admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
TR-159_linux_rootkits
splunk-security_content/detections
T
History
Jose Enrique Hernandez d5e8a824aa Merge branch 'develop' into TR-159_linux_rootkits
2020-10-08 11:07:51 -04:00
..
abnormally_high_aws_instances_launched_by_user___mltk.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
abnormally_high_aws_instances_launched_by_user.yml
risk validation
2020-09-03 11:30:09 -07:00
abnormally_high_aws_instances_terminated_by_user___mltk.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
abnormally_high_aws_instances_terminated_by_user.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
access_lsass_memory_for_dump_creation.yml
new pass condition handling
2020-07-09 14:21:33 +02:00
amazon_eks_kubernetes_cluster_scan_detection.yml
addedmitretechnique
2020-07-09 22:24:16 -04:00
amazon_eks_kubernetes_pod_scan_detection.yml
addedmitretechnique
2020-07-09 22:24:16 -04:00
attempt_to_add_certificate_to_untrusted_store.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
attempt_to_stop_security_service.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
attempted_credential_dump_from_registry_via_reg_exe___ssa.yml
Jud changes
2020-10-06 11:00:59 -07:00
attempted_credential_dump_from_registry_via_reg_exe.yml
fixing a mistake
2020-09-25 16:39:29 -04:00
aws_cloud_provisioning_from_previously_unseen_city.yml
updated spec docs and also added one more example
2020-09-10 12:17:21 -04:00
aws_cloud_provisioning_from_previously_unseen_country.yml
updating mitre id and adding response tasks for securityhub events
2020-06-10 16:12:50 -07:00
aws_cloud_provisioning_from_previously_unseen_ip_address.yml
new generate script
2020-05-06 17:42:38 +02:00
aws_cloud_provisioning_from_previously_unseen_region.yml
updating mitre id and adding response tasks for securityhub events
2020-06-10 16:12:50 -07:00
aws_cross_account_activity_from_previously_unseen_account.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
aws_detect_attach_to_role_policy.yml
addedmitretoawssearches
2020-08-19 21:16:13 -04:00
aws_detect_permanent_key_creation.yml
newfixawsdetectpkey
2020-08-20 16:39:25 -04:00
aws_detect_role_creation.yml
fixedaws_dete_role_creation
2020-08-27 14:12:34 -04:00
aws_detect_sts_assume_role_abuse.yml
Update aws_detect_sts_assume_role_abuse.yml
2020-09-10 13:25:39 -07:00
aws_detect_sts_get_session_token_abuse.yml
addedmitretoawssearches
2020-08-19 21:16:13 -04:00
aws_network_access_control_list_created_with_all_open_ports.yml
new generate script
2020-05-06 17:42:38 +02:00
aws_network_access_control_list_deleted.yml
new generate script
2020-05-06 17:42:38 +02:00
batch_file_write_to_system32.yml
new generate script
2020-05-06 17:42:38 +02:00
child_processes_of_spoolsv_exe.yml
bug in generate
2020-05-14 10:00:55 +02:00
clients_connecting_to_multiple_dns_servers.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
cloud_compute_instance_created_by_previously_unseen_user.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
cloud_compute_instance_created_with_previously_unseen_image.yml
bug in generate
2020-05-14 10:00:55 +02:00
cloud_compute_instance_created_with_previously_unseen_instance_type.yml
bug in generate
2020-05-14 10:00:55 +02:00
cloud_compute_instance_started_in_previously_unused_region.yml
updating mitre id and adding response tasks for securityhub events
2020-06-10 16:12:50 -07:00
common_ransomware_extensions.yml
new generate script
2020-05-06 17:42:38 +02:00
common_ransomware_notes.yml
Updated searches
2020-05-25 11:06:36 +02:00
create_local_admin_accounts_using_net_exe.yml
[TR-038] update mitre id for detection. add test for net exe specific behavior
2020-07-28 11:47:58 -07:00
create_or_delete_windows_shares_using_net_exe.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
create_remote_thread_into_lsass.yml
new pass condition handling
2020-07-09 14:21:33 +02:00
creation_of_shadow_copy_with_wmic_and_powershell.yml
new pass condition handling
2020-07-09 14:21:33 +02:00
creation_of_shadow_copy.yml
new pass condition handling
2020-07-09 14:21:33 +02:00
credential_dumping_via_copy_command_from_shadow_copy.yml
new pass condition handling
2020-07-09 14:21:33 +02:00
credential_dumping_via_symlink_to_shadow_copy.yml
new pass condition handling
2020-07-09 14:21:33 +02:00
deleting_shadow_copies.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
detect_activity_related_to_pass_the_hash_attacks.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
detect_api_activity_from_users_without_mfa.yml
new generate script
2020-05-06 17:42:38 +02:00
detect_arp_poisoning.yml
Updates
2020-08-14 22:59:11 +02:00
