admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

endpoint: more typefixes

Browse Source
This commit is contained in:
ljstella
2024-11-15 10:48:49 -06:00
parent 911bfd0df1
commit 8f18a20d94
25 changed files with 25 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/detect_certipy_file_modifications.yml
+1 -1
View File
@@ -60,7 +60,7 @@ rba:
score: 45
threat_objects:
- field: file_name
type: file name
type: file_name
- field: process_name
type: process_name
tags:
detections/endpoint/detect_remote_access_software_usage_file.yml
+1 -1
View File
@@ -66,7 +66,7 @@ rba:
score: 25
threat_objects:
- field: file_name
type: file name
type: file_name
tags:
analytic_story:
- Insider Threat
detections/endpoint/detect_rtlo_in_file_name.yml
+1 -1
View File
@@ -58,7 +58,7 @@ rba:
score: 40
threat_objects:
- field: file_name
type: file name
type: file_name
tags:
analytic_story:
- Spearphishing Attachments
detections/endpoint/excessive_file_deletion_in_windefender_folder.yml
+1 -1
View File
@@ -53,7 +53,7 @@ rba:
score: 25
threat_objects:
- field: deleted_files
type: file name
type: file_name
tags:
analytic_story:
- Data Destruction
detections/endpoint/executables_or_script_creation_in_suspicious_path.yml
+1 -1
View File
@@ -63,7 +63,7 @@ rba:
score: 20
threat_objects:
- field: file_name
type: file name
type: file_name
tags:
analytic_story:
- Double Zero Destructor
detections/endpoint/file_with_samsam_extension.yml
+1 -1
View File
@@ -57,7 +57,7 @@ rba:
score: 90
threat_objects:
- field: file_name
type: file name
type: file_name
tags:
analytic_story:
- SamSam Ransomware
detections/endpoint/linux_deletion_of_cron_jobs.yml
+1 -1
View File
@@ -49,7 +49,7 @@ rba:
score: 49
threat_objects:
- field: file_name
type: file name
type: file_name
tags:
analytic_story:
- AcidRain
detections/endpoint/linux_deletion_of_init_daemon_script.yml
+1 -1
View File
@@ -49,7 +49,7 @@ rba:
score: 49
threat_objects:
- field: file_name
type: file name
type: file_name
tags:
analytic_story:
- AcidRain
detections/endpoint/linux_deletion_of_services.yml
+1 -1
View File
@@ -53,7 +53,7 @@ rba:
score: 64
threat_objects:
- field: file_name
type: file name
type: file_name
tags:
analytic_story:
- AwfulShred
detections/endpoint/linux_deletion_of_ssl_certificate.yml
+1 -1
View File
@@ -51,7 +51,7 @@ rba:
score: 49
threat_objects:
- field: file_name
type: file name
type: file_name
tags:
analytic_story:
- AcidRain
detections/endpoint/network_traffic_to_active_directory_web_services_protocol.yml
+1 -1
View File
@@ -36,7 +36,7 @@ rba:
on $dest_ip$ by $src_ip$.
risk_objects:
- field: dest_ip
type: ip address
type: system
score: 10
threat_objects:
- field: src_ip
detections/endpoint/powershell_script_block_with_url_chain.yml
+1 -1
View File
@@ -57,7 +57,7 @@ rba:
score: 80
threat_objects:
- field: file_name
type: file name
type: file_name
- field: url
type: url string
tags:
detections/endpoint/powershell_webrequest_using_memory_stream.yml
+1 -1
View File
@@ -55,7 +55,7 @@ rba:
score: 80
threat_objects:
- field: file_name
type: file name
type: file_name
tags:
analytic_story:
- Malicious PowerShell
detections/endpoint/rundll32_process_creating_exe_dll_files.yml
+1 -1
View File
@@ -47,7 +47,7 @@ rba:
score: 80
threat_objects:
- field: file_name
type: file name
type: file_name
tags:
analytic_story:
- IcedID
detections/endpoint/suspicious_driver_loaded_path.yml
+1 -1
View File
@@ -50,7 +50,7 @@ rba:
score: 63
threat_objects:
- field: file_name
type: file name
type: file_name
tags:
analytic_story:
- XMRig
detections/endpoint/suspicious_process_executed_from_container_file.yml
+1 -1
View File
@@ -62,7 +62,7 @@ rba:
score: 16
threat_objects:
- field: file_name
type: file name
type: file_name
tags:
analytic_story:
- Unusual Processes
detections/endpoint/windows_admin_permission_discovery.yml
+1 -1
View File
@@ -54,7 +54,7 @@ rba:
score: 25
threat_objects:
- field: file_name
type: file name
type: file_name
tags:
analytic_story:
- NjRAT
detections/endpoint/windows_alternate_datastream___base64_content.yml
+1 -1
View File
@@ -58,7 +58,7 @@ rba:
score: 80
threat_objects:
- field: file_name
type: file name
type: file_name
tags:
analytic_story:
- Windows Defense Evasion Tactics
detections/endpoint/windows_alternate_datastream___executable_content.yml
+1 -1
View File
@@ -53,7 +53,7 @@ rba:
score: 80
threat_objects:
- field: file_name
type: file name
type: file_name
- field: file_hash
type: file hash
tags:
detections/endpoint/windows_data_destruction_recursive_exec_files_deletion.yml
+1 -1
View File
@@ -55,7 +55,7 @@ rba:
score: 64
threat_objects:
- field: deleted_files
type: file name
type: file_name
tags:
analytic_story:
- Swift Slicer
detections/endpoint/windows_high_file_deletion_frequency.yml
+1 -1
View File
@@ -60,7 +60,7 @@ rba:
score: 72
threat_objects:
- field: deleted_files
type: file name
type: file_name
- field: process_name
type: process_name
tags:
detections/endpoint/windows_mshta_writing_to_world_writable_path.yml
+1 -1
View File
@@ -64,7 +64,7 @@ rba:
score: 64
threat_objects:
- field: Image
type: file name
type: file_name
tags:
analytic_story:
- APT29 Diplomatic Deceptions with WINELOADER
detections/endpoint/windows_replication_through_removable_media.yml
+1 -1
View File
@@ -57,7 +57,7 @@ rba:
score: 64
threat_objects:
- field: file_name
type: file name
type: file_name
tags:
analytic_story:
- Chaos Ransomware
detections/endpoint/windows_sqlwriter_sqldumper_dll_sideload.yml
+1 -1
View File
@@ -57,7 +57,7 @@ rba:
score: 64
threat_objects:
- field: Image
type: file name
type: file_name
tags:
analytic_story:
- APT29 Diplomatic Deceptions with WINELOADER
detections/endpoint/windows_unsigned_ms_dll_side_loading.yml
+1 -1
View File
@@ -61,7 +61,7 @@ rba:
score: 9
threat_objects:
- field: Image
type: file name
type: file_name
tags:
analytic_story:
- APT29 Diplomatic Deceptions with WINELOADER