admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
BlackSuit-Ransomware
splunk-security_content/detections/application
T
History
research-bot 37dd520eea updating join
2024-08-26 11:26:03 +05:30
..
crushftp_server_side_template_injection.yml
improved data source field
2024-07-16 14:06:31 +02:00
detect_distributed_password_spray_attempts.yml
Release v4.36.0 - Draft release branch (Manual)
2024-07-17 18:03:56 +00:00
detect_new_login_attempts_to_routers.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
detect_password_spray_attempts.yml
Release v4.36.0 - Draft release branch (Manual)
2024-07-17 18:03:56 +00:00
email_attachments_with_lots_of_spaces.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
email_files_written_outside_of_the_outlook_directory.yml
Improved data sources
2024-07-17 14:41:50 +02:00
email_servers_sending_high_volume_traffic_to_hosts.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
ivanti_vtm_new_account_creation.yml
updating data source
2024-08-22 21:49:40 +05:30
monitor_email_for_brand_abuse.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
no_windows_updates_in_a_time_frame.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
okta_authentication_failed_during_mfa_challenge.yml
improved data source field
2024-07-16 14:06:31 +02:00
okta_idp_lifecycle_modifications.yml
improved data source field
2024-07-16 14:06:31 +02:00
okta_mfa_exhaustion_hunt.yml
improved data source field
2024-07-16 14:06:31 +02:00
okta_mismatch_between_source_and_response_for_verify_push_request.yml
improved data source field
2024-07-16 14:06:31 +02:00
okta_multi_factor_authentication_disabled.yml
improved data source field
2024-07-16 14:06:31 +02:00
okta_multiple_accounts_locked_out.yml
improved data source field
2024-07-16 14:06:31 +02:00
okta_multiple_failed_mfa_requests_for_user.yml
improved data source field
2024-07-16 14:06:31 +02:00
okta_multiple_failed_requests_to_access_applications.yml
improved data source field
2024-07-16 14:06:31 +02:00
okta_multiple_users_failing_to_authenticate_from_ip.yml
improved data source field
2024-07-16 14:06:31 +02:00
okta_new_api_token_created.yml
improved data source field
2024-07-16 14:06:31 +02:00
okta_new_device_enrolled_on_account.yml
improved data source field
2024-07-16 14:06:31 +02:00
okta_phishing_detection_with_fastpass_origin_check.yml
improved data source field
2024-07-16 14:06:31 +02:00
okta_risk_threshold_exceeded.yml
improved data source field
2024-07-16 14:06:31 +02:00
okta_successful_single_factor_authentication.yml
improved data source field
2024-07-16 14:06:31 +02:00
okta_suspicious_activity_reported.yml
improved data source field
2024-07-16 14:06:31 +02:00
okta_suspicious_use_of_a_session_cookie.yml
improved data source field
2024-07-16 14:06:31 +02:00
okta_threatinsight_threat_detected.yml
improved data source field
2024-07-16 14:06:31 +02:00
okta_unauthorized_access_to_application.yml
improved data source field
2024-07-16 14:06:31 +02:00
okta_user_logins_from_multiple_cities.yml
improved data source field
2024-07-16 14:06:31 +02:00
pingid_mismatch_auth_source_and_verification_response.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
pingid_multiple_failed_mfa_requests_for_user.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
pingid_new_mfa_method_after_credential_reset.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
pingid_new_mfa_method_registered_for_user.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
suspicious_email_attachment_extensions.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
suspicious_java_classes.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
web_servers_executing_suspicious_processes.yml
Improved data sources
2024-07-17 14:41:50 +02:00
windows_ad_add_self_to_group.yml
Release v4.36.0 - Draft release branch (Manual)
2024-07-17 18:03:56 +00:00
windows_ad_dangerous_deny_acl_modification.yml
updating detections
2024-08-08 15:48:37 +10:00
windows_ad_dangerous_group_acl_modification.yml
updating detections
2024-08-08 15:48:37 +10:00
windows_ad_dangerous_user_acl_modification.yml
updating detections
2024-08-08 15:48:37 +10:00
windows_ad_dcshadow_privileges_acl_addition.yml
updating detections
2024-08-08 15:48:37 +10:00
windows_ad_domain_root_acl_deletion.yml
updating detections
2024-08-08 15:48:37 +10:00
windows_ad_domain_root_acl_modification.yml
updating detections
2024-08-08 15:48:37 +10:00
windows_ad_gpo_deleted.yml
updating detections
2024-08-08 15:48:37 +10:00
windows_ad_gpo_disabled.yml
updating join
2024-08-26 11:26:03 +05:30
windows_ad_gpo_new_cse_addition.yml
updating observables
2024-08-19 13:53:39 +05:30
windows_ad_hidden_ou_creation.yml
updating detections
2024-08-08 15:48:37 +10:00
windows_ad_object_owner_updated.yml
updating detections
2024-08-08 15:48:37 +10:00
windows_ad_privileged_group_modification.yml
updating detections
2024-07-02 13:00:04 +10:00
windows_ad_self_dacl_assignment.yml
updating detections
2024-08-08 15:48:37 +10:00
windows_ad_suspicious_attribute_modification.yml
updating observables
2024-08-19 13:53:39 +05:30
windows_ad_suspicious_gpo_modification.yml
updating detections
2024-08-08 15:48:37 +10:00
windows_increase_in_group_or_object_modification_activity.yml
Release v4.36.0 - Draft release branch (Manual)
2024-07-17 18:03:56 +00:00
windows_increase_in_user_modification_activity.yml
Release v4.36.0 - Draft release branch (Manual)
2024-07-17 18:03:56 +00:00