Branch was auto-updated.

detections/deprecated/monitor_dns_for_brand_abuse.yml

@@ -17,7 +17,7 @@ how_to_implement: You need to ingest data from your DNS logs. Specifically you m
   This approach allows you to also create your own localized passive DNS capability
   which can aid you in future investigations. You also need to have run the search
   "ESCU - DNSTwist Domain Names", which creates the permutations of the domain that
-  will be checked for. You also need the [`dnstwist`](https://gist.github.com/d1vious/c4c2aae7fa7d5cbb1f24adc5f6303) custom command. 
+  will be checked for. You also need the [`dnstwist`](https://gist.github.com/d1vious/c4c2aae7fa7d5cbb1f24adc5f6303ac1) custom command. 
 known_false_positives: None at this time
 references: []
 tags:

dist/escu/default/commands.conf

@@ -1,6 +1,7 @@
-[dnstwist]
-filename = dnstwist.py
-chunked = true
+# deprecated please see gist: https://gist.github.com/d1vious/c4c2aae7fa7d5cbb1f24adc5f6303ac1
+#[dnstwist]
+#filename = dnstwist.py
+#chunked = true
 
 # run story functionality has been moved to: https://github.com/splunk/analytic_story_execution'
 # [runstory]

dist/escu/default/searchbnf.conf

@@ -1,26 +0,0 @@
-[dnstwist-command]
-syntax	    = dnstwist (<dnstwist-options>)*
-shortdesc   = Perform word permutations on a domain, or list of domains
-description = Perform domain permutations on a domain, provided list of domains or domains part of Splunk_SA_CIM lookups
-usage       = public
-maintainer  = Splunk Security Research <research@splunk.com>
-example1    = |dnstwist domainlist=domains.csv
-comment1    = Performs word premutation on a list of domains provided under DA-ESS-ContentUpdate/lookup/domains.csv
-example2    = |dnstwist domain=www.splunk.com
-comment2    = Performs word premutation on a single domain
-example3    = |dnstwist populate_from_cim=true
-comment3    = Performs word premutation on cim_corporate_email_domains.csv and cim_corporate_web_domains.csv from Splunk_SA_CIM
-
-[dnstwist-options]
-syntax 	    = domainlist=<string> | domain=<string> | populate_from_cim=<bool>
-description = Prove the name of a lookup file with the list of domains, or individual domain you want to create permutations of.
-
-# runstory functionality was migrated to: https://github.com/splunk/analytic_story_execution
-# [runstory-command]
-# syntax      = runstory <analytic_story_name>
-# shortdesc   = Run an analytic story
-# description = Run all the detection searches in an analytic story
-# maintainer  = Splunk Security Research
-# example1    = | runstory "Malicious PowerShell"
-# example2    = | runstory "AWS Cryptomining"
-# usage       = public

stories/active_directory_password_spraying.yml

@@ -23,7 +23,7 @@ narrative: 'In a password spraying attack, adversaries leverage one or a small l
   Specifically, this Analytic Story is focused on detecting possible Password Spraying
   attacks against Active Directory environments leveraging Windows Event Logs in the
   `Account Logon` and `Logon/Logoff` Advanced Audit Policy categories. It presents
-  9 detection analytics which can aid defenders in identifyng instances where one
+  9 detection analytics which can aid defenders in identifying instances where one
   source user, source host or source process attempts to authenticate against a target
   or targets using a high, unsual, number of unique users. A user, host or process
   attempting to authenticate with multiple users is not common behavior for legitimate