admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
DockerDetectionUpdatesAndFixes
splunk-security_content/dist/ssa/detections
T
History
d1vious b9b6912d97 adding eventid from customer convo
2021-12-06 14:42:14 -05:00
..
ssa___anomalous_usage_of_archive_tools.yml
adding eventid from customer convo
2021-12-06 14:42:14 -05:00
ssa___applying_stolen_credentials_via_mimikatz_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___applying_stolen_credentials_via_powersploit_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___assessment_of_credential_strength_via_dsinternals_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___attempt_to_delete_services.yml
adding eventid from customer convo
2021-12-06 14:42:14 -05:00
ssa___attempt_to_disable_services.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___credential_extraction_indicative_of_lazagne_command_line_options.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___credential_extraction_indicative_of_use_of_dsinternals_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___credential_extraction_indicative_of_use_of_mimikatz_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___credential_extraction_indicative_of_use_of_powersploit_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___delete_a_net_user.yml
adding eventid from customer convo
2021-12-06 14:42:14 -05:00
ssa___deny_permission_using_cacls_utility.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___detect_dump_lsass_memory_using_comsvcs.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___detect_kerberoasting.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___detect_pass_the_hash.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___detect_prohibited_applications_spawning_cmd_exe.yml
adding eventid from customer convo
2021-12-06 14:42:14 -05:00
ssa___disable_net_user_account.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___first_time_seen_command_line_argument.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___grant_permission_using_cacls_utility.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___illegal_access_to_user_content_via_powersploit_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___illegal_account_creation_via_powersploit_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___illegal_deletion_of_logs_via_mimikatz_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___illegal_service_and_process_control_via_powersploit_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___modify_acls_permission_of_files_or_folders.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___more_than_usual_number_of_lolbas_applications_in_short_time_period.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___phishing_email_detection_by_machine_learning_method_-_ssa.yml
added logic to include test file in the detections, also renamed the files to have prefixed ssa____ on name
2021-11-24 16:26:17 -05:00
ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml
adding eventid from customer convo
2021-12-06 14:42:14 -05:00
ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml
adding eventid from customer convo
2021-12-06 14:42:14 -05:00
ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___rare_parent-child_process_relationship.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___reconnaissance_and_access_to_computers_via_mimikatz_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___reconnaissance_of_connectivity_via_powersploit_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___reconnaissance_of_defensive_tools_via_powersploit_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___resize_shadowstorage_volume.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___sdelete_application_execution.yml
adding eventid from customer convo
2021-12-06 14:42:14 -05:00
ssa___setting_credentials_via_dsinternals_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___setting_credentials_via_mimikatz_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___setting_credentials_via_powersploit_modules.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___system_process_running_from_unexpected_location.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___unusually_long_command_line.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___wevtutil_usage_to_clear_logs.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00
ssa___wevtutil_usage_to_disable_logs.yml
Merge branch 'develop' into TR-880_fixing_ssa_package
2021-12-06 13:12:12 -05:00