mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Branch was auto-updated.
This commit is contained in:
srv-rr-gh-researchbt
+2
-2
@@ -1,6 +1,6 @@
|
||||
name: Splunk Persistent XSS in RapidDiag through User Interface Views Unit Test
|
||||
name: Persistent XSS in RapidDiag through User Interface Views Unit Test
|
||||
tests:
|
||||
- name: Splunk Persistent XSS in RapidDiag through User Interface Views
|
||||
- name: Persistent XSS in RapidDiag through User Interface Views
|
||||
file: application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.yml
|
||||
pass_condition: "| stats count | where count > 0"
|
||||
earliest_time: -24h
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
name: Splunk risky command abuse disclosed february 2023 Unit Test
|
||||
name: Splunk risky Command Abuse disclosed february 2023 Unit Test
|
||||
tests:
|
||||
- name: Splunk risky command abuse disclosed february 2023
|
||||
- name: Splunk risky Command Abuse disclosed february 2023
|
||||
file: application/splunk_risky_command_abuse_disclosed_february_2023.yml
|
||||
pass_condition: "| stats count | where count > 0"
|
||||
earliest_time: -24h
|
||||
|
||||
+2
-2
@@ -1,6 +1,6 @@
|
||||
name: Splunk unnecesary file extensions allowed by lookup table uploads Unit Test
|
||||
name: Splunk unnecessary file extensions allowed by lookup table uploads Unit Test
|
||||
tests:
|
||||
- name: Splunk unnecesary file extensions allowed by lookup table uploads
|
||||
- name: Splunk unnecessary file extensions allowed by lookup table uploads
|
||||
file: application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml
|
||||
pass_condition: "| stats count | where count > 0"
|
||||
earliest_time: -24h
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
name: Splunk XSS via View
|
||||
name: Splunk XSS via View Unit Test
|
||||
tests:
|
||||
- name: Splunk Stored XSS via view module tag layoutPanel attribute
|
||||
- name: Splunk XSS via View
|
||||
file: application/splunk_xss_via_view.yml
|
||||
pass_condition: "| stats count | where count > 0"
|
||||
earliest_time: -24h
|
||||
|
||||
@@ -1,13 +1,13 @@
|
||||
name: Windows AD Replication Request Initiated by User Account Test
|
||||
name: Windows AD Replication Request Initiated by User Account Unit Test
|
||||
tests:
|
||||
- name: Windows AD Replication Request Initiated by User Account
|
||||
file: endpoint/windows_ad_replication_request_initiated_by_user_account.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security-xml.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log
|
||||
source: XmlWinEventLog:Security
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
- name: Windows AD Replication Request Initiated by User Account
|
||||
file: endpoint/windows_ad_replication_request_initiated_by_user_account.yml
|
||||
pass_condition: "| stats count | where count > 0"
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security-xml.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log
|
||||
source: XmlWinEventLog:Security
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
|
||||
+12
-13
@@ -1,14 +1,13 @@
|
||||
name: Windows AD Replication Request Initiated from Unsanctioned Location Test
|
||||
name: Windows AD Replication Request Initiated from Unsanctioned Location Unit Test
|
||||
tests:
|
||||
- name: Windows AD Replication Request Initiated from Unsanctioned Location
|
||||
file: endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security-xml.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log
|
||||
source: XmlWinEventLog:Security
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
|
||||
- name: Windows AD Replication Request Initiated from Unsanctioned Location
|
||||
file: endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml
|
||||
pass_condition: "| stats count | where count > 0"
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security-xml.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log
|
||||
source: XmlWinEventLog:Security
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
|
||||
@@ -1,13 +1,13 @@
|
||||
name: Windows AD SID History Attribute Modified
|
||||
name: Windows AD SID History Attribute Modified Unit Test
|
||||
tests:
|
||||
- name: Windows AD SID History Attribute Modified
|
||||
file: endpoint/windows_ad_sid_history_attribute_modified.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134.005/sid_history2/windows-security.log
|
||||
source: XmlWinEventLog
|
||||
sourcetype: XmlWinEventLog
|
||||
update_timestamp: true
|
||||
- name: Windows AD SID History Attribute Modified
|
||||
file: endpoint/windows_ad_sid_history_attribute_modified.yml
|
||||
pass_condition: "| stats count | where count > 0"
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134.005/sid_history2/windows-security.log
|
||||
source: XmlWinEventLog
|
||||
sourcetype: XmlWinEventLog
|
||||
update_timestamp: true
|
||||
|
||||
-12
@@ -1,12 +0,0 @@
|
||||
name: Windows Multiple Disabled Users Failed To Authenticate W Kerberos Unit Test
|
||||
tests:
|
||||
- name: Windows Multiple Disabled Users Failed To Authenticate W Kerberos
|
||||
file: endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log
|
||||
source: XmlWinEventLog:Security
|
||||
sourcetype: XmlWinEventLog
|
||||
+12
@@ -0,0 +1,12 @@
|
||||
name: Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos Unit Test
|
||||
tests:
|
||||
- name: Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos
|
||||
file: endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml
|
||||
pass_condition: "| stats count | where count > 0"
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log
|
||||
source: XmlWinEventLog:Security
|
||||
sourcetype: XmlWinEventLog
|
||||
@@ -1,13 +1,13 @@
|
||||
name: Windows PowerShell Export PfxCertificate Unit Test
|
||||
name: Windows PowerShell Export Certificate Unit Test
|
||||
tests:
|
||||
- name: Windows PowerShell Export PfxCertificate
|
||||
file: endpoint/windows_powershell_export_certificate.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: 4104_export_certificate.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_certificate.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
- name: Windows PowerShell Export Certificate
|
||||
file: endpoint/windows_powershell_export_certificate.yml
|
||||
pass_condition: "| stats count | where count > 0"
|
||||
earliest_time: -24h
|
||||
latest_time: now
|
||||
attack_data:
|
||||
- file_name: 4104_export_certificate.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_certificate.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
update_timestamp: true
|
||||
|
||||
Reference in New Issue
Block a user