admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
dlux_update
splunk-security_content/detections/application
T
History
dluxtron 3f660b7a3d updating risk score
2024-06-27 09:54:37 +10:00
..
detect_distributed_password_spray_attempts.yml
Updating detections
2024-06-25 12:23:25 +10:00
detect_new_login_attempts_to_routers.yml
merged with develop
2023-03-03 12:40:16 +01:00
detect_password_spray_attempts.yml
Updating detections
2024-06-25 12:23:25 +10:00
detect_risky_spl_using_pretrained_ml_model.yml
merged with develop
2023-03-03 12:40:16 +01:00
email_attachments_with_lots_of_spaces.yml
data_destruction_wiper_story
2023-04-14 10:50:14 +02:00
email_files_written_outside_of_the_outlook_directory.yml
merged with develop
2023-03-03 12:40:16 +01:00
email_servers_sending_high_volume_traffic_to_hosts.yml
merged with develop
2023-03-03 12:40:16 +01:00
monitor_email_for_brand_abuse.yml
merged with develop
2023-03-03 12:40:16 +01:00
multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml
merged with develop
2023-03-03 12:40:16 +01:00
no_windows_updates_in_a_time_frame.yml
merged with develop
2023-03-03 12:40:16 +01:00
okta_account_locked_out.yml
merged with develop
2023-03-03 12:40:16 +01:00
okta_account_lockout_events.yml
merged with develop
2023-03-03 12:40:16 +01:00
okta_failed_sso_attempts.yml
merged with develop
2023-03-03 12:40:16 +01:00
okta_mfa_exhaustion_hunt.yml
observable fix for cloud
2023-07-28 11:46:28 -05:00
okta_mismatch_between_source_and_response_for_verify_push_request.yml
merged with develop
2023-03-23 10:35:34 +01:00
okta_multiple_failed_requests_to_access_applications.yml
Fixing some syntactic errors with a number of detections.
2023-04-12 10:09:43 -07:00
okta_new_api_token_created.yml
merged with develop
2023-03-03 12:40:16 +01:00
okta_new_device_enrolled_on_account.yml
merged with develop
2023-03-03 12:40:16 +01:00
okta_phishing_detection_with_fastpass_origin_check.yml
merged with develop
2023-03-23 10:35:34 +01:00
okta_risk_threshold_exceeded.yml
updating detections
2024-06-25 13:47:19 +10:00
okta_suspicious_activity_reported.yml
merged with develop
2023-03-03 12:40:16 +01:00
okta_suspicious_use_of_a_session_cookie.yml
merged with develop
2023-03-23 10:35:34 +01:00
okta_threatinsight_login_failure_with_high_unknown_users.yml
updates to ymls
2023-04-17 15:23:53 -07:00
okta_threatinsight_suspected_passwordspray_attack.yml
Update okta_threatinsight_suspected_passwordspray_attack.yml
2023-04-17 16:46:08 -07:00
okta_threatinsight_threat_detected.yml
merged with develop
2023-03-03 12:40:16 +01:00
okta_two_or_more_rejected_okta_pushes.yml
observable fix for cloud
2023-07-28 11:46:28 -05:00
okta_user_logins_from_multiple_cities.yml
merged with develop
2023-03-03 12:40:16 +01:00
path_traversal_spl_injection.yml
merged with develop
2023-03-03 12:40:16 +01:00
splunk_absolute_path_traversal_using_runshellscript.yml
Fixed a handful of issues with observables and messages and spacing in content.
2023-10-23 19:49:17 +00:00
splunk_account_discovery_drilldown_dashboard_disclosure.yml
merged with develop
2023-03-03 12:40:16 +01:00
splunk_code_injection_via_custom_dashboard_leading_to_rce.yml
merged with develop
2023-03-03 12:40:16 +01:00
splunk_command_and_scripting_interpreter_delete_usage.yml
merged with develop
2023-03-03 12:40:16 +01:00
splunk_command_and_scripting_interpreter_risky_commands.yml
merged with develop
2023-03-03 12:40:16 +01:00
splunk_command_and_scripting_interpreter_risky_spl_mltk.yml
manual flag for 1 detection
2023-04-10 11:20:41 -07:00
splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml
o365_obs_fix
2023-09-22 15:01:21 -07:00
splunk_data_exfiltration_from_analytics_workspace_using_sid_query.yml
merged with develop
2023-03-03 12:40:16 +01:00
splunk_digital_certificates_infrastructure_version.yml
merged with develop
2023-03-03 12:40:16 +01:00
splunk_digital_certificates_lack_of_encryption.yml
merged with develop
2023-03-03 12:40:16 +01:00
splunk_dos_using_malformed_saml_request.yml
Delete detection and migrate
2023-09-28 14:51:28 -07:00
splunk_dos_via_dump_spl_command.yml
Fix detection
2023-06-01 11:10:39 -07:00
splunk_dos_via_malformed_s2s_request.yml
merged with develop
2023-03-03 12:40:16 +01:00
splunk_dos_via_printf_search_function.yml
Final changes in prep for release. Datasets uploaded to attack range
2023-08-30 08:09:15 -07:00
splunk_edit_user_privilege_escalation.yml
adding CVE
2023-09-11 17:13:40 -07:00
splunk_endpoint_denial_of_service_dos_zip_bomb.yml
merged with develop
2023-03-03 12:40:16 +01:00
splunk_http_response_splitting_via_rest_spl_command.yml
improve specificity
2023-06-08 13:16:51 -07:00
splunk_improperly_formatted_parameter_crashes_splunkd.yml
merged with develop
2023-03-23 10:35:34 +01:00
splunk_list_all_nonstandard_admin_accounts.yml
merged with develop
2023-03-03 12:40:16 +01:00
splunk_low_privilege_user_can_view_hashed_splunk_password.yml
content for June2023.
