admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
Bhavin Patel
2021-10-15 11:51:34 -07:00
committed by GitHub
parent 7fa141e029 4b3a13848f
commit cd4f49f6e2
36 changed files with 36 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/experimental/application/email_files_written_outside_of_the_outlook_directory.yml
+1
View File
@@ -34,6 +34,7 @@ tags:
kill_chain_phases:
- Actions on Objectives
mitre_attack_id:
- T1114
- T1114.001
product:
- Splunk Enterprise
detections/experimental/application/email_servers_sending_high_volume_traffic_to_hosts.yml
+1
View File
@@ -44,6 +44,7 @@ tags:
kill_chain_phases:
- Actions on Objectives
mitre_attack_id:
- T1114
- T1114.002
nist:
- PR.PT
detections/experimental/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml
+1
View File
@@ -27,6 +27,7 @@ tags:
cis20:
- CIS 16
mitre_attack_id:
- T1078
- T1078.001
nist:
- DE.CM
detections/experimental/application/okta_account_lockout_events.yml
+1
View File
@@ -22,6 +22,7 @@ tags:
cis20:
- CIS 16
mitre_attack_id:
- T1078
- T1078.001
nist:
- DE.CM
detections/experimental/application/okta_failed_sso_attempts.yml
+1
View File
@@ -22,6 +22,7 @@ tags:
cis20:
- CIS 16
mitre_attack_id:
- T1078
- T1078.001
nist:
- DE.CM
detections/experimental/application/okta_user_logins_from_multiple_cities.yml
+1
View File
@@ -28,6 +28,7 @@ tags:
cis20:
- CIS 16
mitre_attack_id:
- T1078
- T1078.001
nist:
- DE.CM
detections/experimental/application/suspicious_email_attachment_extensions.yml
+1
View File
@@ -40,6 +40,7 @@ tags:
- Delivery
mitre_attack_id:
- T1566.001
- T1566
nist:
- DE.AE
- PR.IP
detections/experimental/cloud/abnormally_high_cloud_instances_destroyed.yml
+1
View File
@@ -39,6 +39,7 @@ tags:
- Actions on Objectives
mitre_attack_id:
- T1078.004
- T1078
nist:
- DE.DP
- DE.AE
detections/experimental/cloud/abnormally_high_cloud_instances_launched.yml
+1
View File
@@ -40,6 +40,7 @@ tags:
- Actions on Objectives
mitre_attack_id:
- T1078.004
- T1078
nist:
- DE.DP
- DE.AE
detections/experimental/cloud/high_number_of_login_failures_from_a_single_source.yml
+1
View File
@@ -26,6 +26,7 @@ tags:
- Actions on Objectives
mitre_attack_id:
- T1110.001
- T1110
nist:
- DE.DP
- DE.AE
detections/experimental/endpoint/detect_outlook_exe_writing_a_zip_file.yml
+1
View File
@@ -41,6 +41,7 @@ tags:
- Installation
- Actions on Objectives
mitre_attack_id:
- T1566
- T1566.001
nist:
- ID.AM
detections/experimental/endpoint/exchange_powershell_module_usage.yml
+1
View File
@@ -48,6 +48,7 @@ tags:
- Exploitation
message: Local user discovery enumeration using PowerShell on $dest$ by $user$
mitre_attack_id:
- T1059
- T1059.001
observable:
- name: dest
detections/experimental/endpoint/first_time_seen_running_windows_service.yml
+1
View File
@@ -37,6 +37,7 @@ tags:
- Installation
- Actions on Objectives
mitre_attack_id:
- T1569
- T1569.002
nist:
- ID.AM
detections/experimental/endpoint/print_processor_registry_autostart.yml
+1
View File
@@ -37,6 +37,7 @@ tags:
- Exploitation
mitre_attack_id:
- T1547.012
- T1547
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/experimental/endpoint/remote_desktop_process_running_on_system.yml
+1
View File
@@ -38,6 +38,7 @@ tags:
- Actions on Objectives
mitre_attack_id:
- T1021.001
- T1021
nist:
- DE.AE
- PR.AC
detections/experimental/endpoint/suspicious_plistbuddy_usage.yml
+1
View File
@@ -54,6 +54,7 @@ tags:
- Actions on Objectives
mitre_attack_id:
- T1543.001
- T1543
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/experimental/endpoint/suspicious_plistbuddy_usage_via_osquery.yml
+1
View File
@@ -49,6 +49,7 @@ tags:
- Actions on Objectives
