admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
create-vscode-schema
splunk-security_content/removed/detections
T
History
Bhavin Patel 2bcff6573a Bump contentctl.yml to 5.20.0 (#3829) 
* chore: bump contentctl.yml to 5.20.0

* move removed detections

---------

Co-authored-by: research bot <research@splunk.com>
2025-12-15 23:12:19 +05:30
..
abnormally_high_aws_instances_launched_by_user___mltk.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
abnormally_high_aws_instances_launched_by_user.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
abnormally_high_aws_instances_terminated_by_user___mltk.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
abnormally_high_aws_instances_terminated_by_user.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
account_discovery_with_net_app.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
any_powershell_downloadfile.yml
removed detections and version bump
2025-08-06 14:08:17 -05:00
any_powershell_downloadstring.yml
removed detections and version bump
2025-08-06 14:08:17 -05:00
asl_aws_createaccesskey.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
asl_aws_excessive_security_scanning.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
asl_aws_password_policy_changes.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
attempt_to_stop_security_service.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
attempted_credential_dump_from_registry_via_reg_exe.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
aws_cloud_provisioning_from_previously_unseen_city.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
aws_cloud_provisioning_from_previously_unseen_country.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
aws_cloud_provisioning_from_previously_unseen_ip_address.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
aws_cloud_provisioning_from_previously_unseen_region.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
aws_cross_account_activity_from_previously_unseen_account.yml
updating status
2025-04-16 15:07:32 -07:00
aws_detect_attach_to_role_policy.yml
updating status
2025-04-16 15:07:32 -07:00
aws_detect_permanent_key_creation.yml
updating status
2025-04-16 15:07:32 -07:00
aws_detect_role_creation.yml
updating status
2025-04-16 15:07:32 -07:00
aws_detect_sts_assume_role_abuse.yml
updating status
2025-04-16 15:07:32 -07:00
aws_detect_sts_get_session_token_abuse.yml
updating status
2025-04-16 15:07:32 -07:00
aws_eks_kubernetes_cluster_sensitive_object_access.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
aws_saml_access_by_provider_user_and_principal.yml
updating status
2025-04-16 15:07:32 -07:00
certutil_download_with_urlcache_and_split_arguments.yml
fixed status of newly removed detection
2025-06-17 12:47:33 -07:00
certutil_download_with_verifyctl_and_split_arguments.yml
fixed status of newly removed detection
2025-06-17 12:47:33 -07:00
change_default_file_association.yml
Merge branch 'develop' into output_normalization_endpoint
2025-03-19 15:10:33 +01:00
cisco_secure_application_alerts.yml
removing staged detection
2025-08-26 09:46:54 -07:00
clients_connecting_to_multiple_dns_servers.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
cloud_network_access_control_list_deleted.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
cmdline_tool_not_executed_in_cmd_shell.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
correlation_by_repository_and_risk.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
correlation_by_user_and_risk.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
create_local_admin_accounts_using_net_exe.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
curl_download_and_bash_execution.yml
Bump contentctl.yml to 5.20.0 (#3829)
2025-12-15 23:12:19 +05:30
deleting_of_net_users.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
detect_activity_related_to_pass_the_hash_attacks.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
detect_api_activity_from_users_without_mfa.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
detect_aws_api_activities_from_unapproved_accounts.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
detect_critical_alerts_from_security_tools.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
detect_large_outbound_icmp_packets.yml
Move deprecated detections to removed. update status too
2025-05-08 14:52:52 -07:00
detect_long_dns_txt_record_response.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
detect_mimikatz_using_loaded_images.yml
Merge branch 'develop' into output_normalization_endpoint
2025-03-19 15:10:33 +01:00
detect_mimikatz_via_powershell_and_eventcode_4703.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
detect_new_api_calls_from_user_roles.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
detect_new_user_aws_console_login.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
detect_processes_used_for_system_network_configuration_discovery.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
detect_rundll32_application_control_bypass___advpack.yml
updating version and removing detections (#3749)
2025-10-30 10:29:04 -07:00
detect_rundll32_application_control_bypass___setupapi.yml
updating version and removing detections (#3749)
2025-10-30 10:29:04 -07:00
detect_rundll32_application_control_bypass___syssetup.yml
updating version and removing detections (#3749)
2025-10-30 10:29:04 -07:00
detect_spike_in_aws_api_activity.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
detect_spike_in_network_acl_activity.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
detect_spike_in_security_group_activity.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
detect_usb_device_insertion.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
detect_web_traffic_to_dynamic_domain_providers.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
detect_webshell_exploit_behavior.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
detection_of_dns_tunnels.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
disabling_net_user_account.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