2023-06-01 08:18:50 -07:00
splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml
content for June2023.
2023-06-01 08:18:50 -07:00
splunk_persistent_xss_in_rapiddiag_through_user_interface_views.yml
observable fix for cloud
2023-07-28 11:46:28 -05:00
splunk_persistent_xss_via_url_validation_bypass_w_dashboard.yml
fixing mitre ids
2023-06-01 09:45:20 -07:00
splunk_process_injection_forwarder_bundle_downloads.yml
merged with develop
2023-03-03 12:40:16 +01:00
splunk_protocol_impersonation_weak_encryption_configuration.yml
merged with develop
2023-03-03 12:40:16 +01:00
splunk_protocol_impersonation_weak_encryption_selfsigned.yml
observable fix for cloud
2023-07-28 11:46:28 -05:00
splunk_protocol_impersonation_weak_encryption_simplerequest.yml
observable fix for cloud
2023-07-28 11:46:28 -05:00
splunk_rbac_bypass_on_indexing_preview_rest_endpoint.yml
content for June2023.
2023-06-01 08:18:50 -07:00
splunk_rce_via_serialized_session_payload.yml
remove source= from search
2023-10-02 11:54:06 -07:00
splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.yml
merged with develop
2023-03-03 12:40:16 +01:00
splunk_reflected_xss_in_the_templates_lists_radio.yml
merged with develop
2023-03-03 12:40:16 +01:00
splunk_reflected_xss_on_app_search_table_endpoint.yml
Delete detection and migrate
2023-09-28 14:51:28 -07:00
splunk_risky_command_abuse_disclosed_february_2023.yml
properly format times in risky command search
2023-10-02 12:56:00 -07:00
splunk_stored_xss_via_data_model_objectname_field.yml
merged with develop
2023-03-03 12:40:16 +01:00
splunk_unauthenticated_log_injection_web_service_log.yml
Update splunk_unauthenticated_log_injection_web_service_log.yml
2023-07-31 09:02:03 -07:00
splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml
updated all yml, remove kc,nist,cis, updaated with 3.64.0 new content
2023-04-04 17:15:38 -05:00
splunk_user_enumeration_attempt.yml
merged with develop
2023-03-03 12:40:16 +01:00
splunk_xss_in_monitoring_console.yml
merged with develop
2023-03-03 12:40:16 +01:00
splunk_xss_in_save_table_dialog_header_in_search_page.yml
merged with develop
2023-03-03 12:40:16 +01:00
splunk_xss_via_view.yml
Add missing tests to detections.
2023-07-31 16:27:16 -07:00
suspicious_email_attachment_extensions.yml
updated with proper format
2023-10-13 13:32:37 -07:00
suspicious_java_classes.yml
merged with develop
2023-03-03 12:40:16 +01:00
web_servers_executing_suspicious_processes.yml
updated with proper format
2023-10-13 13:32:37 -07:00
windows_ad_add_self_to_group.yml
updating detections
2024-06-25 13:47:19 +10:00
windows_ad_dangerous_deny_acl_modification.yml
fixing yaml
2024-06-27 06:58:32 +10:00
windows_ad_dangerous_group_acl_modification.yml
updating yaml formatting
2024-06-27 09:19:30 +10:00
windows_ad_dangerous_user_acl_modification.yml
updating yaml formatting
2024-06-27 09:19:30 +10:00
windows_ad_dcshadow_privileges_acl_addition.yml
updating yaml formatting
2024-06-27 09:19:30 +10:00
windows_ad_domain_root_acl_deletion.yml
updating yaml formatting
2024-06-27 09:19:30 +10:00
windows_ad_domain_root_acl_modification.yml
updating yaml formatting
2024-06-27 09:19:30 +10:00
windows_ad_gpo_deleted.yml
updating risk score
2024-06-27 09:54:37 +10:00
windows_ad_gpo_disabled.yml
updating risk score
2024-06-27 09:54:37 +10:00
windows_ad_gpo_new_cse_addition.yml
Adding AD self assignment detections
2023-12-18 18:19:44 +10:00
windows_ad_hidden_ou_creation.yml
updating yaml formatting
2024-06-27 09:19:30 +10:00
windows_ad_object_owner_updated.yml
Adding AD self assignment detections
2023-12-18 18:19:44 +10:00
windows_ad_privileged_group_modification.yml
Adding AD self assignment detections
2023-12-18 18:19:44 +10:00
windows_ad_self_dacl_assignment.yml
updating yaml
2024-06-27 09:30:00 +10:00
windows_ad_suspicious_attribute_modification.yml
Adding AD self assignment detections
2023-12-18 18:19:44 +10:00
windows_ad_suspicious_gpo_modification.yml
updating yaml formatting
2024-06-27 09:19:30 +10:00
windows_increase_in_group_or_object_modification_activity.yml
updating yaml formatting
2024-06-27 09:19:30 +10:00
windows_increase_in_user_modification_activity.yml
updating yaml formatting
2024-06-27 09:19:30 +10:00