diff --git a/detections/application/crushftp_server_side_template_injection.yml b/detections/application/crushftp_server_side_template_injection.yml index 9c8c20f034..061b0771c6 100644 --- a/detections/application/crushftp_server_side_template_injection.yml +++ b/detections/application/crushftp_server_side_template_injection.yml @@ -36,7 +36,7 @@ references: - https://www.bleepingcomputer.com/news/security/crushftp-warns-users-to-patch-exploited-zero-day-immediately/ drilldown_searches: - name: View the detection results for $dest$ - search: '%orginal_detection_search% | search dest = $dest$' + search: '%original_detection_search% | search dest = $dest$' tags: analytic_story: - CrushFTP Vulnerabilities diff --git a/detections/application/detect_new_login_attempts_to_routers.yml b/detections/application/detect_new_login_attempts_to_routers.yml index 7d9a4eb300..538973238f 100644 --- a/detections/application/detect_new_login_attempts_to_routers.yml +++ b/detections/application/detect_new_login_attempts_to_routers.yml @@ -26,7 +26,7 @@ known_false_positives: Legitimate router connections may appear as new connectio references: [] drilldown_searches: - name: View the detection results for $user$ and $dest$ - search: '%orginal_detection_search% | search user = $user$ dest = $dest$' + search: '%original_detection_search% | search user = $user$ dest = $dest$' tags: analytic_story: - Router and Infrastructure Security diff --git a/detections/application/detect_password_spray_attempts.yml b/detections/application/detect_password_spray_attempts.yml index 2f1b2c6236..3cc54729ec 100644 --- a/detections/application/detect_password_spray_attempts.yml +++ b/detections/application/detect_password_spray_attempts.yml @@ -37,7 +37,7 @@ references: - https://attack.mitre.org/techniques/T1110/003/ drilldown_searches: - name: View the detection results for $unique_accounts$ - search: '%orginal_detection_search% | search unique_accounts = $unique_accounts$' + search: '%original_detection_search% | search unique_accounts = $unique_accounts$' tags: analytic_story: - Compromised User Account diff --git a/detections/application/email_attachments_with_lots_of_spaces.yml b/detections/application/email_attachments_with_lots_of_spaces.yml index 062110d92a..fbea8a8433 100644 --- a/detections/application/email_attachments_with_lots_of_spaces.yml +++ b/detections/application/email_attachments_with_lots_of_spaces.yml @@ -40,7 +40,7 @@ known_false_positives: None at this time references: [] drilldown_searches: - name: View the detection results for $user$ - search: '%orginal_detection_search% | search user = $user$' + search: '%original_detection_search% | search user = $user$' tags: analytic_story: - Data Destruction diff --git a/detections/application/email_files_written_outside_of_the_outlook_directory.yml b/detections/application/email_files_written_outside_of_the_outlook_directory.yml index 4766dc0aea..e7ed8fe839 100644 --- a/detections/application/email_files_written_outside_of_the_outlook_directory.yml +++ b/detections/application/email_files_written_outside_of_the_outlook_directory.yml @@ -34,7 +34,7 @@ known_false_positives: Administrators and users sometimes prefer backing up thei references: [] drilldown_searches: - name: View the detection results for $dest$ - search: '%orginal_detection_search% | search dest = $dest$' + search: '%original_detection_search% | search dest = $dest$' tags: analytic_story: - Collection and Staging diff --git a/detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml b/detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml index 6a5cbf2f54..c2681e4edb 100644 --- a/detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml +++ b/detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml @@ -40,7 +40,7 @@ known_false_positives: The false-positive rate will vary based on how you set th references: [] drilldown_searches: - name: View the detection results for $dest$ - search: '%orginal_detection_search% | search dest = $dest$' + search: '%original_detection_search% | search dest = $dest$' tags: analytic_story: - Collection and Staging diff --git a/detections/application/ivanti_vtm_new_account_creation.yml b/detections/application/ivanti_vtm_new_account_creation.yml index