splunk-security_content

3cx_supply_chain_attack_network_indicators.yml

add drilldowns to production analytics

2025-06-10 16:26:40 +02:00

cisco_configuration_archive_logging_analysis.yml

Update attack_data links

2025-09-09 08:35:57 -04:00

cisco_ios_suspicious_privileged_account_creation.yml

Update attack_data links

2025-09-09 08:35:57 -04:00

cisco_network_interface_modifications.yml

Update attack_data links

2025-09-09 08:35:57 -04:00

cisco_secure_firewall___binary_file_type_download.yml

Add some missing products. I assume all these detections want to be for all 3 splunk products.

2025-12-17 11:46:11 -08:00

cisco_secure_firewall___bits_network_activity.yml

small tweaks

2025-07-10 16:43:54 +02:00

cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

cisco_secure_firewall___blocked_connection.yml

small tweaks

2025-07-10 16:43:54 +02:00

cisco_secure_firewall___citrix_netscaler_memory_overread_attempt.yml

Add some missing products. I assume all these detections want to be for all 3 splunk products.

2025-12-17 11:46:11 -08:00

cisco_secure_firewall___communication_over_suspicious_ports.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

cisco_secure_firewall___connection_to_file_sharing_domain.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

cisco_secure_firewall___file_download_over_uncommon_port.yml

Add some missing products. I assume all these detections want to be for all 3 splunk products.

2025-12-17 11:46:11 -08:00

cisco_secure_firewall___high_eve_threat_confidence.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

cisco_secure_firewall___high_priority_intrusion_classification.yml

updating risk and drilldowns

2025-05-19 12:11:35 -07:00

cisco_secure_firewall___high_volume_of_intrusion_events_per_host.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

cisco_secure_firewall___intrusion_events_by_threat_activity.yml

Update detections/network/cisco_secure_firewall___intrusion_events_by_threat_activity.yml

2025-12-08 14:34:07 +01:00

cisco_secure_firewall___lumma_stealer_activity.yml

updating risk and drilldowns

2025-05-19 12:11:35 -07:00

cisco_secure_firewall___lumma_stealer_download_attempt.yml

updating risk and drilldowns

2025-05-19 12:11:35 -07:00

cisco_secure_firewall___lumma_stealer_outbound_connection_attempt.yml

updating risk and drilldowns

2025-05-19 12:11:35 -07:00

cisco_secure_firewall___malware_file_downloaded.yml

Add some missing products. I assume all these detections want to be for all 3 splunk products.

2025-12-17 11:46:11 -08:00

cisco_secure_firewall___oracle_e_business_suite_correlation.yml

Add Oracle Exploitation Snort Coverage (#3742 )

2025-10-23 14:49:04 -07:00

cisco_secure_firewall___oracle_e_business_suite_exploitation.yml

Add Oracle Exploitation Snort Coverage (#3742 )

2025-10-23 14:49:04 -07:00

cisco_secure_firewall___possibly_compromised_host.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

cisco_secure_firewall___potential_data_exfiltration.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

cisco_secure_firewall___rare_snort_rule_triggered.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

cisco_secure_firewall___react_server_components_rce_attempt.yml

Add some missing products. I assume all these detections want to be for all 3 splunk products.

2025-12-17 11:46:11 -08:00

cisco_secure_firewall___remote_access_software_usage_traffic.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

cisco_secure_firewall___repeated_blocked_connections.yml

small tweaks

2025-07-10 16:43:54 +02:00

cisco_secure_firewall___repeated_malware_downloads.yml

Hellcat United (#3723 )

2025-10-16 16:53:02 -07:00

cisco_secure_firewall___snort_rule_triggered_across_multiple_hosts.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

cisco_secure_firewall___static_tundra_smart_install_abuse.yml

adding a new detections for snort with static tundra sigs

2025-08-21 10:17:54 -07:00

cisco_secure_firewall___veeam_cve_2023_27532_exploitation_activity.yml

updating risk and drilldowns

2025-05-19 12:11:35 -07:00

cisco_secure_firewall___wget_or_curl_download.yml

small tweaks

2025-07-10 16:43:54 +02:00

cisco_smart_install_oversized_packet_detection.yml

Bumped versions

2025-09-09 08:49:59 -04:00

cisco_smart_install_port_discovery_and_status.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

cisco_snmp_community_string_configuration_changes.yml

Update attack_data links

2025-09-09 08:35:57 -04:00

cisco_tftp_server_configuration_for_data_exfiltration.yml

Update attack_data links

2025-09-09 08:35:57 -04:00

detect_arp_poisoning.yml

New Rules & Updates - Oct 25 (#3726 )

