admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
dlux_update
splunk-security_content/detections/network
T
History
dluxtron 367e3fe4b5 updating detections
2023-11-01 11:08:37 +10:00
..
detect_arp_poisoning.yml
minor change for creating PR
2023-09-26 14:03:04 -07:00
detect_dga_domains_using_pretrained_model_in_dsdl.yml
bug fix validation
2023-04-28 13:53:52 +02:00
detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml
Update detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml
2023-06-12 14:41:43 -07:00
detect_hosts_connecting_to_dynamic_domain_providers.yml
merged with ba ocsf work
2023-03-03 13:28:14 +01:00
detect_ipv6_network_infrastructure_threats.yml
merged with develop
2023-03-03 12:40:16 +01:00
detect_large_outbound_icmp_packets.yml
merged with ba ocsf work
2023-03-03 13:28:14 +01:00
detect_outbound_ldap_traffic.yml
merged with develop
2023-03-03 12:40:16 +01:00
detect_outbound_smb_traffic.yml
merged with develop
2023-03-03 12:40:16 +01:00
detect_port_security_violation.yml
merged with develop
2023-03-03 12:40:16 +01:00
detect_rogue_dhcp_server.yml
merged with develop
2023-03-03 12:40:16 +01:00
detect_snicat_sni_exfiltration.yml
merged with develop
2023-03-03 12:40:16 +01:00
detect_software_download_to_network_device.yml
merged with develop
2023-03-03 12:40:16 +01:00
detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml
addressing review feedback
2023-06-08 12:43:07 -07:00
detect_traffic_mirroring.yml
merged with develop
2023-03-03 12:40:16 +01:00
detect_unauthorized_assets_by_mac_address.yml
merged with develop
2023-03-03 12:40:16 +01:00
detect_windows_dns_sigred_via_splunk_stream.yml
updated with proper format
2023-10-13 13:32:37 -07:00
detect_windows_dns_sigred_via_zeek.yml
updated with proper format
2023-10-13 13:32:37 -07:00
detect_zerologon_via_zeek.yml
updated descriptions
2023-10-13 13:26:36 -07:00
dns_query_length_outliers___mltk.yml
merged with ba ocsf work
2023-03-03 13:28:14 +01:00
dns_query_length_with_high_standard_deviation.yml
issue 2568 fix
2023-04-17 17:19:34 -07:00
excessive_dns_failures.yml
merged with ba ocsf work
2023-03-03 13:28:14 +01:00
f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml
T1133 Tags + description updates
2023-06-01 13:44:32 -06:00
hosts_receiving_high_volume_of_network_traffic_from_email_server.yml
merged with develop
2023-03-03 12:40:16 +01:00
internal_horizontal_port_scan.yml
updating detections
2023-11-01 11:08:37 +10:00
internal_vertical_port_scan.yml
updating detections
2023-10-31 22:09:11 +10:00
internal_vulnerability_scan.yml
updating detections
2023-11-01 11:08:37 +10:00
large_volume_of_dns_any_queries.yml
merged with develop
2023-03-03 12:40:16 +01:00
multiple_archive_files_http_post_traffic.yml
bug fix validation
2023-04-28 13:53:52 +02:00
ngrok_reverse_proxy_on_network.yml
merged with develop
2023-03-03 12:40:16 +01:00
plain_http_post_exfiltrated_data.yml
bug fix validation
2023-04-28 13:53:52 +02:00
prohibited_network_traffic_allowed.yml
merged with ba ocsf work
2023-03-03 13:28:14 +01:00
protocol_or_port_mismatch.yml
merged with ba ocsf work
2023-03-03 13:28:14 +01:00
protocols_passing_authentication_in_cleartext.yml
merged with develop
2023-03-03 12:40:16 +01:00
remote_desktop_network_bruteforce.yml
carry over
2023-05-01 12:07:20 -07:00
remote_desktop_network_traffic.yml
merged with develop
2023-03-03 12:40:16 +01:00
smb_traffic_spike___mltk.yml
update baseline time and text
2023-09-08 10:13:28 -07:00
smb_traffic_spike.yml
updated with proper format
2023-10-13 13:32:37 -07:00
splunk_identified_ssl_tls_certificates.yml
Fix a large number of searches with observable issues. Discuss with team before merging changes.
2023-09-22 17:10:03 -07:00
ssl_certificates_with_punycode.yml
merged with develop
2023-03-03 12:40:16 +01:00
tor_traffic.yml
updating tor detection
2023-09-20 11:55:18 -07:00
unusually_long_content_type_length.yml
merged with develop
2023-03-03 12:40:16 +01:00
windows_ad_replication_service_traffic.yml
Fixing some syntactic errors with a number of detections.
2023-04-12 10:09:43 -07:00
windows_ad_rogue_domain_controller_network_activity.yml
Fixing some syntactic errors with a number of detections.
2023-04-12 10:09:43 -07:00
zeek_x509_certificate_with_punycode.yml
merged with develop
2023-03-03 12:40:16 +01:00