detect_attackers_scanning_for_vulnerable_jboss_servers.yml
Updated searches
2020-05-25 11:06:36 +02:00
detect_aws_api_activities_from_unapproved_accounts.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
detect_aws_console_login_by_user_from_new_city.yml
Merge branch 'develop' into security_hub_response
2020-06-24 17:22:16 -07:00
detect_aws_console_login_by_user_from_new_country.yml
Merge branch 'develop' into security_hub_response
2020-06-24 17:22:16 -07:00
detect_aws_console_login_by_user_from_new_region.yml
Merge branch 'develop' into security_hub_response
2020-06-24 17:22:16 -07:00
detect_computer_changed_with_anonymous_account.yml
adding 4742 detection
2020-09-18 18:39:50 -04:00
detect_credential_dumping_through_lsass_access.yml
zero logon skeleton
2020-09-18 17:16:25 -04:00
detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
detect_dump_lsass_memory_using_comsvcs___ssa.yml
formatting
2020-10-06 11:21:36 -07:00
detect_excessive_account_lockouts_from_endpoint.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
detect_excessive_user_account_lockouts.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
detect_f5_tmui_rct_cve_2020_5902.yml
ymls and updates
2020-08-04 14:04:38 -07:00
detect_gcp_storage_access_from_a_new_ip.yml
shannons PR bug fixes
2020-08-19 14:37:01 -07:00
detect_hosts_connecting_to_dynamic_domain_providers.yml
Updated searches
2020-05-25 11:06:36 +02:00
detect_large_outbound_icmp_packets.yml
new generate script
2020-05-06 17:42:38 +02:00
detect_linux_rootkits_using_chkrootkit.yml
fixed up base on validate errors
2020-09-09 23:18:56 -04:00
detect_linux_rootkits_using_falco.yml
fixed up base on validate errors
2020-09-09 23:18:56 -04:00
detect_linux_rootkits_using_rkhunter.yml
fixed up base on validate errors
2020-09-09 23:18:56 -04:00
detect_long_dns_txt_record_response.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
detect_malicious_requests_to_exploit_jboss_servers.yml
Updated searches
2020-05-25 11:06:36 +02:00
detect_mimikatz_using_loaded_images.yml
zero logon skeleton
2020-09-18 17:16:25 -04:00
detect_mimikatz_via_powershell_and_eventcode_4703.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
detect_mshta_exe_running_scripts_in_command_line_arguments.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
detect_new_api_calls_from_user_roles.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
detect_new_local_admin_account.yml
detection tested
2020-07-08 15:09:05 +02:00
detect_new_login_attempts_to_routers.yml
new generate script
2020-05-06 17:42:38 +02:00
detect_new_open_gcp_storage_buckets.yml
shannons PR bug fixes
2020-08-19 14:37:01 -07:00
detect_new_open_s3_buckets.yml
updates with T1530
2020-06-24 17:21:02 -07:00
detect_new_user_aws_console_login___dm.yml
replace a rename with dropping the DM - same effect, better solution
2020-06-16 11:10:34 -06:00
detect_new_user_aws_console_login.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
detect_oulook_exe_writing_a__zip_file.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
detect_outbound_smb_traffic.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
detect_path_interception_by_creation_of_program_exe.yml
converted detections to subtechniques
2020-07-22 10:45:43 +02:00
detect_phishing_content___ssa.yml
formatting
2020-10-06 11:21:36 -07:00
detect_processes_used_for_system_network_configuration_discovery.yml
new generate script
2020-05-06 17:42:38 +02:00
detect_prohibited_applications_spawning_cmd_exe.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
detect_psexec_with_accepteula_flag.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
detect_rare_executables.yml
bug in generate
2020-05-14 10:00:55 +02:00
detect_rogue_dhcp_server.yml
Updates
2020-08-14 22:59:11 +02:00
detect_s3_access_from_a_new_ip.yml
updates with T1530
2020-06-24 17:21:02 -07:00
detect_spike_in_aws_api_activity.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
new detections for security hub alerts
2020-08-06 14:44:50 -07:00
detect_spike_in_blocked_outbound_traffic_from_your_aws.yml
Updated searches
2020-05-25 11:06:36 +02:00
detect_spike_in_network_acl_activity.yml
new generate script
2020-05-06 17:42:38 +02:00
detect_spike_in_s3_bucket_deletion.yml
updates with T1530
2020-06-24 17:21:02 -07:00
detect_spike_in_security_group_activity.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
detect_spike_in_security_hub_alerts_for_user.yml
new detections for security hub alerts
2020-08-06 14:44:50 -07:00
detect_unauthorized_assets_by_mac_address.yml
new generate script
2020-05-06 17:42:38 +02:00
detect_usb_device_insertion.yml
new generate script
