splunk-security_content

.untested

detection/experimental folder for untested detections

2020-11-06 10:37:11 -08:00

child_processes_of_spoolsv_exe.yml

secondbatchwinprivesctaghermeticwiper

2022-04-05 08:02:47 -07:00

detect_baron_samedit_cve_2021_3156_segfault.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_baron_samedit_cve_2021_3156_via_osquery.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_baron_samedit_cve_2021_3156.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_computer_changed_with_anonymous_account.yml

The Unbroken Haag

2021-12-06 11:57:20 -07:00

detect_outlook_exe_writing_a_zip_file.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_rare_executables.yml

Added automaticc generation of finding report

2022-03-14 12:12:48 +01:00

detection_of_tools_built_by_nirsoft.yml

Refactored security content

2022-03-09 14:43:09 +01:00

exchange_powershell_abuse_via_ssrf.yml

Refactored security content

2022-03-09 14:43:09 +01:00

exchange_powershell_module_usage.yml

Update exchange_powershell_module_usage.yml

2022-10-02 06:55:20 -06:00

first_time_seen_child_process_of_zoom.yml

Refactored security content

2022-03-09 14:43:09 +01:00

first_time_seen_running_windows_service.yml

Refactored security content

2022-03-09 14:43:09 +01:00

linux_stdout_redirection_to_dev_null_file.yml

fixedtagcb

2022-05-03 09:45:47 -07:00

macos___re_opened_applications.yml

Added automaticc generation of finding report

2022-03-14 12:12:48 +01:00

ms_exchange_mailbox_replication_service_writing_active_server_pages.yml

all the changes again

2022-03-16 13:35:48 -07:00

print_processor_registry_autostart.yml

secondbatchwinprivesctaghermeticwiper

2022-04-05 08:02:47 -07:00

processes_tapping_keyboard_events.yml

Added automaticc generation of finding report

2022-03-14 12:12:48 +01:00

randomly_generated_scheduled_task_name.yml

CISA AA22-257A tag

2022-09-15 10:07:38 -06:00

randomly_generated_windows_service_name.yml

Refactored security content

2022-03-09 14:43:09 +01:00

remote_desktop_process_running_on_system.yml

Refactored security content

2022-03-09 14:43:09 +01:00

spike_in_file_writes.yml

Refactored security content

2022-03-09 14:43:09 +01:00

ssa___anomalous_usage_of_account_credentials.yml

Refactored security content

2022-03-09 14:43:09 +01:00

ssa___detect_kerberoasting.yml

Refactored security content

2022-03-09 14:43:09 +01:00

ssa___disable_defender_antivirus_registry.yml

IceID -> IcedID

2022-09-22 09:20:02 -05:00

ssa___excessive_number_of_office_files_copied.yml

adding insider threat, fixing minor display bug

2022-05-19 21:19:35 -04:00

ssa___first_time_seen_cmd_line.yml

Added automaticc generation of finding report

2022-03-14 12:12:48 +01:00

ssa___high_file_deletion_frequency.yml

Branch was auto-updated.

2022-05-19 21:21:59 -04:00

ssa___rare_parent_process_relationship_lolbas.yml

Refactored security content

2022-03-09 14:43:09 +01:00

ssa___windows_wsreset_uac_bypass.yml

Refactored security content

2022-03-09 14:43:09 +01:00

sunburst_correlation_dll_and_network_event.yml

Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.

2022-05-02 17:12:50 -07:00

suspicious_curl_network_connection.yml

Analytic Stories + Tagging

2022-07-27 10:29:47 -06:00

suspicious_plistbuddy_usage_via_osquery.yml

Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.

2022-05-02 17:12:50 -07:00

suspicious_plistbuddy_usage.yml

Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.

2022-05-02 17:12:50 -07:00

suspicious_sqlite3_lsquarantine_behavior.yml

Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.

2022-05-02 17:12:50 -07:00

unusual_number_of_computer_service_tickets_requested.yml

minor changes

2022-03-22 12:48:09 -04:00

unusual_number_of_remote_endpoint_authentication_events.yml

Refactored security content

2022-03-09 14:43:09 +01:00

unusually_long_command_line___mltk.yml

Refactored security content

2022-03-09 14:43:09 +01:00

unusually_long_command_line.yml

Refactored security content

2022-03-09 14:43:09 +01:00

windows_java_spawning_shells.yml

Refactored security content

2022-03-09 14:43:09 +01:00

winrm_spawning_a_process.yml

Updated a large number of the links in other detections. Also, adjusted the number of threads that run and tweaked the timeout time.

2022-05-03 10:34:10 -07:00

wmi_permanent_event_subscription.yml

Refactored security content

2022-03-09 14:43:09 +01:00

wmi_temporary_event_subscription.yml

Refactored security content

2022-03-09 14:43:09 +01:00