mitre_attack_id:
- T1543.001
- T1543
product:
- Splunk Enterprise
- Splunk Enterprise Security
detections/experimental/network/detect_arp_poisoning.yml
+1
View File
@@ -37,6 +37,7 @@ tags:
mitre_attack_id:
- T1200
- T1498
- T1557
- T1557.002
nist:
- ID.AM
detections/experimental/network/detect_ipv6_network_infrastructure_threats.yml
+1
View File
@@ -48,6 +48,7 @@ tags:
mitre_attack_id:
- T1200
- T1498
- T1557
- T1557.002
nist:
- ID.AM
detections/experimental/network/detect_outbound_smb_traffic.yml
+1
View File
@@ -50,6 +50,7 @@ tags:
- Command and Control
mitre_attack_id:
- T1071.002
- T1071
nist:
- DE.CM
product:
detections/experimental/network/detect_port_security_violation.yml
+1
View File
@@ -47,6 +47,7 @@ tags:
mitre_attack_id:
- T1200
- T1498
- T1557
- T1557.002
nist:
- ID.AM
detections/experimental/network/detect_software_download_to_network_device.yml
+1
View File
@@ -40,6 +40,7 @@ tags:
- Delivery
mitre_attack_id:
- T1542.005
- T1542
nist:
- ID.AM
- PR.DS
detections/experimental/network/detect_traffic_mirroring.yml
+1
View File
@@ -38,6 +38,7 @@ tags:
- Actions on Objectives
mitre_attack_id:
- T1200
- T1020
- T1498
- T1020.001
nist:
detections/experimental/network/dns_query_length_outliers___mltk.yml
+1
View File
@@ -60,6 +60,7 @@ tags:
- Command and Control
mitre_attack_id:
- T1071.004
- T1071
nist:
- PR.PT
- DE.AE
detections/experimental/network/excessive_dns_failures.yml
+1
View File
@@ -34,6 +34,7 @@ tags:
- Command and Control
mitre_attack_id:
- T1071.004
- T1071
nist:
- PR.PT
- DE.AE
detections/experimental/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml
+1
View File
@@ -44,6 +44,7 @@ tags:
- Actions on Objectives
mitre_attack_id:
- T1114.002
- T1114
nist:
- PR.PT
- DE.CM
detections/experimental/network/large_volume_of_dns_any_queries.yml
+1
View File
@@ -27,6 +27,7 @@ tags:
kill_chain_phases:
- Actions on Objectives
mitre_attack_id:
- T1498
- T1498.002
nist:
- PR.PT
detections/experimental/network/protocol_or_port_mismatch.yml
+1
View File
@@ -38,6 +38,7 @@ tags:
- Command and Control
mitre_attack_id:
- T1048.003
- T1048
nist:
- DE.AE
- PR.AC
detections/experimental/network/remote_desktop_network_bruteforce.yml
+1
View File
@@ -34,6 +34,7 @@ tags:
- Delivery
mitre_attack_id:
- T1021.001
- T1021
nist:
- DE.AE
- PR.AC
detections/experimental/network/remote_desktop_network_traffic.yml
+1
View File
@@ -42,6 +42,7 @@ tags:
- Actions on Objectives
mitre_attack_id:
- T1021.001
- T1021
nist:
- DE.AE
- PR.AC
detections/experimental/network/smb_traffic_spike.yml
+1
View File
@@ -34,6 +34,7 @@ tags:
- Actions on Objectives
mitre_attack_id:
- T1021.002
- T1021
nist:
- DE.CM
product:
detections/experimental/network/smb_traffic_spike___mltk.yml
+1
View File
@@ -55,6 +55,7 @@ tags:
- Actions on Objectives
mitre_attack_id:
- T1021.002
- T1021
nist:
- DE.CM
product:
detections/experimental/network/tor_traffic.yml
+1
View File
@@ -34,6 +34,7 @@ tags:
kill_chain_phases:
- Command and Control
mitre_attack_id:
- T1071
- T1071.001
nist:
- DE.AE
detections/network/dns_query_length_with_high_standard_deviation.yml
+1
View File
@@ -43,6 +43,7 @@ tags:
query in host $host$
mitre_attack_id:
- T1048.003
- T1048
nist:
- PR.PT
- DE.AE
detections/network/multiple_archive_files_http_post_traffic.yml
+1
View File
@@ -49,6 +49,7 @@ tags:
4form_data$ in uri path $uri_path$
mitre_attack_id:
- T1048.003
- T1048
observable:
- name: uri_path
type: UriPath
detections/network/plain_http_post_exfiltrated_data.yml
+1
View File
@@ -39,6 +39,7 @@ tags:
$form_data$ in uri path $uri_path$
mitre_attack_id:
- T1048.003
- T1048
observable:
- name: uri_path
type: UriPath