2020-05-06 17:42:38 +02:00
detect_use_of_cmd_exe_to_launch_script_interpreters.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
detect_web_traffic_to_dynamic_domain_providers.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
detect_windows_dns_sigred_via_splunk_stream.yml
porting ymls into a newe PR
2020-08-04 12:55:12 -07:00
detect_windows_dns_sigred_via_zeek.yml
porting ymls into a newe PR
2020-08-04 12:55:12 -07:00
detect_zerologon_via_zeek.yml
zero logon skeleton
2020-09-18 17:16:25 -04:00
detection_of_dns_tunnels.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
detection_of_tools_built_by_nirsoft.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
disabling_remote_user_account_control.yml
Updated searches
2020-05-25 11:06:36 +02:00
dns_query_length_outliers___mltk.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
dns_query_length_with_high_standard_deviation.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
dns_query_requests_resolved_by_unauthorized_dns_servers.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
dns_record_changed.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
dump_lsass_via_comsvcs_dll.yml
new pass condition handling
2020-07-09 14:21:33 +02:00
ec2_instance_modified_with_previously_unseen_user.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
ec2_instance_started_in_previously_unseen_region.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
ec2_instance_started_with_previously_unseen_ami.yml
new generate script
2020-05-06 17:42:38 +02:00
ec2_instance_started_with_previously_unseen_instance_type.yml
new generate script
2020-05-06 17:42:38 +02:00
ec2_instance_started_with_previously_unseen_user.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
email_attachments_with_lots_of_spaces.yml
Updated searches
2020-05-25 11:06:36 +02:00
email_files_written_outside_of_the_outlook_directory.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
email_servers_sending_high_volume_traffic_to_hosts.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
excessive_dns_failures.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
execution_of_file_with_multiple_extensions.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
execution_of_file_with_spaces_before_extension.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
extended_period_without_successful_netbackup_backups.yml
new generate script
2020-05-06 17:42:38 +02:00
file_with_samsam_extension.yml
new generate script
2020-05-06 17:42:38 +02:00
first_time_seen_child_process_of_zoom.yml
converted to spec3 and other updates
2020-05-28 13:31:49 -07:00
first_time_seen_cmd_line___ssa.yml
formatting
2020-10-06 11:21:36 -07:00
first_time_seen_command_line_argument.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
first_time_seen_running_windows_service.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
gcp_detect_oauth_token_abuse.yml
yml updates
2020-09-14 13:12:51 -07:00
gcp_gcr_container_uploaded.yml
adding T1525 to mitre
2020-06-10 16:52:19 -07:00
gcp_kubernetes_cluster_pod_scan_detection.yml
Update gcp_kubernetes_cluster_pod_scan_detection.yml
2020-07-20 10:47:18 -07:00
gcp_kubernetes_cluster_scan_detection.yml
addedgcpscansearch
2020-07-10 08:35:59 -04:00
hiding_files_and_directories_with_attrib_exe.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
hosts_receiving_high_volume_of_network_traffic_from_email_server.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
identify_new_user_accounts.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
kerberoasting_spn_request_with_rc4_encryption.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
kubernetes_aws_detect_most_active_service_accounts_by_pod.yml
fixing errors for validate
2020-06-24 11:06:22 -07:00
kubernetes_aws_detect_rbac_authorizations_by_account.yml
more renames base on upper case
2020-06-29 17:39:38 -04:00
kubernetes_aws_detect_sensitive_object_access.yml
fixing errors for validate
2020-06-24 11:06:22 -07:00
kubernetes_aws_detect_sensitive_role_access.yml
fixing errors for validate
2020-06-24 11:06:22 -07:00
kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml
fixedsrcuserfromtable
2020-08-20 12:02:44 -04:00
kubernetes_aws_detect_suspicious_kubectl_calls.yml
fixing errors for validate
2020-06-24 11:06:22 -07:00
kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml
Merge branch 'develop' into awsgcpk8s
2020-06-25 13:26:56 -07:00
kubernetes_azure_detect_rbac_authorization_by_account.yml
updating files to make sure validate passes
2020-06-03 13:10:30 -07:00
kubernetes_azure_detect_sensitive_object_access.yml
Merge branch 'develop' into awsgcpk8s
