Nasreddine Bencherchali a266563b00 Update RBA, logic, and beautify some searches (#3880) ...

* Update RBA, logic, and beautify searches

* Update internal_horizontal_port_scan_nmap_top_20.yml

2026-01-31 09:57:04 +05:30

..

3cx_supply_chain_attack_network_indicators.yml

Update Analytics Performance (#3866)

2026-01-22 12:36:31 +00:00

cisco_configuration_archive_logging_analysis.yml

Update attack_data links

2025-09-09 08:35:57 -04:00

cisco_ios_suspicious_privileged_account_creation.yml

Update attack_data links

2025-09-09 08:35:57 -04:00

cisco_network_interface_modifications.yml

Update attack_data links

2025-09-09 08:35:57 -04:00

cisco_privileged_account_creation_with_http_command_execution.yml

Updating Terminology for ES8+ (#3875)

2026-01-22 22:59:29 +01:00

cisco_privileged_account_creation_with_suspicious_ssh_activity.yml

Updating Terminology for ES8+ (#3875)

2026-01-22 22:59:29 +01:00

cisco_secure_firewall___binary_file_type_download.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_secure_firewall___bits_network_activity.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_secure_firewall___blocked_connection.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_secure_firewall___citrix_netscaler_memory_overread_attempt.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_secure_firewall___communication_over_suspicious_ports.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_secure_firewall___connection_to_file_sharing_domain.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_secure_firewall___file_download_over_uncommon_port.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_secure_firewall___high_eve_threat_confidence.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_secure_firewall___high_priority_intrusion_classification.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_secure_firewall___high_volume_of_intrusion_events_per_host.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_secure_firewall___intrusion_events_by_threat_activity.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_secure_firewall___lumma_stealer_activity.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_secure_firewall___lumma_stealer_download_attempt.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_secure_firewall___lumma_stealer_outbound_connection_attempt.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_secure_firewall___malware_file_downloaded.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_secure_firewall___oracle_e_business_suite_correlation.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_secure_firewall___oracle_e_business_suite_exploitation.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_secure_firewall___possibly_compromised_host.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_secure_firewall___potential_data_exfiltration.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_secure_firewall___privileged_command_execution_via_http.yml

Add Snort/IOS Correlation and Other Things (#3857)

2026-01-12 12:15:11 +01:00

cisco_secure_firewall___rare_snort_rule_triggered.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_secure_firewall___react_server_components_rce_attempt.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_secure_firewall___remote_access_software_usage_traffic.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_secure_firewall___repeated_blocked_connections.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_secure_firewall___repeated_malware_downloads.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_secure_firewall___snort_rule_triggered_across_multiple_hosts.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_secure_firewall___ssh_connection_to_non_standard_port.yml

Add Snort/IOS Correlation and Other Things (#3857)

2026-01-12 12:15:11 +01:00

cisco_secure_firewall___ssh_connection_to_sshd_operns.yml

Add Snort/IOS Correlation and Other Things (#3857)

2026-01-12 12:15:11 +01:00

cisco_secure_firewall___static_tundra_smart_install_abuse.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_secure_firewall___veeam_cve_2023_27532_exploitation_activity.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_secure_firewall___wget_or_curl_download.yml

Fix Reported Issues (#3873)

2026-01-30 16:34:18 +01:00

cisco_smart_install_oversized_packet_detection.yml

Bumped versions

2025-09-09 08:49:59 -04:00

cisco_smart_install_port_discovery_and_status.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

cisco_snmp_community_string_configuration_changes.yml

Update attack_data links

2025-09-09 08:35:57 -04:00

cisco_tftp_server_configuration_for_data_exfiltration.yml

Update attack_data links

2025-09-09 08:35:57 -04:00

detect_arp_poisoning.yml

New Rules & Updates - Oct 25 (#3726)

2025-10-24 14:19:48 -07:00

detect_dga_domains_using_pretrained_model_in_dsdl.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml

VoidLink Tagging (#3870)

2026-01-22 19:53:15 +05:30

detect_dns_query_to_decommissioned_s3_bucket.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_hosts_connecting_to_dynamic_domain_providers.yml

Updating Terminology for ES8+ (#3875)

2026-01-22 22:59:29 +01:00

detect_ipv6_network_infrastructure_threats.yml

Fix Validation Issues (#3861)

2026-01-30 01:38:34 +01:00

detect_large_icmp_traffic.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_outbound_ldap_traffic.yml

Fix Validation Issues (#3861)

2026-01-30 01:38:34 +01:00

detect_outbound_smb_traffic.yml

more fixes

2025-06-17 02:20:37 +02:00

detect_port_security_violation.yml

New Rules & Updates - Oct 25 (#3726)

2025-10-24 14:19:48 -07:00

detect_remote_access_software_usage_dns.yml

Update Analytics Performance (#3866)

2026-01-22 12:36:31 +00:00

detect_remote_access_software_usage_traffic.yml

Update Analytics Performance (#3866)

