admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
28,119 Commits 697 Branches 195 Tags
push_security
Commit Graph

432 Commits

Author SHA1 Message Date
Bhavin Patel 9335358685 Merge branch 'develop' into push_security 2026-04-30 17:05:37 +05:30
Bhavin Patel becdb58b9f Add Secure Access Firewall Detections (#3986) 
---------

Co-authored-by: Lou Stella <ljstella@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-04-29 20:41:09 +02:00
Bhavin Patel 3c9904cac4 adding 1st detection and files 2026-04-28 10:35:06 +05:30
Nasreddine Bencherchali ea5bd52238 Fix Issues - 2nd Round (#3996) 
* Fix #3993

* Fix incorrect DS entries

* fix security_domain issue

* Fix #3992

* Fix #3988

* Update dump_lsass_via_procdump.yml

* Fix #3987

* Fix #3977

* Update network_connection_discovery_with_arp.yml

* Fix #3998

* Fix #3997

* fix versions

* revert change

* Fix #4012

* Update linux_file_creation_in_init_boot_directory.yml

* Update linux_file_creation_in_init_boot_directory.yml

* Fix #4010 and related

* fix typo

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-04-16 05:24:43 +00:00
Nasreddine Bencherchali ed5884f607 More SD-WAN Content (#3944) 
* add more sd-wan content

* rename macro

* Update cisco_sd_wan_service_proxy_access.yml

* fix parsing

* Update cisco_sd_wan___arbitrary_file_overwrite_exploitation_activity.yml

* apply review suggestions
 2026-03-12 18:16:41 +05:30
Nasreddine Bencherchali f930b525ee Add New Analytics - February Batch (#3886) 
* add percent encoded curl exec

* Fix #3916

* Add other calc process names entries

* apply formatting

* add more color

* add cisco sd-wan stuff

* update tags

* Update cisco_sd_wan___low_frequency_rogue_peer.yml

* add ds and maps it

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-03-03 18:31:37 +05:30
pyth0n1c 34be5c0b0c normalize all legacy line endings (#3931) 2026-03-02 23:34:35 +01:00
Rod Soto 02573684ce Add New MCP Related Detections (#3895) 
---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Bhavin Patel <bpatel@splunk.com>
 2026-02-17 23:39:01 +01:00
Bhavin Patel 6d1b940663 Cisco Isovalent - Add first batch of new detections (#3706) 
---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-01-06 01:24:39 +01:00
Nasreddine Bencherchali 7fe10bbef8 Move Unused Macros to Deprecate Sub-Folder (#3847) 2025-12-22 14:01:09 +01:00
Nasreddine Bencherchali 976c62383e Update Macro Usage (#3840) 
* update macro usage

* bump version

* Update detect_hosts_connecting_to_dynamic_domain_providers.yml

* more macro updates
 2025-12-18 21:42:06 +05:30
Br3akp0int 888c2249e8 netsupport (#3798) 
* netsupport

* netsupport

* netsupport

* netsupport

* Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update data_sources/sysmon_eventid_29.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update data_sources/sysmon_eventid_29.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/endpoint/windows_executable_masquerading_as_benign_file_types.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* netsupport

* netsupport

* netsupport

* netsupport

* updates

* small fixes

---------

Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2025-11-21 13:27:52 -08:00
Nasreddine Bencherchali 9fc8942993 New Rules & Updates - Oct 25 (#3726) 
* new rules and updates

* fix issues with ci

* rename for accurate macro

* update description and logic

* new wbadmin rule and fix pwsh dataset

* more updates for the weekend

* update network rules filters

* downgrade versions

* Update windows_file_transfer_protocol_in_non_common_process_path.yml

* add missing DS for some rules

* update nirsoft lookup and add new rules

* update more nirsoft stuff

* update snort message

* Update cisco_secure_firewall_filetype_lookup.yml

* new analytic and updates / incl. fix #3730

* Update detect_new_local_admin_account.yml

* add lnx dataset and fix wildcards
 2025-10-24 14:19:48 -07:00
Rod Soto 0bcb54b6f9 Ollama TA detections (#3710) 
* commit1oll

* olldet2

* olldet3

* fixeddet3

* fixsp

* olldet4

* olldet5

* detoll6

* olldet7

* olldet8

* datasets

* testfixes

* modifiedtasearch

* lotsofixes

* fixednewta

* addedmorerefs

* fixedatasource

* fixedthreatobject

* fixedetectionandalertmessage

* fixedalermessage

* fixedquotes

* fixedhowtoimp

* fixeddescriptionandhowto

* changedestforuripat

* fixedowasplink

* Update detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/application/ollama_possible_rce_via_model_loading.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* protoexnassuggestions

* mionr

* remove index=*

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Bhavin Patel <bpatel@splunk.com>
 2025-10-13 21:54:37 +02:00
Rod Soto 6cf5b0f8f6 Copilot based Detections (#3693) 
* det1

