splunk-security_content

detect_new_login_attempts_to_routers.yml

…

detect_risky_spl_using_pretrained_ml_model.yml

…

email_attachments_with_lots_of_spaces.yml

…

email_files_written_outside_of_the_outlook_directory.yml

…

email_servers_sending_high_volume_traffic_to_hosts.yml

…

monitor_email_for_brand_abuse.yml

…

multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml

…

no_windows_updates_in_a_time_frame.yml

…

okta_account_locked_out.yml

…

okta_account_lockout_events.yml

…

okta_failed_sso_attempts.yml

…

okta_mfa_exhaustion_hunt.yml

observable fix for cloud

2023-07-28 11:46:28 -05:00

okta_mismatch_between_source_and_response_for_verify_push_request.yml

…

okta_multiple_failed_requests_to_access_applications.yml

…

okta_new_api_token_created.yml

…

okta_new_device_enrolled_on_account.yml

…

okta_phishing_detection_with_fastpass_origin_check.yml

…

okta_risk_threshold_exceeded.yml

o365_obs_fix

2023-09-22 15:01:21 -07:00

okta_suspicious_activity_reported.yml

…

okta_suspicious_use_of_a_session_cookie.yml

…

okta_threatinsight_login_failure_with_high_unknown_users.yml

…

okta_threatinsight_suspected_passwordspray_attack.yml

…

okta_threatinsight_threat_detected.yml

…

okta_two_or_more_rejected_okta_pushes.yml

observable fix for cloud

2023-07-28 11:46:28 -05:00

okta_user_logins_from_multiple_cities.yml

…

path_traversal_spl_injection.yml

…

pingid_mismatch_auth_source_and_verification_response.yml

Release v4.18.0

2023-12-20 16:18:23 +00:00

pingid_multiple_failed_mfa_requests_for_user.yml

Release v4.18.0

2023-12-20 16:18:23 +00:00

pingid_new_mfa_method_after_credential_reset.yml

Release v4.18.0

2023-12-20 16:18:23 +00:00

pingid_new_mfa_method_registered_for_user.yml

Release v4.18.0

2023-12-20 16:18:23 +00:00

splunk_absolute_path_traversal_using_runshellscript.yml

Fixed a handful of issues with observables and messages and spacing in content.

2023-10-23 19:49:17 +00:00

splunk_account_discovery_drilldown_dashboard_disclosure.yml

…

splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml

Push new search to address SVD updates

2023-11-22 22:11:06 +00:00

splunk_code_injection_via_custom_dashboard_leading_to_rce.yml

…

splunk_command_and_scripting_interpreter_delete_usage.yml

…

splunk_command_and_scripting_interpreter_risky_commands.yml

…

splunk_command_and_scripting_interpreter_risky_spl_mltk.yml

…

splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml

o365_obs_fix

2023-09-22 15:01:21 -07:00

splunk_data_exfiltration_from_analytics_workspace_using_sid_query.yml

…

splunk_digital_certificates_infrastructure_version.yml

…

splunk_digital_certificates_lack_of_encryption.yml

…

splunk_dos_using_malformed_saml_request.yml

Delete detection and migrate

2023-09-28 14:51:28 -07:00

splunk_dos_via_dump_spl_command.yml

…

splunk_dos_via_malformed_s2s_request.yml

…

splunk_dos_via_printf_search_function.yml

Final changes in prep for release. Datasets uploaded to attack range

2023-08-30 08:09:15 -07:00

splunk_edit_user_privilege_escalation.yml

adding CVE

2023-09-11 17:13:40 -07:00

splunk_endpoint_denial_of_service_dos_zip_bomb.yml

…

splunk_enterprise_kv_store_incorrect_authorization.yml

Release v4.21.0

2024-01-22 22:40:14 +00:00

splunk_enterprise_windows_deserialization_file_partition.yml

Release v4.21.0

2024-01-22 22:40:14 +00:00

splunk_es_dos_investigations_manager_via_investigation_creation.yml

Release 4.19.0

2024-01-10 17:21:34 +00:00

splunk_es_dos_through_investigation_attachments.yml

Release 4.19.0

2024-01-10 17:21:34 +00:00

splunk_http_response_splitting_via_rest_spl_command.yml

improve specificity

2023-06-08 13:16:51 -07:00

splunk_improperly_formatted_parameter_crashes_splunkd.yml

…

splunk_information_disclosure_in_splunk_add_on_builder.yml

Release Branch ESCU 4.23.0

2024-01-30 20:52:05 +00:00

splunk_list_all_nonstandard_admin_accounts.yml

…

splunk_low_privilege_user_can_view_hashed_splunk_password.yml

…

splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml

…

splunk_persistent_xss_in_rapiddiag_through_user_interface_views.yml

observable fix for cloud

2023-07-28 11:46:28 -05:00

splunk_persistent_xss_via_url_validation_bypass_w_dashboard.yml

…

splunk_process_injection_forwarder_bundle_downloads.yml

…

splunk_protocol_impersonation_weak_encryption_configuration.yml

…

splunk_protocol_impersonation_weak_encryption_selfsigned.yml

observable fix for cloud

2023-07-28 11:46:28 -05:00

splunk_protocol_impersonation_weak_encryption_simplerequest.yml

observable fix for cloud

2023-07-28 11:46:28 -05:00

splunk_rbac_bypass_on_indexing_preview_rest_endpoint.yml

…

splunk_rce_via_serialized_session_payload.yml

remove source= from search

2023-10-02 11:54:06 -07:00

splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.yml

…

splunk_rce_via_user_xslt.yml

Push new search to address SVD updates

2023-11-22 22:11:06 +00:00

splunk_reflected_xss_in_the_templates_lists_radio.yml

…

splunk_reflected_xss_on_app_search_table_endpoint.yml

Delete detection and migrate

2023-09-28 14:51:28 -07:00

splunk_risky_command_abuse_disclosed_february_2023.yml

Release v4.21.0

2024-01-22 22:40:14 +00:00

splunk_stored_xss_via_data_model_objectname_field.yml

…

splunk_unauthenticated_log_injection_web_service_log.yml

Update splunk_unauthenticated_log_injection_web_service_log.yml

2023-07-31 09:02:03 -07:00

splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml

Release v4.24.0

2024-02-14 23:54:00 +00:00

splunk_user_enumeration_attempt.yml

…

splunk_xss_in_highlighted_json_events.yml

Release branch v4.16.0

2023-11-16 20:33:10 +00:00

splunk_xss_in_monitoring_console.yml

…

splunk_xss_in_save_table_dialog_header_in_search_page.yml

…

splunk_xss_via_view.yml

Add missing tests to detections.

2023-07-31 16:27:16 -07:00

suspicious_email_attachment_extensions.yml

updated with proper format

2023-10-13 13:32:37 -07:00

suspicious_java_classes.yml

…

web_servers_executing_suspicious_processes.yml

updated with proper format

2023-10-13 13:32:37 -07:00