admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-01-20 13:07:09 -08:00
committed by GitHub
parent 4e583266ed 69b262d1ab
commit ce9cdf1b21
23 changed files with 23 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___anomalous_usage_of_archive_tools.yml
+1
View File
@@ -90,4 +90,5 @@ tags:
- Processes.parent_process_name
- Processes.parent_process
risk_score: 42
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___attempt_to_delete_services.yml
+1 -1
View File
@@ -101,5 +101,5 @@ tags:
- process
- cmd_line
risk_score: 36
risk_severity: high
risk_severity: low
security_domain: endpoint
detections/endpoint/ssa___attempt_to_disable_services.yml
+1 -1
View File
@@ -100,5 +100,5 @@ tags:
- dest_user_id
- process
risk_score: 36
risk_severity: medium
risk_severity: low
security_domain: endpoint
detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
+1 -1
View File
@@ -91,5 +91,5 @@ tags:
- process
- cmd_line
risk_score: 63
risk_severity: low
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___delete_a_net_user.yml
+1 -1
View File
@@ -101,5 +101,5 @@ tags:
- process
- cmd_line
risk_score: 49
risk_severity: high
risk_severity: low
security_domain: endpoint
detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
+1 -1
View File
@@ -86,5 +86,5 @@ tags:
- process
- cmd_line
risk_score: 35
risk_severity: medium
risk_severity: low
security_domain: endpoint
detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
+1 -1
View File
@@ -81,5 +81,5 @@ tags:
- dest_device_id
- process
risk_score: 70
risk_severity: low
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___detect_rclone_command_line_usage.yml
+1
View File
@@ -102,4 +102,5 @@ tags:
- process
- cmd_line
risk_score: 35
risk_severity: low
security_domain: endpoint
detections/endpoint/ssa___disable_net_user_account.yml
+1 -1
View File
@@ -99,5 +99,5 @@ tags:
- process
- cmd_line
risk_score: 49
risk_severity: medium
risk_severity: low
security_domain: endpoint
detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml
+1
View File
@@ -99,4 +99,5 @@ tags:
- process
- cmd_line
risk_score: 72
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___excessive_number_of_office_files_copied.yml
+1
View File
@@ -60,4 +60,5 @@ tags:
- file_name
- file_path
risk_score: 72
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___fsutil_zeroing_file.yml
+1 -1
View File
@@ -93,7 +93,7 @@ tags:
- process
- cmd_line
risk_score: 54
risk_severity: high
risk_severity: medium
security_domain: endpoint
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-security.log
detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
+1 -1
View File
@@ -86,5 +86,5 @@ tags:
- process
- cmd_line
risk_score: 35
risk_severity: medium
risk_severity: low
security_domain: endpoint
detections/endpoint/ssa___high_file_deletion_frequency.yml
+1
View File
@@ -81,4 +81,5 @@ tags:
- file_name
- file_path
risk_score: 72
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
+1 -1
View File
@@ -88,5 +88,5 @@ tags:
- process
- cmd_line
risk_score: 35
risk_severity: medium
risk_severity: low
security_domain: endpoint
detections/endpoint/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml
+1 -1
View File
@@ -101,5 +101,5 @@ tags:
- dest_device_id
- authentication_method
risk_score: 72
risk_severity: high
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml
+1 -1
View File
@@ -105,5 +105,5 @@ tags:
- origin_device_id
- authentication_method
risk_score: 64
risk_severity: high
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___resize_shadowstorage_volume.yml
+1 -1
View File
@@ -99,5 +99,5 @@ tags:
- process
- cmd_line
risk_score: 64
risk_severity: high
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___sdelete_application_execution.yml
+1
View File
@@ -106,4 +106,5 @@ tags:
- process_path
- cmd_line
risk_score: 42
risk_severity: low
security_domain: endpoint
detections/endpoint/ssa___system_process_running_from_unexpected_location.yml
+1 -1
View File
@@ -286,5 +286,5 @@ tags:
- dest_user_id
- process_path
risk_score: 56
risk_severity: low
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___wbadmin_delete_system_backups.yml
+1 -1
View File
@@ -97,7 +97,7 @@ tags:
- process
- cmd_line
risk_score: 15
risk_severity: high
risk_severity: low
security_domain: endpoint
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-security_bcdedit_wbadmin.log
detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml
+1 -1
View File
@@ -86,5 +86,5 @@ tags:
- dest_user_id
- process
risk_score: 63
risk_severity: high
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml
+1
View File
@@ -110,4 +110,5 @@ tags:
- process
- cmd_line
risk_score: 80
risk_severity: high
security_domain: endpoint