* fixeddt1

* det2

* d3

* det4

* djbk

* d6

* d7

* d8

* addedlnkds

* fixsctype

* pipegone

* fixp

* fixdevices

* jbfix

* datasetfix

* exp

* fixsynthax

* changedstory

* changeprinus

* improvedht

* changedSenderuser

* datas

* fixdoublesearch

* fixedpi

* fixeddescriptionsuser

* fixdatalink

* exportedlogsdatasource

* fixedhowtodatasource

* updating risk stuff

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Bhavin Patel <bpatel@splunk.com>
 2025-10-13 12:14:09 -07:00
Bhavin Patel fd9394687e move to public 2025-09-25 13:05:25 -07:00
Michael Haag 1f709a9d67 The Lost Payload: MSIX Resurrection 
"They thought it was just a package."
 2025-08-18 11:46:34 -06:00
Bhavin Patel 716592ff40 updating spl 2025-08-04 14:48:58 -05:00
Bhavin Patel 75b307f0f8 updating def 2025-08-04 14:47:09 -05:00
Bhavin Patel 8a8e24ff29 adding macro 2025-08-04 14:45:49 -05:00
Bhavin Patel efc331be05 Merge branch 'develop' into duo_detections_1 2025-07-18 13:50:53 -07:00
Raven Tait a71c6fb38a Initial batch of ESXi content 
Initial batch of ESXi content
 2025-07-11 11:59:37 -04:00
Patrick Bareiss 7da4b85353 add macros 2025-07-10 15:45:40 +02:00
Nasreddine Bencherchali 75ec47e99a add new detections, story and other cool things 2025-07-01 23:04:48 +02:00
ljstella ff624b020a change to supported sourcetype 2025-06-17 09:08:10 -05:00
Raven Tait 25617e6770 Initial remote employment fraud detections. 2025-06-12 14:43:59 -04:00
Nasreddine Bencherchali d2337f07c8 Update cisco_secure_firewall_inside_to_outside.yml 2025-04-03 14:28:58 +02:00
Nasreddine Bencherchali c156e2bb8d update macro name 2025-04-03 14:26:51 +02:00
Nasreddine Bencherchali f39a6d9a50 cisco secure firewall detections - first batch 2025-04-03 14:21:27 +02:00
Patrick Bareiss 641c590df7 Merge branch 'develop' into output_normalization_endpoint 2025-03-19 15:10:33 +01:00
Bhavin Patel 77dfe52b89 Update macro 2025-03-17 16:44:09 -07:00
Patrick Bareiss 67dff5120a Merge branch 'develop' into output_normalization_endpoint 2025-03-13 09:22:06 +01:00
Steven Dick 2445b44357 Update o365_suspect_search_terms_regex.yml 
removing regex using $ because ContentCTL is being dumb and thinks it's a variable.
 2025-03-12 07:32:14 -04:00
Bhavin Patel 60ba75f2a8 Merge branch 'develop' into nterl0k-T1552-sus-o365-searches 2025-03-11 13:25:48 -07:00
Patrick Bareiss ee813d6b39 output normalisation 2025-03-05 14:25:32 +01:00
Bhavin Patel 6033082600 Merge branch 'develop' into haagsqldb 2025-03-04 10:12:52 -08:00
Bhavin Patel cf52e66778 Merge branch 'develop' into nterl0k-t1114-sus-o365-email-actions 2025-02-28 11:52:31 -08:00
Steven Dick a500515a33 Add files via upload 2025-02-27 10:52:01 -05:00
Bhavin Patel 52ad8c4ebb Merge branch 'develop' into auditd_detection_updates 2025-02-26 12:09:47 -08:00
Michael Haag 31937902ee Merge branch 'develop' into haagsqldb 2025-02-21 08:41:11 -07:00
Nasreddine Bencherchali 6869ca91e6 Merge branch 'develop' into auditd_detection_updates 2025-02-21 11:02:45 +01:00
Patrick Bareiss 77cbb835ce Merge branch 'develop' into github_detections_improvement 2025-02-21 09:37:10 +01:00
Patrick Bareiss 41e69bd182 Merge branch 'develop' into github_detections_improvement 2025-02-21 09:24:24 +01:00
Bhavin Patel 49fa1c1900 Merge branch 'develop' into cisco_ai_defense 2025-02-20 15:02:29 -08:00
Teoderick Contreras 7f09aa976d auditd_detection_updates 2025-02-20 13:36:03 +01:00
pyth0n1c f9ab1d168d Merge branch 'develop' into nterl0k-t1114-sus-o365-email-actions 2025-02-19 12:15:02 -08:00
Nasreddine Bencherchali 7df0472037 update exchange macro 2025-02-19 21:11:52 +01:00
Nasreddine Bencherchali ba36467ece feat: add new analytic story and analytic 2025-02-19 11:22:18 +01:00
Nasreddine Bencherchali c16e7a1a74 feat: add auditpol macro 2025-02-19 11:22:18 +01:00
Bhavin Patel f8fc280263 Merge branch 'develop' into nterl0k-t1114-sus-o365-email-actions 2025-02-18 17:44:35 -08:00