admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Atomic Reference

Browse Source
This commit is contained in:
Michael Haag
2023-01-03 10:07:28 -07:00
committed by GitHub
parent 5e5a98030a
commit 8a6bfc4458
5 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_iis_components_add_new_module.yml
+1
View File
@@ -24,6 +24,7 @@ references:
- https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf
- https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
- https://www.secureworks.com/research/bronze-union
- https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004
- https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html
tags:
analytic_story:
detections/endpoint/windows_iis_components_get_webglobalmodule_module_query.yml
+1
View File
@@ -12,6 +12,7 @@ known_false_positives: This analytic is meant to assist with hunting modules acr
references:
- https://docs.splunk.com/Documentation/Splunk/9.0.2/Data/MonitorWindowsdatawithPowerShellscripts
- https://gist.github.com/MHaggis/64396dfd9fc3734e1d1901a8f2f07040
- https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004
tags:
analytic_story:
- IIS Components
detections/endpoint/windows_iis_components_module_failed_to_load.yml
+1
View File
@@ -16,6 +16,7 @@ references:
- https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf
- https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
- https://www.secureworks.com/research/bronze-union
- https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004
- https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html
tags:
analytic_story:
detections/endpoint/windows_iis_components_new_module_added.yml
+1
View File
@@ -17,6 +17,7 @@ references:
- https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf
- https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
- https://www.secureworks.com/research/bronze-union
- https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004
- https://strontic.github.io/xcyclopedia/library/appcmd.exe-055B2B09409F980BF9B5A3969D01E5B2.html
tags:
analytic_story:
detections/endpoint/windows_powershell_iis_components_webglobalmodule_usage.yml
+1
View File
@@ -22,6 +22,7 @@ references:
- https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework-1.pdf
- https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/
- https://www.secureworks.com/research/bronze-union
- https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1505.004
tags:
analytic_story:
- IIS Components