e954cce656..69b025706c 100644 --- a/detections/application/ivanti_vtm_new_account_creation.yml +++ b/detections/application/ivanti_vtm_new_account_creation.yml @@ -30,7 +30,7 @@ references: - https://nvd.nist.gov/vuln/detail/CVE-2024-7593 drilldown_searches: - name: View the detection results for $MODUSER$ - search: '%orginal_detection_search% | search MODUSER = $MODUSER$' + search: '%original_detection_search% | search MODUSER = $MODUSER$' tags: analytic_story: - Ivanti Virtual Traffic Manager CVE-2024-7593 diff --git a/detections/application/monitor_email_for_brand_abuse.yml b/detections/application/monitor_email_for_brand_abuse.yml index b3ac26facd..6317e0686d 100644 --- a/detections/application/monitor_email_for_brand_abuse.yml +++ b/detections/application/monitor_email_for_brand_abuse.yml @@ -28,7 +28,7 @@ known_false_positives: None at this time references: [] drilldown_searches: - name: View the detection results for $user$ - search: '%orginal_detection_search% | search user = $user$' + search: '%original_detection_search% | search user = $user$' tags: analytic_story: - Brand Monitoring diff --git a/detections/application/okta_authentication_failed_during_mfa_challenge.yml b/detections/application/okta_authentication_failed_during_mfa_challenge.yml index a1cc27f6a4..8d45280aa8 100644 --- a/detections/application/okta_authentication_failed_during_mfa_challenge.yml +++ b/detections/application/okta_authentication_failed_during_mfa_challenge.yml @@ -33,7 +33,7 @@ references: - https://splunkbase.splunk.com/app/6553 drilldown_searches: - name: View the detection results for $user$ - search: '%orginal_detection_search% | search user = $user$' + search: '%original_detection_search% | search user = $user$' tags: analytic_story: - Okta Account Takeover diff --git a/detections/application/okta_idp_lifecycle_modifications.yml b/detections/application/okta_idp_lifecycle_modifications.yml index 52408a9bc4..1ffa86aa88 100644 --- a/detections/application/okta_idp_lifecycle_modifications.yml +++ b/detections/application/okta_idp_lifecycle_modifications.yml @@ -32,7 +32,7 @@ references: - https://splunkbase.splunk.com/app/6553 drilldown_searches: - name: View the detection results for $user$ - search: '%orginal_detection_search% | search user = $user$' + search: '%original_detection_search% | search user = $user$' tags: analytic_story: - Suspicious Okta Activity diff --git a/detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml b/detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml index bb86575e86..e015ae1650 100644 --- a/detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml +++ b/detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml @@ -44,7 +44,7 @@ references: - https://splunkbase.splunk.com/app/6553 drilldown_searches: - name: View the detection results for $actor.alternateId$ - search: '%orginal_detection_search% | search actor.alternateId = $actor.alternateId$' + search: '%original_detection_search% | search actor.alternateId = $actor.alternateId$' tags: analytic_story: - Okta Account Takeover diff --git a/detections/application/okta_multi_factor_authentication_disabled.yml b/detections/application/okta_multi_factor_authentication_disabled.yml index edc990a219..4925c46f77 100644 --- a/detections/application/okta_multi_factor_authentication_disabled.yml +++ b/detections/application/okta_multi_factor_authentication_disabled.yml @@ -30,7 +30,7 @@ references: - https://splunkbase.splunk.com/app/6553 drilldown_searches: - name: View the detection results for $user$ - search: '%orginal_detection_search% | search user = $user$' + search: '%original_detection_search% | search user = $user$' tags: analytic_story: - Okta Account Takeover diff --git a/detections/application/okta_multiple_accounts_locked_out.yml b/detections/application/okta_multiple_accounts_locked_out.yml index 122ff16ae3..3e3ef30ab9 100644 --- a/detections/application/okta_multiple_accounts_locked_out.yml +++ b/detections/application/okta_multiple_accounts_locked_out.yml @@ -29,7 +29,7 @@ references: - https://splunkbase.splunk.com/app/6553 drilldown_searches: - name: View the detection results for $user$ - search: '%orginal_detection_search% | search user = $user$' + search: '%original_detection_search% | search