2026-01-22 12:36:31 +00:00

detect_rogue_dhcp_server.yml

New Rules & Updates - Oct 25 (#3726)

2025-10-24 14:19:48 -07:00

detect_snicat_sni_exfiltration.yml

Fix Validation Issues (#3861)

2026-01-30 01:38:34 +01:00

detect_software_download_to_network_device.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml

VoidLink Tagging (#3870)

2026-01-22 19:53:15 +05:30

detect_traffic_mirroring.yml

New Rules & Updates - Oct 25 (#3726)

2025-10-24 14:19:48 -07:00

detect_unauthorized_assets_by_mac_address.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

detect_windows_dns_sigred_via_splunk_stream.yml

Fix Validation Issues (#3861)

2026-01-30 01:38:34 +01:00

detect_windows_dns_sigred_via_zeek.yml

Fix Validation Issues (#3861)

2026-01-30 01:38:34 +01:00

detect_zerologon_via_zeek.yml

Fix Validation Issues (#3861)

2026-01-30 01:38:34 +01:00

dns_kerberos_coercion.yml

NTLM Reflection via DNS Object SPN Spoofing (#3789)

2025-11-18 12:59:34 -08:00

dns_query_length_outliers___mltk.yml

Updating Terminology for ES8+ (#3875)

2026-01-22 22:59:29 +01:00

dns_query_length_with_high_standard_deviation.yml

Updating Query Based on XS Data (#3876)

2026-01-23 15:49:23 +01:00

excessive_dns_failures.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

hosts_receiving_high_volume_of_network_traffic_from_email_server.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

http_c2_framework_user_agent.yml

Detections for default user agents (#3842)

2026-01-07 09:34:04 +05:30

http_malware_user_agent.yml

Detections for default user agents (#3842)

2026-01-07 09:34:04 +05:30

http_pua_user_agent.yml

Detections for default user agents (#3842)

2026-01-07 09:34:04 +05:30

http_rmm_user_agent.yml

Detections for default user agents (#3842)

2026-01-07 09:34:04 +05:30

internal_horizontal_port_scan_nmap_top_20.yml

Update RBA, logic, and beautify some searches (#3880)

2026-01-31 09:57:04 +05:30

internal_horizontal_port_scan.yml

Fix Validation Issues (#3861)

2026-01-30 01:38:34 +01:00

internal_vertical_port_scan.yml

Update RBA, logic, and beautify some searches (#3880)

2026-01-31 09:57:04 +05:30

internal_vulnerability_scan.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

large_volume_of_dns_any_queries.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

ngrok_reverse_proxy_on_network.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

prohibited_network_traffic_allowed.yml

Fix Validation Issues (#3861)

2026-01-30 01:38:34 +01:00

protocol_or_port_mismatch.yml

Update RBA, logic, and beautify some searches (#3880)

2026-01-31 09:57:04 +05:30

protocols_passing_authentication_in_cleartext.yml

Scattered Lapsus$ Hunters (#3724)

2025-10-21 11:27:25 -07:00

remote_desktop_network_traffic.yml

rdp_artifacts_and_evasion

2025-08-07 14:29:17 +02:00

rundll32_dnsquery.yml

Fix Validation Issues (#3861)

2026-01-30 01:38:34 +01:00

smb_traffic_spike___mltk.yml

Updating Terminology for ES8+ (#3875)

2026-01-22 22:59:29 +01:00

smb_traffic_spike.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

ssl_certificates_with_punycode.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

suspicious_process_dns_query_known_abuse_web_services.yml

Add New Analytics Covering SesameOp and PromptFlux (#3827)

2026-01-08 00:58:33 +01:00

suspicious_process_with_discord_dns_query.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

tor_traffic.yml

Fix Validation Issues (#3861)

2026-01-30 01:38:34 +01:00

wermgr_process_connecting_to_ip_check_web_services.yml

Fix Validation Issues (#3861)

2026-01-30 01:38:34 +01:00

windows_abused_web_services.yml

Fix search typo in windows abused web services analytic (#3878)

2026-01-24 14:38:30 +01:00

windows_ad_replication_service_traffic.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

windows_ad_rogue_domain_controller_network_activity.yml

Fix Validation Issues (#3861)

2026-01-30 01:38:34 +01:00

windows_dns_query_request_by_telegram_bot_api.yml

objectivity_stealer

2025-08-25 18:46:15 +02:00

windows_gather_victim_network_info_through_ip_check_web_services.yml

castlerat (#3750)

2025-11-07 11:08:44 -08:00

windows_multi_hop_proxy_tor_website_query.yml

interlock_ransomware

2025-07-28 11:58:45 +02:00

windows_remote_desktop_network_bruteforce_attempt.yml

rdp_artifacts_and_evasion

2025-08-01 10:13:08 +02:00

windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00

zeek_x509_certificate_with_punycode.yml

Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.

2025-05-02 14:10:46 -07:00