2020-06-25 13:26:56 -07:00
kubernetes_azure_detect_sensitive_role_access.yml
updating files to make sure validate passes
2020-06-03 13:10:30 -07:00
kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml
updating files to make sure validate passes
2020-06-03 13:10:30 -07:00
kubernetes_azure_detect_suspicious_kubectl_calls.yml
fixing errors for validate
2020-06-24 11:06:22 -07:00
kubernetes_azure_pod_scan_fingerprint.yml
updating files to make sure validate passes
2020-06-03 13:10:30 -07:00
kubernetes_azure_scan_fingerprint.yml
Merge branch 'develop' into T1526detections
2020-07-09 22:55:00 -04:00
kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml
Update kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml
2020-07-13 16:12:47 -07:00
kubernetes_gcp_detect_RBAC_authorizations_by_account.yml
rename file
2020-07-13 16:30:28 -07:00
kubernetes_gcp_detect_sensitive_object_access.yml
fixbackticks
2020-07-13 19:01:57 -04:00
kubernetes_gcp_detect_sensitive_role_access.yml
fixbackticks
2020-07-13 19:01:57 -04:00
kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml
fixbackticks
2020-07-13 19:01:57 -04:00
kubernetes_gcp_detect_suspicious_kubectl_calls.yml
adding ffilter, sigh
2020-07-13 17:05:30 -07:00
large_volume_of_dns_any_queries.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
macos___re_opened_applications.yml
new generate script
2020-05-06 17:42:38 +02:00
malicious_powershell_process___connect_to_internet_with_hidden_window.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
malicious_powershell_process___encoded_command.yml
detection tested
2020-07-28 15:43:57 +02:00
malicious_powershell_process___execution_policy_bypass.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
malicious_powershell_process___multiple_suspicious_command_line_arguments.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
malicious_powershell_process_with_obfuscation_techniques.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
monitor_dns_for_brand_abuse.yml
new generate script
2020-05-06 17:42:38 +02:00
monitor_email_for_brand_abuse.yml
Updated searches
2020-05-25 11:06:36 +02:00
monitor_registry_keys_for_print_monitors.yml
bug in generate
2020-05-14 10:00:55 +02:00
monitor_web_traffic_for_brand_abuse.yml
new generate script
2020-05-06 17:42:38 +02:00
multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
new_container_uploaded_to_aws_ecr.yml
adding T1525 to mitre
2020-06-10 16:52:19 -07:00
no_windows_updates_in_a_time_frame.yml
new generate script
2020-05-06 17:42:38 +02:00
okta_account_lockout_events.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
okta_failed_sso_attempts.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
okta_user_logins_from_multiple_cities.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
open_redirect_in_splunk_web.yml
new generate script
2020-05-06 17:42:38 +02:00
osquery_pack___coldroot_detection.yml
new generate script
2020-05-06 17:42:38 +02:00
overwriting_accessibility_binaries.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
process_execution_via_wmi.yml
bug in generate
2020-05-14 10:00:55 +02:00
processes_created_by_netsh.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
processes_launching_netsh.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
processes_tapping_keyboard_events.yml
new generate script
2020-05-06 17:42:38 +02:00
prohibited_apps_spawning_cmdprompt___ssa.yml
formatting
2020-10-06 11:21:36 -07:00
prohibited_network_traffic_allowed.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
prohibited_software_on_endpoint.yml
Updated searches
2020-05-25 11:06:36 +02:00
protocol_or_port_mismatch.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
protocols_passing_authentication_in_cleartext.yml
new generate script
2020-05-06 17:42:38 +02:00
rare_parent_process_relationship_lolbas___ssa.yaml
formatting
2020-10-06 11:21:36 -07:00
reg_exe_manipulating_windows_services_registry_keys.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
reg_exe_used_to_hide_files_directories_via_registry_keys.yml
Updated searches
2020-05-25 11:06:36 +02:00
registry_keys_for_creating_shim_databases.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
registry_keys_used_for_persistence.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
registry_keys_used_for_privilege_escalation.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
remote_desktop_network_bruteforce.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
remote_desktop_network_traffic.yml
updated detection
2020-07-07 15:45:59 +02:00
remote_desktop_process_running_on_system.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
