admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update detect_dga_domains_using_pretrained_model_in_dsdl.yml

Browse Source
This commit is contained in:
Bhavin Patel
2022-09-29 13:09:04 -07:00
committed by GitHub
parent 8c527b79e3
commit de34ea116f
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/experimental/network/detect_dga_domains_using_pretrained_model_in_dsdl.yml
+3 -3
View File
@@ -32,7 +32,7 @@ tags:
- Suspicious DNS Traffic
- Dynamic DNS
- Command and Control
asset_type: Web Server
asset_type: Endpoint
cis20:
- CIS 8
- CIS 12
@@ -44,7 +44,7 @@ tags:
impact: 70
kill_chain_phases:
- Command & Control
message: A potentially a DGA domain $domain$ was detected from host $src$, kindly review.
message: A potential connection to a DGA domain $domain$ was detected from host $src$, kindly review.
mitre_attack_id:
- T1568.002
nist:
@@ -54,7 +54,7 @@ tags:
- DE.CM
observable:
- name: domain
type: Other
type: URL Domain
role:
- Attacker
- name: src