user = $user$' tags: analytic_story: - Okta Account Takeover diff --git a/detections/application/okta_multiple_failed_mfa_requests_for_user.yml b/detections/application/okta_multiple_failed_mfa_requests_for_user.yml index a670e35970..08999289e5 100644 --- a/detections/application/okta_multiple_failed_mfa_requests_for_user.yml +++ b/detections/application/okta_multiple_failed_mfa_requests_for_user.yml @@ -28,7 +28,7 @@ references: - https://attack.mitre.org/techniques/T1621/ drilldown_searches: - name: View the detection results for $src_user$ - search: '%orginal_detection_search% | search src_user = $src_user$' + search: '%original_detection_search% | search src_user = $src_user$' tags: analytic_story: - Okta Account Takeover diff --git a/detections/application/okta_multiple_users_failing_to_authenticate_from_ip.yml b/detections/application/okta_multiple_users_failing_to_authenticate_from_ip.yml index 01ab48db71..f8350ab78c 100644 --- a/detections/application/okta_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/application/okta_multiple_users_failing_to_authenticate_from_ip.yml @@ -31,7 +31,7 @@ references: - https://splunkbase.splunk.com/app/6553 drilldown_searches: - name: View the detection results for $user$ - search: '%orginal_detection_search% | search user = $user$' + search: '%original_detection_search% | search user = $user$' tags: analytic_story: - Okta Account Takeover diff --git a/detections/application/okta_new_api_token_created.yml b/detections/application/okta_new_api_token_created.yml index 4e8e30ee38..205d2fb2ce 100644 --- a/detections/application/okta_new_api_token_created.yml +++ b/detections/application/okta_new_api_token_created.yml @@ -30,7 +30,7 @@ references: - https://splunkbase.splunk.com/app/6553 drilldown_searches: - name: View the detection results for $user$ - search: '%orginal_detection_search% | search user = $user$' + search: '%original_detection_search% | search user = $user$' tags: analytic_story: - Okta Account Takeover diff --git a/detections/application/okta_new_device_enrolled_on_account.yml b/detections/application/okta_new_device_enrolled_on_account.yml index 59da8c6014..68ad818d36 100644 --- a/detections/application/okta_new_device_enrolled_on_account.yml +++ b/detections/application/okta_new_device_enrolled_on_account.yml @@ -29,7 +29,7 @@ references: - https://developer.okta.com/docs/reference/api/event-types/?q=device.enrollment.create drilldown_searches: - name: View the detection results for $user$ - search: '%orginal_detection_search% | search user = $user$' + search: '%original_detection_search% | search user = $user$' tags: analytic_story: - Okta Account Takeover diff --git a/detections/application/okta_phishing_detection_with_fastpass_origin_check.yml b/detections/application/okta_phishing_detection_with_fastpass_origin_check.yml index 3798c39b7c..cf65283daa 100644 --- a/detections/application/okta_phishing_detection_with_fastpass_origin_check.yml +++ b/detections/application/okta_phishing_detection_with_fastpass_origin_check.yml @@ -28,7 +28,7 @@ references: - https://sec.okta.com/fastpassphishingdetection drilldown_searches: - name: View the detection results for $user$ - search: '%orginal_detection_search% | search user = $user$' + search: '%original_detection_search% | search user = $user$' tags: analytic_story: - Okta Account Takeover diff --git a/detections/application/okta_risk_threshold_exceeded.yml b/detections/application/okta_risk_threshold_exceeded.yml index 4457076dd3..c2303855c8 100644 --- a/detections/application/okta_risk_threshold_exceeded.yml +++ b/detections/application/okta_risk_threshold_exceeded.yml @@ -39,7 +39,7 @@ references: - https://sec.okta.com/everythingisyes drilldown_searches: - name: View the detection results for $risk_object$ - search: '%orginal_detection_search% | search risk_object = $risk_object$' + search: '%original_detection_search% | search risk_object = $risk_object$' tags: analytic_story: - Okta Account Takeover diff --git a/detections/application/okta_successful_single_factor_authentication.yml b/detections/application/okta_successful_single_factor_authentication.yml index 8f60c5af5b..46c5be3135 100644 --- a/detections/application/okta_successful_single_factor_authentication.yml +++ b/detections/application/okta_successful_single_factor_authentication.yml @@ -30,7 +30,7 @@ references: - https://attack.mitre.org/techniques/T1078/004/ drilldown_searches: - name: View the detection results for $user$ - search: '%orginal_detection_search% | search user = $user$' + search: '%original_detection_search% | search user = $user$' tags: analytic_story: - Okta Account Takeover diff --git a/detections/application/okta_suspicious_activity_reported.yml b/detections/application/okta_suspicious_activity_reported.yml index 5089c683be..f899972509 100644 --- a/detections/application/okta_suspicious_activity_reported.yml +++ b/detections/application/okta_suspicious_activity_reported.yml @@ -30,7 +30,7 @@ references: - https://help.okta.com/en-us/Content/Topics/Security/suspicious-activity-reporting.htm drilldown_searches: - name: View the detection results for $user$ - search: '%orginal_detection_search% | search user = $user$' + search: '%original_detection_search% | search user = $user$' tags: analytic_story: - Okta Account Takeover diff --git a/detections/application/okta_suspicious_use_of_a_session_cookie.yml b/detections/application/okta_suspicious_use_of_a_session_cookie.yml index 4406b00153..32eecac3f1 100644 --- a/detections/application/okta_suspicious_use_of_a_session_cookie.yml +++ b/detections/application/okta_suspicious_use_of_a_session_cookie.yml @@ -32,7 +32,7 @@ references: - https://attack.mitre.org/techniques/T1539/ drilldown_searches: - name: View the detection results for $user$ - search: '%orginal_detection_search% | search user = $user$' + search: '%original_detection_search% | search user = $user$' tags: analytic_story: - Suspicious Okta Activity diff --git a/detections/application/okta_threatinsight_threat_detected.yml b/detections/application/okta_threatinsight_threat_detected.yml index 3b949e369f..a968480a4a 100644 --- a/detections/application/okta_threatinsight_threat_detected.yml +++ b/detections/application/okta_threatinsight_threat_detected.yml @@ -29,7 +29,7 @@ references: - https://developer.okta.com/docs/reference/api/event-types/?q=security.threat.detected drilldown_searches: - name: View the detection results for $app$ - search: '%orginal_detection_search% | search app = $app$' + search: '%original_detection_search% | search app = $app$' tags: analytic_story: - Okta Account Takeover diff --git a/detections/application/okta_unauthorized_access_to_application.yml b/detections/application/okta_unauthorized_access_to_application.yml index a7cde016f9..585cee6eb2 100644 --- a/detections/application/okta_unauthorized_access_to_application.yml +++ b/detections/application/okta_unauthorized_access_to_application.yml @@ -30,7 +30,7 @@ references: - https://attack.mitre.org/techniques/T1110/003/ drilldown_searches: - name: View the detection results for $user$ - search: '%orginal_detection_search% | search user = $user$' + search: '%original_detection_search% | search user = $user$' tags: analytic_story: - Okta Account Takeover diff --git a/detections/application/okta_user_logins_from_multiple_cities.yml b/detections/application/okta_user_logins_from_multiple_cities.yml index b88029589b..acf170c838 100644 --- a/detections/application/okta_user_logins_from_multiple_cities.yml +++ b/detections/application/okta_user_logins_from_multiple_cities.yml @@ -34,7 +34,7 @@ references: - https://attack.mitre.org/techniques/T1110/003/ drilldown_searches: - name: View the detection results for $user$ - search: '%orginal_detection_search% | search user = $user$' + search: '%original_detection_search% | search user = $user$' tags: analytic_story: - Okta Account Takeover diff --git a/detections/application/pingid_mismatch_auth_source_and_verification_response.yml b/detections/application/pingid_mismatch_auth_source_and_verification_response.yml index 7303e87dc6..6ed7ce8d76 100644 --- a/detections/application/pingid_mismatch_auth_source_and_verification_response.yml +++ b/detections/application/pingid_mismatch_auth_source_and_verification_response.yml @@ -43,7 +43,7 @@ references: - https://docs.pingidentity.com/r/en-us/pingoneforenterprise/p14e_subscriptions?tocId=3xhnxjX3VzKNs3SXigWnQA drilldown_searches: - name: View the detection results for $user$ and $src$ - search: '%orginal_detection_search% | search user = $user$ src = $src$' + search: '%original_detection_search% | search user = $user$ src = $src$' tags: analytic_story: - Compromised User Account diff --git a/detections/application/pingid_multiple_failed_mfa_requests_for_user.yml b/detections/application/pingid_multiple_failed_mfa_requests_for_user.yml index d397f3112f..d110a33c78 100644 --- a/detections/application/pingid_multiple_failed_mfa_requests_for_user.yml +++ b/detections/application/pingid_multiple_failed_mfa_requests_for_user.yml @@ -33,7 +33,7 @@ references: - https://docs.pingidentity.com/r/en-us/pingoneforenterprise/p14e_subscriptions?tocId=3xhnxjX3VzKNs3SXigWnQA drilldown_searches: - name: View the detection results for $user$ - search: '%orginal_detection_search% | search user = $user$' + search: '%original_detection_search% | search user = $user$' tags: analytic_story: - Compromised User Account diff --git a/detections/application/pingid_new_mfa_method_after_credential_reset.yml b/detections/application/pingid_new_mfa_method_after_credential_reset.yml index 19c57db54e..fa7446bba1 100644 --- a/detections/application/pingid_new_mfa_method_after_credential_reset.yml +++ b/detections/application/pingid_new_mfa_method_after_credential_reset.yml @@ -41,7 +41,7 @@ references: - https://docs.pingidentity.com/r/en-us/pingoneforenterprise/p14e_subscriptions?tocId=3xhnxjX3VzKNs3SXigWnQA drilldown_searches: - name: View the detection results for $user$ - search: '%orginal_detection_search% | search user = $user$' + search: '%original_detection_search% | search user = $user$' tags: analytic_story: - Compromised User Account diff --git a/detections/application/pingid_new_mfa_method_registered_for_user.yml b/detections/application/pingid_new_mfa_method_registered_for_user.yml index 383c1a8694..6f60526b16 100644 --- a/detections/application/pingid_new_mfa_method_registered_for_user.yml +++ b/detections/application/pingid_new_mfa_method_registered_for_user.yml @@ -33,7 +33,7 @@ references: - https://docs.pingidentity.com/r/en-us/pingoneforenterprise/p14e_subscriptions?tocId=3xhnxjX3VzKNs3SXigWnQA drilldown_searches: - name: View the detection results for $user$ and $src$ - search: '%orginal_detection_search% | search user = $user$ src = $src$' + search: '%original_detection_search% | search user = $user$ src = $src$' tags: analytic_story: - Compromised User Account diff --git a/detections/application/suspicious_email_attachment_extensions.yml b/detections/application/suspicious_email_attachment_extensions.yml index 432a8bf091..d78080a801 100644 --- a/detections/application/suspicious_email_attachment_extensions.yml +++ b/detections/application/suspicious_email_attachment_extensions.yml @@ -37,7 +37,7 @@ known_false_positives: None identified references: [] drilldown_searches: - name: View the detection results for $user$ - search: '%orginal_detection_search% | search user = $user$' + search: '%original_detection_search% | search user = $user$' tags: analytic_story: - Data Destruction diff --git a/detections/application/suspicious_java_classes.yml b/detections/application/suspicious_java_classes.yml index c2b91cb978..b4c9a54230 100644 --- a/detections/application/suspicious_java_classes.yml +++ b/detections/application/suspicious_java_classes.yml @@ -27,7 +27,7 @@ known_false_positives: There are no known false positives. references: [] drilldown_searches: - name: View the detection results for $user$ and $dest$ - search: '%orginal_detection_search% | search user = $user$ dest = $dest$' + search: '%original_detection_search% | search user = $user$ dest = $dest$' tags: analytic_story: - Apache Struts Vulnerability diff --git a/detections/application/web_servers_executing_suspicious_processes.yml b/detections/application/web_servers_executing_suspicious_processes.yml index 9a7cb81e49..6fce7f0d63 100644 --- a/detections/application/web_servers_executing_suspicious_processes.yml +++ b/detections/application/web_servers_executing_suspicious_processes.yml @@ -35,7 +35,7 @@ known_false_positives: Some of these processes may be used legitimately on web s references: [] drilldown_searches: - name: View the detection results for $user$ and $dest$ - search: '%orginal_detection_search% | search user = $user$ dest = $dest$' + search: '%original_detection_search% | search user = $user$ dest = $dest$' tags: analytic_story: - Apache Struts Vulnerability diff --git a/detections/application/windows_ad_add_self_to_group.yml b/detections/application/windows_ad_add_self_to_group.yml index 0266e509ae..d9af1ed4b3 100644 --- a/detections/application/windows_ad_add_self_to_group.yml +++ b/detections/application/windows_ad_add_self_to_group.yml @@ -22,7 +22,7 @@ known_false_positives: Unknown references: [] drilldown_searches: - name: View the detection results for $user$ - search: '%orginal_detection_search% | search user = $user$' + search: '%original_detection_search% | search user = $user$' tags: analytic_story: - Active Directory Privilege Escalation diff --git a/detections/application/windows_ad_dangerous_deny_acl_modification.yml b/detections/application/windows_ad_dangerous_deny_acl_modification.yml index 828ff554b8..61566b9c75 100644 --- a/detections/application/windows_ad_dangerous_deny_acl_modification.yml +++ b/detections/application/windows_ad_dangerous_deny_acl_modification.yml @@ -47,7 +47,7 @@ references: - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory drilldown_searches: - name: View the detection results for $user$ and $src_user$ - search: '%orginal_detection_search% | search user = $user$ src_user = $src_user$' + search: '%original_detection_search% | search user = $user$ src_user = $src_user$' tags: analytic_story: - Sneaky Active Directory Persistence Tricks diff --git a/detections/application/windows_ad_dangerous_group_acl_modification.yml b/detections/application/windows_ad_dangerous_group_acl_modification.yml index 328f9495ed..02753ab2cd 100644 --- a/detections/application/windows_ad_dangerous_group_acl_modification.yml +++ b/detections/application/windows_ad_dangerous_group_acl_modification.yml @@ -56,7 +56,7 @@ references: - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory drilldown_searches: - name: View the detection results for $user$ and $src_user$ - search: '%orginal_detection_search% | search user = $user$ src_user = $src_user$' + search: '%original_detection_search% | search user = $user$ src_user = $src_user$' tags: analytic_story: - Sneaky Active Directory Persistence Tricks diff --git a/detections/application/windows_ad_dangerous_user_acl_modification.yml b/detections/application/windows_ad_dangerous_user_acl_modification.yml index 239014362b..32d5653515 100644 --- a/detections/application/windows_ad_dangerous_user_acl_modification.yml +++ b/detections/application/windows_ad_dangerous_user_acl_modification.yml @@ -54,7 +54,7 @@ references: - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory drilldown_searches: - name: View the detection results for $user$ and $src_user$ - search: '%orginal_detection_search% | search user = $user$ src_user = $src_user$' + search: '%original_detection_search% | search user = $user$ src_user = $src_user$' tags: analytic_story: - Sneaky Active Directory Persistence Tricks diff --git a/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml b/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml index 7c9483cab6..d2bfc13110 100644 --- a/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml +++ b/detections/application/windows_ad_dcshadow_privileges_acl_addition.yml @@ -50,7 +50,7 @@ references: - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory drilldown_searches: - name: View the detection results for $user$ and $src_user$ - search: '%orginal_detection_search% | search user = $user$ src_user = $src_user$' + search: '%original_detection_search% | search user = $user$ src_user = $src_user$' tags: analytic_story: - Sneaky Active Directory Persistence Tricks diff --git a/detections/application/windows_ad_domain_root_acl_deletion.yml b/detections/application/windows_ad_domain_root_acl_deletion.yml index bb199da51d..c2c3ba3539 100644 --- a/detections/application/windows_ad_domain_root_acl_deletion.yml +++ b/detections/application/windows_ad_domain_root_acl_deletion.yml @@ -47,7 +47,7 @@ references: - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory drilldown_searches: - name: View the detection results for $user$ and $src_user$ - search: '%orginal_detection_search% | search user = $user$ src_user = $src_user$' + search: '%original_detection_search% | search user = $user$ src_user = $src_user$' tags: analytic_story: - Sneaky Active Directory Persistence Tricks diff --git a/detections/application/windows_ad_domain_root_acl_modification.yml b/detections/application/windows_ad_domain_root_acl_modification.yml index 664a9dd119..e7c51045b1 100644 --- a/detections/application/windows_ad_domain_root_acl_modification.yml +++ b/detections/application/windows_ad_domain_root_acl_modification.yml @@ -46,7 +46,7 @@ references: - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory drilldown_searches: - name: View the detection results for $user$ and $src_user$ - search: '%orginal_detection_search% | search user = $user$ src_user = $src_user$' + search: '%original_detection_search% | search user = $user$ src_user = $src_user$' tags: analytic_story: - Sneaky Active Directory Persistence Tricks diff --git a/detections/application/windows_ad_gpo_deleted.yml b/detections/application/windows_ad_gpo_deleted.yml index e91fbf4172..07bd35bef9 100644 --- a/detections/application/windows_ad_gpo_deleted.yml +++ b/detections/application/windows_ad_gpo_deleted.yml @@ -30,7 +30,7 @@ references: - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory drilldown_searches: - name: View the detection results for $src_user$ - search: '%orginal_detection_search% | search src_user = $src_user$' + search: '%original_detection_search% | search src_user = $src_user$' tags: analytic_story: - Sneaky Active Directory Persistence Tricks diff --git a/detections/application/windows_ad_gpo_disabled.yml b/detections/application/windows_ad_gpo_disabled.yml index 9ff48a920c..cac1966b85 100644 --- a/detections/application/windows_ad_gpo_disabled.yml +++ b/detections/application/windows_ad_gpo_disabled.yml @@ -28,7 +28,7 @@ references: - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory drilldown_searches: - name: View the detection results for $src_user$ - search: '%orginal_detection_search% | search src_user = $src_user$' + search: '%original_detection_search% | search src_user = $src_user$' tags: analytic_story: - Sneaky Active Directory Persistence Tricks diff --git a/detections/application/windows_ad_gpo_new_cse_addition.yml b/detections/application/windows_ad_gpo_new_cse_addition.yml index d398f3d7cd..afe9ddff50 100644 --- a/detections/application/windows_ad_gpo_new_cse_addition.yml +++ b/detections/application/windows_ad_gpo_new_cse_addition.yml @@ -39,7 +39,7 @@ references: - https://github.com/FSecureLABS/SharpGPOAbuse drilldown_searches: - name: View the detection results for $src_user$ - search: '%orginal_detection_search% | search src_user = $src_user$' + search: '%original_detection_search% | search src_user = $src_user$' tags: analytic_story: - Sneaky Active Directory Persistence Tricks diff --git a/detections/application/windows_ad_hidden_ou_creation.yml b/detections/application/windows_ad_hidden_ou_creation.yml index cf3ea89d0c..b85587c507 100644 --- a/detections/application/windows_ad_hidden_ou_creation.yml +++ b/detections/application/windows_ad_hidden_ou_creation.yml @@ -47,7 +47,7 @@ references: - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory drilldown_searches: - name: View the detection results for $user$ and $src_user$ - search: '%orginal_detection_search% | search user = $user$ src_user = $src_user$' + search: '%original_detection_search% | search user = $user$ src_user = $src_user$' tags: analytic_story: - Sneaky Active Directory Persistence Tricks diff --git a/detections/application/windows_ad_object_owner_updated.yml b/detections/application/windows_ad_object_owner_updated.yml index cfff50ae40..8212bba33a 100644 --- a/detections/application/windows_ad_object_owner_updated.yml +++ b/detections/application/windows_ad_object_owner_updated.yml @@ -39,7 +39,7 @@ references: - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory drilldown_searches: - name: View the detection results for $user$ and $src_user$ - search: '%orginal_detection_search% | search user = $user$ src_user = $src_user$' + search: '%original_detection_search% | search user = $user$ src_user = $src_user$' tags: analytic_story: - Sneaky Active Directory Persistence Tricks diff --git a/detections/application/windows_ad_privileged_group_modification.yml