diff --git a/detections/deprecated/monitor_dns_for_brand_abuse.yml b/detections/deprecated/monitor_dns_for_brand_abuse.yml index a23e13a57f..12fb70bec6 100644 --- a/detections/deprecated/monitor_dns_for_brand_abuse.yml +++ b/detections/deprecated/monitor_dns_for_brand_abuse.yml @@ -17,7 +17,7 @@ how_to_implement: You need to ingest data from your DNS logs. Specifically you m This approach allows you to also create your own localized passive DNS capability which can aid you in future investigations. You also need to have run the search "ESCU - DNSTwist Domain Names", which creates the permutations of the domain that - will be checked for. You also need the [`dnstwist`](https://gist.github.com/d1vious/c4c2aae7fa7d5cbb1f24adc5f6303) custom command. + will be checked for. You also need the [`dnstwist`](https://gist.github.com/d1vious/c4c2aae7fa7d5cbb1f24adc5f6303ac1) custom command. known_false_positives: None at this time references: [] tags: diff --git a/dist/escu/default/commands.conf b/dist/escu/default/commands.conf index 14ea427b91..ad3cbfdfd0 100644 --- a/dist/escu/default/commands.conf +++ b/dist/escu/default/commands.conf @@ -1,6 +1,7 @@ -[dnstwist] -filename = dnstwist.py -chunked = true +# deprecated please see gist: https://gist.github.com/d1vious/c4c2aae7fa7d5cbb1f24adc5f6303ac1 +#[dnstwist] +#filename = dnstwist.py +#chunked = true # run story functionality has been moved to: https://github.com/splunk/analytic_story_execution' # [runstory] diff --git a/dist/escu/default/searchbnf.conf b/dist/escu/default/searchbnf.conf deleted file mode 100644 index 2b074fb3fe..0000000000 --- a/dist/escu/default/searchbnf.conf +++ /dev/null @@ -1,26 +0,0 @@ -[dnstwist-command] -syntax = dnstwist ()* -shortdesc = Perform word permutations on a domain, or list of domains -description = Perform domain permutations on a domain, provided list of domains or domains part of Splunk_SA_CIM lookups -usage = public -maintainer = Splunk Security Research -example1 = |dnstwist domainlist=domains.csv -comment1 = Performs word premutation on a list of domains provided under DA-ESS-ContentUpdate/lookup/domains.csv -example2 = |dnstwist domain=www.splunk.com -comment2 = Performs word premutation on a single domain -example3 = |dnstwist populate_from_cim=true -comment3 = Performs word premutation on cim_corporate_email_domains.csv and cim_corporate_web_domains.csv from Splunk_SA_CIM - -[dnstwist-options] -syntax = domainlist= | domain= | populate_from_cim= -description = Prove the name of a lookup file with the list of domains, or individual domain you want to create permutations of. - -# runstory functionality was migrated to: https://github.com/splunk/analytic_story_execution -# [runstory-command] -# syntax = runstory -# shortdesc = Run an analytic story -# description = Run all the detection searches in an analytic story -# maintainer = Splunk Security Research -# example1 = | runstory "Malicious PowerShell" -# example2 = | runstory "AWS Cryptomining" -# usage = public diff --git a/stories/active_directory_password_spraying.yml b/stories/active_directory_password_spraying.yml index 296f5127f6..c9f20df254 100644 --- a/stories/active_directory_password_spraying.yml +++ b/stories/active_directory_password_spraying.yml @@ -23,7 +23,7 @@ narrative: 'In a password spraying attack, adversaries leverage one or a small l Specifically, this Analytic Story is focused on detecting possible Password Spraying attacks against Active Directory environments leveraging Windows Event Logs in the `Account Logon` and `Logon/Logoff` Advanced Audit Policy categories. It presents - 9 detection analytics which can aid defenders in identifyng instances where one + 9 detection analytics which can aid defenders in identifying instances where one source user, source host or source process attempts to authenticate against a target or targets using a high, unsual, number of unique users. A user, host or process attempting to authenticate with multiple users is not common behavior for legitimate