splunk-security_content

3cx_supply_chain_attack_network_indicators.yml

update versions

2025-03-14 13:47:44 +01:00

cisco_secure_firewall___binary_file_type_download.yml

update to RBA section

2025-04-17 09:48:48 -07:00

cisco_secure_firewall___bits_network_activity.yml

updating RBA

2025-04-16 15:45:14 -07:00

cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml

updating RBA

2025-04-16 15:45:14 -07:00

cisco_secure_firewall___blocked_connection.yml

updating RBA

2025-04-16 15:45:14 -07:00

cisco_secure_firewall___communication_over_suspicious_ports.yml

fillnull for url

2025-04-16 16:09:07 -07:00

cisco_secure_firewall___connection_to_file_sharing_domain.yml

resolve review comments

2025-04-17 00:22:13 +02:00

cisco_secure_firewall___file_download_over_uncommon_port.yml

update to RBA section

2025-04-17 09:48:48 -07:00

cisco_secure_firewall___high_eve_threat_confidence.yml

adding drilldown

2025-04-16 16:31:04 -07:00

cisco_secure_firewall___high_volume_of_intrusion_events_per_host.yml

updates to rba and such

2025-04-17 13:59:44 -07:00

cisco_secure_firewall___malware_file_downloaded.yml

update to RBA section

2025-04-17 09:48:48 -07:00

cisco_secure_firewall___possibly_compromised_host.yml

updates to rba and such

2025-04-17 13:59:44 -07:00

cisco_secure_firewall___potential_data_exfiltration.yml

updating RBA

2025-04-16 15:45:14 -07:00

cisco_secure_firewall___rare_snort_rule_triggered.yml

updates to rba and such

2025-04-17 13:59:44 -07:00

cisco_secure_firewall___repeated_blocked_connections.yml

updating RBA

2025-04-16 15:45:14 -07:00

cisco_secure_firewall___repeated_malware_downloads.yml

update to RBA section

2025-04-17 09:48:48 -07:00

cisco_secure_firewall___snort_rule_triggered_across_multiple_hosts.yml

updates to rba and such

2025-04-17 13:59:44 -07:00

cisco_secure_firewall___wget_or_curl_download.yml

missed a threat object

2025-04-16 16:51:46 -07:00

detect_arp_poisoning.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

detect_dga_domains_using_pretrained_model_in_dsdl.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

detect_dns_query_to_decommissioned_s3_bucket.yml

update versions

2025-03-14 13:47:44 +01:00

detect_hosts_connecting_to_dynamic_domain_providers.yml

update versions

2025-03-14 13:47:44 +01:00

detect_ipv6_network_infrastructure_threats.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

detect_large_icmp_traffic.yml

rebase with develop

2025-04-01 09:42:07 +02:00

detect_outbound_ldap_traffic.yml

update inspect failures

2025-03-27 10:54:24 -07:00

detect_outbound_smb_traffic.yml

update versions

2025-03-14 13:47:44 +01:00

detect_port_security_violation.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

detect_remote_access_software_usage_dns.yml

update versions

2025-03-14 13:47:44 +01:00

detect_remote_access_software_usage_traffic.yml

update versions

2025-03-14 13:47:44 +01:00

detect_rogue_dhcp_server.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

detect_snicat_sni_exfiltration.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

detect_software_download_to_network_device.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

detect_traffic_mirroring.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

detect_unauthorized_assets_by_mac_address.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

detect_windows_dns_sigred_via_splunk_stream.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

detect_windows_dns_sigred_via_zeek.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

detect_zerologon_via_zeek.yml

systembc

2025-03-03 14:12:55 +01:00

dns_query_length_outliers___mltk.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

dns_query_length_with_high_standard_deviation.yml

update versions

2025-03-14 13:47:44 +01:00

excessive_dns_failures.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

hosts_receiving_high_volume_of_network_traffic_from_email_server.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

internal_horizontal_port_scan_nmap_top_20.yml

update versions

2025-03-14 13:47:44 +01:00

internal_horizontal_port_scan.yml

update versions

2025-03-14 13:47:44 +01:00

internal_vertical_port_scan.yml

update versions

2025-03-14 13:47:44 +01:00

internal_vulnerability_scan.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

large_volume_of_dns_any_queries.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

ngrok_reverse_proxy_on_network.yml

update versions

2025-03-14 13:47:44 +01:00

prohibited_network_traffic_allowed.yml

update versions

2025-03-14 13:47:44 +01:00

protocol_or_port_mismatch.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

protocols_passing_authentication_in_cleartext.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

remote_desktop_network_traffic.yml

update versions

2025-03-14 13:47:44 +01:00

rundll32_dnsquery.yml

update versions

2025-03-14 13:47:44 +01:00

smb_traffic_spike___mltk.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

smb_traffic_spike.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

ssl_certificates_with_punycode.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

suspicious_process_dns_query_known_abuse_web_services.yml

round 2

2025-04-18 10:22:37 -06:00

suspicious_process_with_discord_dns_query.yml

round 2

2025-04-18 10:22:37 -06:00

tor_traffic.yml

update versions

2025-03-14 13:47:44 +01:00

wermgr_process_connecting_to_ip_check_web_services.yml

update versions

2025-03-14 13:47:44 +01:00

windows_abused_web_services.yml

update versions

2025-03-14 13:47:44 +01:00

windows_ad_replication_service_traffic.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

windows_ad_rogue_domain_controller_network_activity.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00

windows_dns_query_request_by_telegram_bot_api.yml

update versions

2025-03-14 13:47:44 +01:00

windows_gather_victim_network_info_through_ip_check_web_services.yml

update versions

2025-03-14 13:47:44 +01:00

windows_multi_hop_proxy_tor_website_query.yml

update versions

2025-03-14 13:47:44 +01:00

windows_remote_desktop_network_bruteforce_attempt.yml

update versions

2025-03-14 13:47:44 +01:00

windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml

update versions

2025-03-14 13:47:44 +01:00

zeek_x509_certificate_with_punycode.yml

remove update_timestamps, confidence, impact,

2025-01-03 15:25:52 -08:00