00
committed by GitHub
parent 00a0d0c783 d8ce6e1ee5
commit 799da5e452
8 changed files with 24 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/cloud/abnormally_high_number_of_cloud_instances_destroyed.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Abnormally High Number Of Cloud Instances Destroyed
id: ef629fc9-1583-4590-b62a-f2247fbf7bbf
version: 3
date: '2024-10-17'
version: 4
date: '2024-10-22'
author: David Dorsey, Splunk
status: experimental
type: Anomaly
@@ -66,4 +66,4 @@ tags:
- All_Changes.object_category
- All_Changes.user
risk_score: 25
security_domain: cloud
security_domain: threat
detections/cloud/abnormally_high_number_of_cloud_instances_launched.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Abnormally High Number Of Cloud Instances Launched
id: f2361e9f-3928-496c-a556-120cd4223a65
version: 4
date: '2024-10-17'
version: 5
date: '2024-10-22'
author: David Dorsey, Splunk
status: experimental
type: Anomaly
@@ -62,4 +62,4 @@ tags:
- All_Changes.object_category
- All_Changes.user
risk_score: 25
security_domain: cloud
security_domain: threat
detections/cloud/asl_aws_iam_failure_group_deletion.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: ASL AWS IAM Failure Group Deletion
id: 8d12f268-c567-4557-9813-f8389e235c06
version: 4
date: '2024-09-30'
version: 5
date: '2024-10-22'
author: Patrick Bareiss, Splunk
status: production
type: Anomaly
@@ -53,7 +53,7 @@ tags:
- src_endpoint.ip
- cloud.region
risk_score: 5
security_domain: cloud
security_domain: access
tests:
- name: True Positive Test
attack_data:
detections/cloud/asl_aws_iam_successful_group_deletion.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: ASL AWS IAM Successful Group Deletion
id: 1bbe54f1-93d7-4764-8a01-ddaa12ece7ac
version: 3
date: '2024-10-17'
version: 4
date: '2024-10-22'
author: Patrick Bareiss, Splunk
status: production
type: Hunting
@@ -58,7 +58,7 @@ tags:
- src_endpoint.ip
- cloud.region
risk_score: 5
security_domain: cloud
security_domain: access
tests:
- name: True Positive Test
attack_data:
detections/cloud/aws_iam_failure_group_deletion.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: AWS IAM Failure Group Deletion
id: 723b861a-92eb-11eb-93b8-acde48001122
version: 4
date: '2024-09-30'
version: 5
date: '2024-10-22'
author: Michael Haag, Splunk
status: production
type: Anomaly
@@ -52,7 +52,7 @@ tags:
- errorCode
- requestParameters.groupName
risk_score: 5
security_domain: cloud
security_domain: access
tests:
- name: True Positive Test
attack_data:
detections/cloud/aws_iam_successful_group_deletion.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: AWS IAM Successful Group Deletion
id: e776d06c-9267-11eb-819b-acde48001122
version: 3
date: '2024-10-17'
version: 4
date: '2024-10-22'
author: Michael Haag, Splunk
status: production
type: Hunting
@@ -65,7 +65,7 @@ tags:
- errorCode
- requestParameters.groupName
risk_score: 5
security_domain: cloud
security_domain: access
tests:
- name: True Positive Test
attack_data:
detections/cloud/aws_lambda_updatefunctioncode.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: AWS Lambda UpdateFunctionCode
id: 211b80d3-6340-4345-11ad-212bf3d0d111
version: 3
date: '2024-10-17'
version: 4
date: '2024-10-22'
author: Bhavin Patel, Splunk
status: production
type: Hunting
@@ -54,7 +54,7 @@ tags:
- userAgent
- errorCode
risk_score: 63
security_domain: cloud
security_domain: threat
tests:
- name: True Positive Test
attack_data:
detections/cloud/risk_rule_for_dev_sec_ops_by_repository.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Risk Rule for Dev Sec Ops by Repository
id: 161bc0ca-4651-4c13-9c27-27770660cf67
version: 3
date: '2024-09-30'
version: 4
date: '2024-10-22'
author: Bhavin Patel
status: production
type: Correlation
@@ -42,7 +42,7 @@ tags:
required_fields:
- _time
risk_score: 70
security_domain: cloud
security_domain: threat
tests:
- name: True Positive Test
attack_data: