splunk-security_content

abnormally_high_aws_instances_launched_by_user___mltk.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

abnormally_high_aws_instances_launched_by_user.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

abnormally_high_aws_instances_terminated_by_user___mltk.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

abnormally_high_aws_instances_terminated_by_user.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

account_discovery_with_net_app.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

asl_aws_createaccesskey.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

asl_aws_excessive_security_scanning.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

asl_aws_password_policy_changes.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

attempt_to_stop_security_service.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

attempted_credential_dump_from_registry_via_reg_exe.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

aws_cloud_provisioning_from_previously_unseen_city.yml

progress on input/output lookup

2025-01-03 16:35:39 -08:00

aws_cloud_provisioning_from_previously_unseen_country.yml

progress on input/output lookup

2025-01-03 16:35:39 -08:00

aws_cloud_provisioning_from_previously_unseen_ip_address.yml

progress on input/output lookup

2025-01-03 16:35:39 -08:00

aws_cloud_provisioning_from_previously_unseen_region.yml

progress on input/output lookup

2025-01-03 16:35:39 -08:00

aws_eks_kubernetes_cluster_sensitive_object_access.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

change_default_file_association.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

clients_connecting_to_multiple_dns_servers.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

cloud_network_access_control_list_deleted.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

cmdline_tool_not_executed_in_cmd_shell.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

correlation_by_repository_and_risk.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

correlation_by_user_and_risk.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

create_local_admin_accounts_using_net_exe.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

deleting_of_net_users.yml

updating versions

2025-02-05 10:49:03 -08:00

detect_activity_related_to_pass_the_hash_attacks.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

detect_api_activity_from_users_without_mfa.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

detect_aws_api_activities_from_unapproved_accounts.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

detect_critical_alerts_from_security_tools.yml

Merge branch 'develop' of https://github.com/splunk/security_content into major-updates

2025-01-22 11:40:26 +01:00

detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml

progress on input/output lookup

2025-01-03 16:35:39 -08:00

detect_long_dns_txt_record_response.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

detect_mimikatz_using_loaded_images.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

detect_mimikatz_via_powershell_and_eventcode_4703.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

detect_new_api_calls_from_user_roles.yml

progress on input/output lookup

2025-01-03 16:35:39 -08:00

detect_new_user_aws_console_login.yml

progress on input/output lookup

2025-01-03 16:35:39 -08:00

detect_processes_used_for_system_network_configuration_discovery.yml

updating versions

2025-02-05 10:49:03 -08:00

detect_spike_in_aws_api_activity.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

detect_spike_in_network_acl_activity.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

detect_spike_in_security_group_activity.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

detect_usb_device_insertion.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

detect_web_traffic_to_dynamic_domain_providers.yml

version bump

2025-02-07 11:13:01 -08:00

detect_webshell_exploit_behavior.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

detection_of_dns_tunnels.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

disabling_net_user_account.yml

updating versions

2025-02-05 10:49:03 -08:00

dns_query_requests_resolved_by_unauthorized_dns_servers.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

dns_record_changed.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

domain_account_discovery_with_net_app.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

domain_group_discovery_with_net.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

dump_lsass_via_procdump_rename.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

ec2_instance_modified_with_previously_unseen_user.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

ec2_instance_started_in_previously_unseen_region.yml

progress on input/output lookup

2025-01-03 16:35:39 -08:00

ec2_instance_started_with_previously_unseen_ami.yml

Fix more errors with missing lookups, baselines, and detections

2025-01-16 10:45:46 -08:00

ec2_instance_started_with_previously_unseen_instance_type.yml

Fix more errors with missing lookups, baselines, and detections

2025-01-16 10:45:46 -08:00

ec2_instance_started_with_previously_unseen_user.yml

Fix more errors with missing lookups, baselines, and detections

2025-01-16 10:45:46 -08:00

elevated_group_discovery_with_net.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

excel_spawning_powershell.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

excel_spawning_windows_script_host.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

excessive_service_stop_attempt.yml

restore deleted to deprecated

2025-01-24 21:43:08 +01:00

excessive_usage_of_net_app.yml

updating versions

2025-02-05 10:49:03 -08:00

execution_of_file_with_spaces_before_extension.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

extended_period_without_successful_netbackup_backups.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

extraction_of_registry_hives.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

first_time_seen_command_line_argument.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

gcp_detect_accounts_with_high_risk_roles_by_project.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

gcp_detect_high_risk_permissions_by_resource_and_account.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

gcp_detect_oauth_token_abuse.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

gcp_kubernetes_cluster_scan_detection.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

identify_new_user_accounts.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

known_services_killed_by_ransomware.yml

updating descirption

2025-02-10 14:02:05 -08:00

kubernetes_aws_detect_most_active_service_accounts_by_pod.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

kubernetes_aws_detect_rbac_authorization_by_account.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

kubernetes_aws_detect_sensitive_role_access.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

kubernetes_azure_active_service_accounts_by_pod_namespace.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

kubernetes_azure_detect_rbac_authorization_by_account.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

kubernetes_azure_detect_sensitive_object_access.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

kubernetes_azure_detect_sensitive_role_access.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

kubernetes_azure_detect_suspicious_kubectl_calls.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

kubernetes_azure_pod_scan_fingerprint.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

kubernetes_azure_scan_fingerprint.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

kubernetes_gcp_detect_rbac_authorizations_by_account.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

kubernetes_gcp_detect_sensitive_object_access.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

kubernetes_gcp_detect_sensitive_role_access.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

kubernetes_gcp_detect_suspicious_kubectl_calls.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

linux_auditd_find_private_keys.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

local_account_discovery_with_net.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

monitor_dns_for_brand_abuse.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

mshtml_module_load_in_office_product.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

net_localgroup_discovery.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

network_connection_discovery_with_net.yml

restore deleted to deprecated

2025-01-24 21:43:08 +01:00

o365_suspicious_admin_email_forwarding.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

o365_suspicious_rights_delegation.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

o365_suspicious_user_email_forwarding.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

office_application_drop_executable.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

office_application_spawn_regsvr32_process.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

office_application_spawn_rundll32_process.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

office_document_creating_schedule_task.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

office_document_executing_macro_code.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

office_document_spawned_child_process_to_download.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

office_product_spawn_cmd_process.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

office_product_spawning_bitsadmin.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

office_product_spawning_certutil.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

office_product_spawning_mshta.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

office_product_spawning_rundll32_with_no_dll.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

office_product_spawning_windows_script_host.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

office_product_spawning_wmic.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

office_product_writing_cab_or_inf.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

office_spawning_control.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

okta_account_locked_out.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

okta_account_lockout_events.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

okta_failed_sso_attempts.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

okta_threatinsight_login_failure_with_high_unknown_users.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

okta_threatinsight_suspected_passwordspray_attack.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

okta_two_or_more_rejected_okta_pushes.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

osquery_pack___coldroot_detection.yml

updating versions

2025-02-05 10:49:03 -08:00

password_policy_discovery_with_net.yml

restore deleted to deprecated

2025-01-24 21:43:08 +01:00

processes_created_by_netsh.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

prohibited_software_on_endpoint.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

reg_exe_used_to_hide_files_directories_via_registry_keys.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

remote_desktop_network_bruteforce.yml

Merge branch 'develop' into remove_type_and_subtype

2025-02-11 15:38:08 -08:00

remote_registry_key_modifications.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

remote_system_discovery_with_net.yml

CI fixes

2025-01-22 20:57:29 +01:00

scheduled_tasks_used_in_badrabbit_ransomware.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

spectre_and_meltdown_vulnerable_systems.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

suspicious_changes_to_file_associations.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

suspicious_driver_loaded_path.yml

Merge branch 'develop' into remove_type_and_subtype

2025-02-11 15:38:08 -08:00

suspicious_email___uba_anomaly.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

suspicious_event_log_service_behavior.yml

Update suspicious_event_log_service_behavior.yml

2025-02-19 11:22:59 +01:00

suspicious_file_write.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

suspicious_powershell_command_line_arguments.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

suspicious_process_file_path.yml

updating descirption

2025-02-10 14:02:05 -08:00

suspicious_rundll32_rename.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

suspicious_writes_to_system_volume_information.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

uncommon_processes_on_endpoint.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

unsigned_image_loaded_by_lsass.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

unsuccessful_netbackup_backups.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

web_fraud___account_harvesting.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

web_fraud___anomalous_user_clickspeed.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

web_fraud___password_sharing_across_accounts.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

windows_command_shell_fetch_env_variables.yml

restore deleted to deprecated

2025-01-24 21:43:08 +01:00

windows_connhost_exe_started_forcefully.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

windows_dll_search_order_hijacking_hunt.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

windows_hosts_file_modification.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

windows_lateral_tool_transfer_remcom.yml

updating versions

2025-02-05 10:49:03 -08:00

windows_modify_registry_reg_restore.yml

restore deleted to deprecated

2025-01-24 21:43:08 +01:00

windows_msiexec_with_network_connections.yml

updating versions

2025-02-05 10:49:03 -08:00

windows_network_share_interaction_with_net.yml

restore deleted to deprecated

2025-01-24 21:43:08 +01:00

windows_office_product_spawning_msdt.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

windows_query_registry_reg_save.yml

restore deleted to deprecated

2025-01-24 21:43:08 +01:00

windows_service_stop_via_net__and_sc_application.yml

restore deleted to deprecated

2025-01-24 21:43:08 +01:00

windows_valid_account_with_never_expires_password.yml

restore deleted to deprecated

2025-01-24 21:43:08 +01:00

winword_spawning_cmd.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

winword_spawning_powershell.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

winword_spawning_windows_script_host.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00