b/detections/application/windows_ad_privileged_group_modification.yml index d4dd23b4b6..143fa555ca 100644 --- a/detections/application/windows_ad_privileged_group_modification.yml +++ b/detections/application/windows_ad_privileged_group_modification.yml @@ -22,7 +22,7 @@ references: - https://splunkbase.splunk.com/app/6853 drilldown_searches: - name: View the detection results for $user$ - search: '%orginal_detection_search% | search user = $user$' + search: '%original_detection_search% | search user = $user$' tags: analytic_story: - Active Directory Privilege Escalation diff --git a/detections/application/windows_ad_self_dacl_assignment.yml b/detections/application/windows_ad_self_dacl_assignment.yml index 2b0b8a1408..3b16460a02 100644 --- a/detections/application/windows_ad_self_dacl_assignment.yml +++ b/detections/application/windows_ad_self_dacl_assignment.yml @@ -44,7 +44,7 @@ references: - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory drilldown_searches: - name: View the detection results for $src_user$ - search: '%orginal_detection_search% | search src_user = $src_user$' + search: '%original_detection_search% | search src_user = $src_user$' tags: analytic_story: - Sneaky Active Directory Persistence Tricks diff --git a/detections/application/windows_ad_suspicious_attribute_modification.yml b/detections/application/windows_ad_suspicious_attribute_modification.yml index c2f01a7729..93fc4c9f52 100644 --- a/detections/application/windows_ad_suspicious_attribute_modification.yml +++ b/detections/application/windows_ad_suspicious_attribute_modification.yml @@ -34,7 +34,7 @@ references: - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory drilldown_searches: - name: View the detection results for $src_user$ and $dest$ - search: '%orginal_detection_search% | search src_user = $src_user$ dest = $dest$' + search: '%original_detection_search% | search src_user = $src_user$ dest = $dest$' tags: analytic_story: - Sneaky Active Directory Persistence Tricks diff --git a/detections/application/windows_ad_suspicious_gpo_modification.yml b/detections/application/windows_ad_suspicious_gpo_modification.yml index 81f342edbe..c0937e3905 100644 --- a/detections/application/windows_ad_suspicious_gpo_modification.yml +++ b/detections/application/windows_ad_suspicious_gpo_modification.yml @@ -56,7 +56,7 @@ references: - https://lantern.splunk.com/Security/Product_Tips/Enterprise_Security/Enabling_an_audit_trail_from_Active_Directory drilldown_searches: - name: View the detection results for $user$ and $src_user$ - search: '%orginal_detection_search% | search user = $user$ src_user = $src_user$' + search: '%original_detection_search% | search user = $user$ src_user = $src_user$' tags: analytic_story: - Sneaky Active Directory Persistence Tricks diff --git a/detections/application/windows_increase_in_group_or_object_modification_activity.yml b/detections/application/windows_increase_in_group_or_object_modification_activity.yml index 0417a7b781..38e1e97161 100644 --- a/detections/application/windows_increase_in_group_or_object_modification_activity.yml +++ b/detections/application/windows_increase_in_group_or_object_modification_activity.yml @@ -24,7 +24,7 @@ known_false_positives: Unknown references: [] drilldown_searches: - name: View the detection results for $src_user$ - search: '%orginal_detection_search% | search src_user = $src_user$' + search: '%original_detection_search% | search src_user = $src_user$' tags: analytic_story: - Sneaky Active Directory Persistence Tricks diff --git a/detections/application/windows_increase_in_user_modification_activity.yml b/detections/application/windows_increase_in_user_modification_activity.yml index 641ab13457..a8f3d8125b 100644 --- a/detections/application/windows_increase_in_user_modification_activity.yml +++ b/detections/application/windows_increase_in_user_modification_activity.yml @@ -28,7 +28,7 @@ known_false_positives: Genuine activity references: [] drilldown_searches: - name: View the detection results for $src_user$ - search: '%orginal_detection_search% | search src_user = $src_user$' + search: '%original_detection_search% | search src_user = $src_user$' tags: analytic_story: - Sneaky Active Directory Persistence Tricks