admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'develop' of github.com:splunk/security-content into tf23

Browse Source
This commit is contained in:
Xiao Lin
2021-10-25 13:45:04 -07:00
parent 8e42d76725 c93daad34f
commit 9acac939bf
35 changed files with 75 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/deprecated/open_redirect_in_splunk_web.yml
+2
View File
@@ -35,3 +35,5 @@ tags:
required_fields:
- _time
security_domain: network
cve:
- CVE-2016-4859
detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml
+2
View File
@@ -36,3 +36,5 @@ tags:
required_fields:
- _time
security_domain: endpoint
cve:
- CVE-2017-5753
detections/deprecated/splunk_enterprise_information_disclosure.yml
+3
View File
@@ -42,3 +42,6 @@ tags:
required_fields:
- _time
security_domain: network
cve:
- CVE-2018-11409
detections/endpoint/control_loading_from_world_writable_directory.yml
+2
View File
@@ -84,3 +84,5 @@ tags:
- Processes.parent_process_id
risk_score: 80
security_domain: endpoint
cve:
- CVE-2021-40444
detections/endpoint/detect_computer_changed_with_anonymous_account.yml
+2
View File
@@ -67,3 +67,5 @@ tags:
- user
risk_score: 49
security_domain: endpoint
cve:
- CVE-2020-1472
detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
+2
View File
@@ -72,3 +72,5 @@ tags:
- EventCode
risk_score: 80
security_domain: endpoint
cve:
- CVE-2021-36934
detections/endpoint/mshtml_module_load_in_office_product.yml
+2
View File
@@ -69,3 +69,5 @@ tags:
- dest
risk_score: 80
security_domain: endpoint
cve:
- CVE-2021-40444
detections/endpoint/office_product_writing_cab_or_inf.yml
+2
View File
@@ -74,3 +74,5 @@ tags:
- file_path
risk_score: 80
security_domain: endpoint
cve:
- CVE-2021-40444
detections/endpoint/office_spawning_control.yml
+2
View File
@@ -83,3 +83,5 @@ tags:
- Processes.parent_process_id
risk_score: 80
security_domain: endpoint
cve:
- CVE-2021-40444
detections/endpoint/petitpotam_network_share_access_request.yml
+2
View File
@@ -68,3 +68,5 @@ tags:
- Message
risk_score: 56
security_domain: endpoint
cve:
- CVE-2021-36942
detections/endpoint/petitpotam_suspicious_kerberos_tgt_request.yml
+2
View File
@@ -61,3 +61,5 @@ tags:
- Message
risk_score: 56
security_domain: endpoint
cve:
- CVE-2021-36942
detections/endpoint/print_spooler_adding_a_printer_driver.yml
+3
View File
@@ -68,3 +68,6 @@ tags:
- Message
risk_score: 72
security_domain: endpoint
cve:
- CVE-2021-34527
- CVE-2021-1675
detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml
+3
View File
@@ -66,3 +66,6 @@ tags:
- Message
risk_score: 72
security_domain: endpoint
cve:
- CVE-2021-34527
- CVE-2021-1675
detections/endpoint/rundll32_control_rundll_hunt.yml
+2
View File
@@ -87,3 +87,5 @@ tags:
- Processes.parent_process_id
risk_score: 15
security_domain: endpoint
cve:
- CVE-2021-40444
detections/endpoint/rundll32_control_rundll_world_writable_directory.yml
+2
View File
@@ -89,3 +89,5 @@ tags:
- Processes.parent_process_id
risk_score: 80
security_domain: endpoint
cve:
- CVE-2021-40444
detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml
+2
View File
@@ -84,3 +84,5 @@ tags:
- Processes.parent_process_id
risk_score: 70
security_domain: endpoint
cve:
- CVE-2021-34527
detections/endpoint/sam_database_file_access_attempt.yml
+2
View File
@@ -72,3 +72,5 @@ tags:
- user
risk_score: 80