dns_query_requests_resolved_by_unauthorized_dns_servers.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
dns_record_changed.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
domain_account_discovery_with_net_app.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
domain_group_discovery_with_net.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
dump_lsass_via_procdump_rename.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
ec2_instance_modified_with_previously_unseen_user.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
ec2_instance_started_in_previously_unseen_region.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
ec2_instance_started_with_previously_unseen_ami.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
ec2_instance_started_with_previously_unseen_instance_type.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
ec2_instance_started_with_previously_unseen_user.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
elevated_group_discovery_with_net.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
excel_spawning_powershell.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
excel_spawning_windows_script_host.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
excessive_service_stop_attempt.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
excessive_usage_of_net_app.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
execution_of_file_with_spaces_before_extension.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
extended_period_without_successful_netbackup_backups.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
extraction_of_registry_hives.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
first_time_seen_command_line_argument.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
gcp_detect_accounts_with_high_risk_roles_by_project.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
gcp_detect_high_risk_permissions_by_resource_and_account.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
gcp_detect_oauth_token_abuse.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
gcp_kubernetes_cluster_scan_detection.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
github_actions_disable_security_workflow.yml
updating status
2025-04-16 15:07:32 -07:00
github_commit_changes_in_master.yml
updating status
2025-04-16 15:07:32 -07:00
github_commit_in_develop.yml
updating status
2025-04-16 15:07:32 -07:00
github_dependabot_alert.yml
updating status
2025-04-16 15:07:32 -07:00
github_pull_request_from_unknown_user.yml
updating status
2025-04-16 15:07:32 -07:00
identify_new_user_accounts.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
known_services_killed_by_ransomware.yml
updating status
2025-04-16 15:07:32 -07:00
kubernetes_aws_detect_most_active_service_accounts_by_pod.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
kubernetes_aws_detect_rbac_authorization_by_account.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
kubernetes_aws_detect_sensitive_role_access.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
kubernetes_azure_active_service_accounts_by_pod_namespace.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
kubernetes_azure_detect_rbac_authorization_by_account.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
kubernetes_azure_detect_sensitive_object_access.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
kubernetes_azure_detect_sensitive_role_access.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
kubernetes_azure_detect_suspicious_kubectl_calls.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
kubernetes_azure_pod_scan_fingerprint.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
kubernetes_azure_scan_fingerprint.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
kubernetes_gcp_detect_rbac_authorizations_by_account.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
kubernetes_gcp_detect_sensitive_object_access.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
kubernetes_gcp_detect_sensitive_role_access.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
kubernetes_gcp_detect_suspicious_kubectl_calls.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
linux_auditd_find_private_keys.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
linux_java_spawning_shell.yml
Bump contentctl.yml to 5.20.0 (#3829)
2025-12-15 23:12:19 +05:30
local_account_discovery_with_net.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
monitor_dns_for_brand_abuse.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
mshtml_module_load_in_office_product.yml
Merge branch 'develop' into output_normalization_endpoint
2025-03-19 15:10:33 +01:00
multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
net_localgroup_discovery.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
network_connection_discovery_with_net.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
o365_suspicious_admin_email_forwarding.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
o365_suspicious_rights_delegation.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
o365_suspicious_user_email_forwarding.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
office_application_drop_executable.yml
Merge branch 'develop' into output_normalization_endpoint
2025-03-19 15:10:33 +01:00
office_application_spawn_regsvr32_process.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
office_application_spawn_rundll32_process.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
office_document_creating_schedule_task.yml
Merge branch 'develop' into output_normalization_endpoint
2025-03-19 15:10:33 +01:00
office_document_executing_macro_code.yml
Merge branch 'develop' into output_normalization_endpoint
2025-03-19 15:10:33 +01:00
office_document_spawned_child_process_to_download.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
office_product_spawn_cmd_process.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
office_product_spawning_bitsadmin.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
office_product_spawning_certutil.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