2025-10-24 14:19:48 -07:00

detect_dga_domains_using_pretrained_model_in_dsdl.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_dns_query_to_decommissioned_s3_bucket.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_hosts_connecting_to_dynamic_domain_providers.yml

Update Macro Usage (#3840 )

2025-12-18 21:42:06 +05:30

detect_ipv6_network_infrastructure_threats.yml

New Rules & Updates - Oct 25 (#3726 )

2025-10-24 14:19:48 -07:00

detect_large_icmp_traffic.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_outbound_ldap_traffic.yml

update analytics after review suggestions

2025-06-02 10:30:36 +02:00

detect_outbound_smb_traffic.yml

more fixes

2025-06-17 02:20:37 +02:00

detect_port_security_violation.yml

New Rules & Updates - Oct 25 (#3726 )

2025-10-24 14:19:48 -07:00

detect_remote_access_software_usage_dns.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

detect_remote_access_software_usage_traffic.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

detect_rogue_dhcp_server.yml

New Rules & Updates - Oct 25 (#3726 )

2025-10-24 14:19:48 -07:00

detect_snicat_sni_exfiltration.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_software_download_to_network_device.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_traffic_mirroring.yml

New Rules & Updates - Oct 25 (#3726 )

2025-10-24 14:19:48 -07:00

detect_unauthorized_assets_by_mac_address.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_windows_dns_sigred_via_splunk_stream.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_windows_dns_sigred_via_zeek.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_zerologon_via_zeek.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

dns_kerberos_coercion.yml

NTLM Reflection via DNS Object SPN Spoofing (#3789 )

2025-11-18 12:59:34 -08:00

dns_query_length_outliers___mltk.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

dns_query_length_with_high_standard_deviation.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

excessive_dns_failures.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

hosts_receiving_high_volume_of_network_traffic_from_email_server.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

http_c2_framework_user_agent.yml

Detections for default user agents (#3842 )

2026-01-07 09:34:04 +05:30

http_malware_user_agent.yml

Detections for default user agents (#3842 )

2026-01-07 09:34:04 +05:30

http_pua_user_agent.yml

Detections for default user agents (#3842 )

2026-01-07 09:34:04 +05:30

http_rmm_user_agent.yml

Detections for default user agents (#3842 )

2026-01-07 09:34:04 +05:30

internal_horizontal_port_scan_nmap_top_20.yml

Internal horizontal port scan nmap iteration (#3802 )

2025-12-02 14:51:03 -08:00

internal_horizontal_port_scan.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

internal_vertical_port_scan.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

internal_vulnerability_scan.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

large_volume_of_dns_any_queries.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

ngrok_reverse_proxy_on_network.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

prohibited_network_traffic_allowed.yml

more fixes

2025-06-17 02:20:37 +02:00

protocol_or_port_mismatch.yml

update analytics after review suggestions

2025-06-02 10:30:36 +02:00

protocols_passing_authentication_in_cleartext.yml

Scattered Lapsus$ Hunters (#3724 )

2025-10-21 11:27:25 -07:00

remote_desktop_network_traffic.yml

rdp_artifacts_and_evasion

2025-08-07 14:29:17 +02:00

rundll32_dnsquery.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

smb_traffic_spike___mltk.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

smb_traffic_spike.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

ssl_certificates_with_punycode.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

suspicious_process_dns_query_known_abuse_web_services.yml

Add New Analytics Covering SesameOp and PromptFlux (#3827 )

2026-01-08 00:58:33 +01:00

suspicious_process_with_discord_dns_query.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

tor_traffic.yml

interlock_ransomware

2025-07-28 11:58:45 +02:00

wermgr_process_connecting_to_ip_check_web_services.yml

quasar_and_loader

2025-07-17 14:51:43 +02:00

windows_abused_web_services.yml

quick fixes and updates

2025-06-17 20:32:55 +02:00

windows_ad_replication_service_traffic.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ad_rogue_domain_controller_network_activity.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_dns_query_request_by_telegram_bot_api.yml

objectivity_stealer

2025-08-25 18:46:15 +02:00

windows_gather_victim_network_info_through_ip_check_web_services.yml

castlerat (#3750 )

2025-11-07 11:08:44 -08:00

windows_multi_hop_proxy_tor_website_query.yml

interlock_ransomware

2025-07-28 11:58:45 +02:00

windows_remote_desktop_network_bruteforce_attempt.yml

rdp_artifacts_and_evasion

2025-08-01 10:13:08 +02:00

windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

zeek_x509_certificate_with_punycode.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00