remote_process_instantiation_via_wmi.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
remote_registry_key_modifications.yml
Updated searches
2020-05-25 11:06:36 +02:00
remote_wmi_command_attempt.yml
new generate script
2020-05-06 17:42:38 +02:00
rundll_loading_dll_by_ordinal.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
samsam_test_file_write.yml
new generate script
2020-05-06 17:42:38 +02:00
sc_exe_manipulating_windows_services.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
scheduled_task_name_used_by_dragonfly_threat_actors.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
scheduled_tasks_used_in_badrabbit_ransomware.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
schtasks_scheduling_job_on_remote_system.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
schtasks_used_for_forcing_a_reboot.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
script_execution_via_wmi.yml
bug in generate
2020-05-14 10:00:55 +02:00
shim_database_file_creation.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
shim_database_installation_with_suspicious_parameters.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
short_lived_windows_accounts.yml
tetsing detection
2020-07-06 17:03:00 +02:00
single_letter_process_on_endpoint.yml
new generate script
2020-05-06 17:42:38 +02:00
smb_traffic_spike___mltk.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
smb_traffic_spike.yml
Update smb_traffic_spike.yml
2020-07-24 12:32:22 -04:00
spectre_and_meltdown_vulnerable_systems.yml
Removed data model module name from output
2020-07-09 11:42:51 -05:00
spike_in_file_writes.yml
bug in generate
2020-05-14 10:00:55 +02:00
splunk_enterprise_information_disclosure.yml
new generate script
2020-05-06 17:42:38 +02:00
sql_injection_with_long_urls.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
suspicious_changes_to_file_associations.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
suspicious_email___uba_anomaly.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
suspicious_email_attachment_extensions.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
suspicious_file_write.yml
new generate script
2020-05-06 17:42:38 +02:00
suspicious_java_classes.yml
new generate script
2020-05-06 17:42:38 +02:00
suspicious_lnk_file_launching_a_process.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
suspicious_reg_exe_process.yml
successful tested
2020-07-28 11:14:34 +02:00
suspicious_wevtutil_usage.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
suspicious_writes_to_system_volume_information.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
suspicious_writes_to_windows_recycle_bin.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
system_process_running_unexpected_location___ssa.yml
merging Jud changes
2020-10-06 11:05:10 -07:00
system_processes_run_from_unexpected_locations.yml
Updated searches
2020-05-25 11:06:36 +02:00
tor_traffic.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
uncommon_processes_on_endpoint.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
unload_sysmon_filter_driver.yml
tested detection
2020-07-28 14:17:10 +02:00
unsigned_image_loaded_by_lsass.yml
new pass condition handling
2020-07-09 14:21:33 +02:00
unsuccessful_netbackup_backups.yml
new generate script
2020-05-06 17:42:38 +02:00
unusual_lolbas_in_short_period_of_time___ssa.yml
merging Jud changes
2020-10-06 11:05:10 -07:00
unusually_long_command_line___mltk.yml
Updated searches
2020-05-25 11:06:36 +02:00
unusually_long_command_line___ssa.yml
update date key
2020-10-06 13:47:24 -07:00
unusually_long_command_line.yml
Updated searches
2020-05-25 11:06:36 +02:00
unusually_long_content_type_length.yml
new generate script
2020-05-06 17:42:38 +02:00
usn_journal_deletion.yml
new generate script
2020-05-06 17:42:38 +02:00
web_fraud___account_harvesting.yml
Updated searches
2020-05-25 11:06:36 +02:00
web_fraud___anomalous_user_clickspeed.yml
new generate script
2020-05-06 17:42:38 +02:00
web_fraud___password_sharing_across_accounts.yml
new generate script
2020-05-06 17:42:38 +02:00
web_servers_executing_suspicious_processes.yml
new generate script
2020-05-06 17:42:38 +02:00
windows_event_log_cleared.yml
converted detections to subtechniques
2020-07-22 10:59:55 +02:00
windows_hosts_file_modification.yml
new generate script
2020-05-06 17:42:38 +02:00
wmi_permanent_event_subscription___sysmon.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
wmi_permanent_event_subscription.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00
wmi_temporary_event_subscription.yml
converted detections to subtechniques
2020-07-22 10:34:54 +02:00