office_product_spawning_mshta.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
office_product_spawning_rundll32_with_no_dll.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
office_product_spawning_windows_script_host.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
office_product_spawning_wmic.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
office_product_writing_cab_or_inf.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
office_spawning_control.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
okta_account_locked_out.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
okta_account_lockout_events.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
okta_failed_sso_attempts.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
okta_threatinsight_login_failure_with_high_unknown_users.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
okta_threatinsight_suspected_passwordspray_attack.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
okta_two_or_more_rejected_okta_pushes.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
osquery_pack___coldroot_detection.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
password_policy_discovery_with_net.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
processes_created_by_netsh.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
prohibited_software_on_endpoint.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
reg_exe_used_to_hide_files_directories_via_registry_keys.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
remote_desktop_network_bruteforce.yml
updating status
2025-04-16 15:07:32 -07:00
remote_registry_key_modifications.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
remote_system_discovery_with_net.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
scheduled_tasks_used_in_badrabbit_ransomware.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
spectre_and_meltdown_vulnerable_systems.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
suspicious_changes_to_file_associations.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
suspicious_driver_loaded_path.yml
updating status
2025-04-16 15:07:32 -07:00
suspicious_email___uba_anomaly.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
suspicious_event_log_service_behavior.yml
updating status
2025-04-16 15:07:32 -07:00
suspicious_file_write.yml
Merge branch 'develop' into output_normalization_endpoint
2025-03-19 15:10:33 +01:00
suspicious_powershell_command_line_arguments.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
suspicious_process_file_path.yml
updating status
2025-04-16 15:07:32 -07:00
suspicious_rundll32_rename.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
suspicious_writes_to_system_volume_information.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
uncommon_processes_on_endpoint.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
unsigned_image_loaded_by_lsass.yml
Merge branch 'develop' into output_normalization_endpoint
2025-03-19 15:10:33 +01:00
unsuccessful_netbackup_backups.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
w3wp_spawning_shell.yml
Bump contentctl.yml to 5.20.0 (#3829)
2025-12-15 23:12:19 +05:30
web_fraud___account_harvesting.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
web_fraud___anomalous_user_clickspeed.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
web_fraud___password_sharing_across_accounts.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
wget_download_and_bash_execution.yml
Bump contentctl.yml to 5.20.0 (#3829)
2025-12-15 23:12:19 +05:30
windows_ad_suspicious_gpo_modification.yml
prep for next release
2025-07-09 11:25:06 -07:00
windows_certutil_download_with_url_argument.yml
fixed status of newly removed detection
2025-06-17 12:47:33 -07:00
windows_change_default_file_association_for_no_file_ext.yml
updating version and removing detections (#3749)
2025-10-30 10:29:04 -07:00
windows_command_shell_fetch_env_variables.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
windows_connhost_exe_started_forcefully.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
windows_default_rdp_file_creation.yml
Bump contentctl.yml to 5.20.0 (#3829)
2025-12-15 23:12:19 +05:30
windows_dll_search_order_hijacking_hunt.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
windows_hosts_file_modification.yml
Merge branch 'develop' into output_normalization_endpoint
2025-03-19 15:10:33 +01:00
windows_installutil_uninstall_option_with_network.yml
removed detections and version bump
2025-08-06 14:08:17 -05:00
windows_java_spawning_shells.yml
Bump contentctl.yml to 5.20.0 (#3829)
2025-12-15 23:12:19 +05:30
windows_lateral_tool_transfer_remcom.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
windows_modify_registry_reg_restore.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
windows_msiexec_with_network_connections.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
windows_network_share_interaction_with_net.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
windows_office_product_spawning_msdt.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
windows_query_registry_reg_save.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
windows_remote_access_software_hunt.yml
fixed status of newly removed detection
2025-06-17 12:47:33 -07:00
windows_service_created_within_public_path.yml
Move deprecated detections to removed. update status too
2025-05-08 14:52:52 -07:00
windows_service_stop_via_net__and_sc_application.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
windows_set_private_network_profile_via_registry.yml
updating version and removing detections (#3749)
2025-10-30 10:29:04 -07:00
windows_valid_account_with_never_expires_password.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
winword_spawning_cmd.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
winword_spawning_powershell.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
winword_spawning_windows_script_host.yml
rename deprecated directory to removed
2025-03-18 14:14:37 -07:00
wmiprsve_lolbas_execution_process_spawn.yml
Bump contentctl.yml to 5.20.0 (#3829)
2025-12-15 23:12:19 +05:30