security_domain: endpoint
cve:
- CVE-2021-36934
detections/endpoint/spoolsv_spawning_rundll32.yml
+2
View File
@@ -82,3 +82,5 @@ tags:
- Processes.parent_process_id
risk_score: 72
security_domain: endpoint
cve:
- CVE-2021-34527
detections/endpoint/spoolsv_suspicious_loaded_modules.yml
+2
View File
@@ -66,3 +66,5 @@ tags:
- ImageLoaded
risk_score: 72
security_domain: endpoint
cve:
- CVE-2021-34527
detections/endpoint/spoolsv_suspicious_process_access.yml
+2
View File
@@ -71,3 +71,5 @@ tags:
- EventCode
risk_score: 72
security_domain: endpoint
cve:
- CVE-2021-34527
detections/endpoint/spoolsv_writing_a_dll.yml
+2
View File
@@ -79,3 +79,5 @@ tags:
- Processes.dest
risk_score: 72
security_domain: endpoint
cve:
- CVE-2021-34527
detections/endpoint/spoolsv_writing_a_dll___sysmon.yml
+2
View File
@@ -73,3 +73,5 @@ tags:
- TargetFilename
risk_score: 72
security_domain: endpoint
cve:
- CVE-2021-34527
detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml
+2
View File
@@ -85,3 +85,5 @@ tags:
- Processes.parent_process_id
risk_score: 49
security_domain: endpoint
cve:
- CVE-2021-34527
detections/endpoint/unified_messaging_service_spawning_a_process.yml
+2
View File
@@ -69,3 +69,5 @@ tags:
- Processes.parent_process_id
risk_score: 56
security_domain: endpoint
cve:
- CVE-2021-26857
detections/endpoint/w3wp_spawning_shell.yml
+4
View File
@@ -76,3 +76,7 @@ tags:
- Processes.parent_process_id
risk_score: 56
security_domain: endpoint
cve:
- CVE-2021-34473
- CVE-2021-34523
- CVE-2021-31207
detections/experimental/endpoint/child_processes_of_spoolsv_exe.yml
+2
View File
@@ -54,3 +54,5 @@ tags:
- Processes.parent_process
- Processes.user
security_domain: endpoint
cve:
- CVE-2018-8440
detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156.yml
+2
View File
@@ -35,3 +35,5 @@ tags:
required_fields:
- _time
security_domain: endpoint
cve:
- CVE-2021-3156
detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml
+2
View File
@@ -39,3 +39,5 @@ tags:
- _time
- host
security_domain: endpoint
cve:
- CVE-2021-3156
detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml
+2
View File
@@ -36,3 +36,5 @@ tags:
- _time
- columns.cmdline
security_domain: endpoint
cve:
- CVE-2021-3156
detections/experimental/endpoint/winrm_spawning_a_process.yml
+2
View File
@@ -51,3 +51,5 @@ tags:
- Processes.process_id
- Processes.parent_process_id
security_domain: endpoint
cve:
- CVE-2021-31166
detections/experimental/network/detect_windows_dns_sigred_via_splunk_stream.yml
+2
View File
@@ -37,3 +37,5 @@ tags:
required_fields:
- _time
security_domain: network
cve:
- CVE-2020-1350
detections/experimental/network/detect_windows_dns_sigred_via_zeek.yml
+2
View File
@@ -44,3 +44,5 @@ tags:
- All_Traffic.bytes_in
- All_Traffic.flow_id
security_domain: endpoint
cve:
- CVE-2020-1350
detections/experimental/network/detect_zerologon_via_zeek.yml
+2
View File
@@ -42,3 +42,5 @@ tags:
- _time
- operation
security_domain: network
cve:
- CVE-2020-1472
detections/experimental/web/detect_f5_tmui_rct_cve_2020_5902.yml
+2
View File
@@ -40,3 +40,5 @@ tags:
required_fields:
- _time
security_domain: network
cve:
- CVE-2020-5902
detections/network/investigate_network_traffic_from_src_ip.yml
+2
View File
@@ -23,3 +23,5 @@ tags:
- _time
- src_ip
security_domain: network
cve:
- CVE-2018-11409