admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
fix_appinspect_issues
splunk-security_content/lookups
T
History
pyth0n1c e8d1b150b4 Update appinspect to do more complete inspection, 
using precert and doing all inspection not
just cloud inspection, because it will catch
more issues with the package.  Also, update
some lookups that had commas in fields.
Finally, remove a column from one lookup
and the corresponding detection.
2023-05-04 16:06:04 -07:00
..
__mlspl_detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.mlmodel
adding detect suspicious dns txt records using pretrained model in dsdl
2023-01-17 15:26:01 -08:00
__mlspl_detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml
adding detect suspicious dns txt records using pretrained model in dsdl
2023-01-17 15:26:01 -08:00
__mlspl_detect_suspicious_processnames_using_pretrained_model_in_dsdl.mlmodel
Detection name update
2023-02-07 15:31:48 +01:00
__mlspl_detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml
Detection name update
2023-02-07 15:31:48 +01:00
__mlspl_pretrained_dga_model_dsdl.mlmodel
changing files
2022-09-28 12:36:40 -07:00
__mlspl_pretrained_dga_model_dsdl.yml
changing file names
2022-09-28 13:16:22 -07:00
__mlspl_risky_spl_pre_trained_model.mlmodel
model to detect risky commands
2022-06-29 23:45:27 +02:00
__mlspl_risky_spl_pre_trained_model.yml
model to detect risky commands
2022-06-23 22:43:22 +02:00
__mlspl_unusual_commandline_detection.mlmodel
Updating mlmodel to 5.3.x specification as well as the test apparatus
2022-01-25 21:42:16 -05:00
__mlspl_unusual_commandline_detection.yml
Update __mlspl_unusual_commandline_detection.yml
2022-01-26 11:26:25 -07:00
3cx_ioc_domains.csv
dns
2023-03-30 12:15:41 -06:00
3cx_ioc_domains.yml
dns
2023-03-30 12:15:41 -06:00
advanced_audit_policy_guids.csv
renaming advanced audit policy guids lookup
2023-02-13 12:03:49 -05:00
advanced_audit_policy_guids.yml
renaming advanced audit policy guids lookup
2023-02-13 12:03:49 -05:00
api_call_by_user_baseline.yml
Update api_call_by_user_baseline.yml
2020-08-18 15:28:54 -07:00
attacker_tools.csv
CISA and mimikatz add
2022-10-06 16:07:25 -06:00
attacker_tools.yml
lookup definitions
2021-07-12 19:02:32 -05:00
aws_service_accounts.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
aws_service_accounts.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
baseline_blocked_outbound_connections.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
baseline_blocked_outbound_connections.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
brand_monitoring.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
brandMonitoring_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
cloud_instances_enough_data.yml
Updated search for abnormally high cloud instances. Including
2020-08-25 22:28:59 -05:00
csc_lookup.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
csc_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
discovered_dns_records.csv
app inspect failures fixes
2020-12-08 14:56:39 -08:00
discovered_dns_records.yml
updated fields and added macros and lookup entries
2020-01-19 21:37:45 -05:00
domains.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
domains.yml
More language clean up
2021-01-22 09:34:33 -06:00
dynamic_dns_providers_default.csv
add additional dynamic domains
2020-10-13 12:44:52 -04:00
dynamic_dns_providers_default.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
dynamic_dns_providers_local.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
dynamic_dns_providers_local.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
escu_search_id_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
escu_search_id.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
hijacklibs.csv
T1003.001 Update
2022-08-25 08:04:20 -06:00
hijacklibs.yml
fix
2022-08-19 15:21:15 -06:00
images_to_repository.csv
updated detections
2021-09-06 10:59:00 +02:00
images_to_repository.yml
updated detections
2021-09-06 10:59:00 +02:00
is_net_windows_file.csv
InstallUtil and DotNet Assemblies
2022-01-20 14:34:04 -07:00
is_net_windows_file.yml
InstallUtil and DotNet Assemblies
2022-01-20 14:34:04 -07:00
is_nirsoft_software.csv
Nirsoft Software
2022-01-24 15:07:20 -07:00
is_nirsoft_software.yml
Nirsoft Software
2022-01-24 15:07:20 -07:00
is_suspicious_file_extension_lookup.csv
add additional suspicious file extensions
2020-11-18 16:19:11 -05:00
is_suspicious_file_extension_lookup.yml
changed the file name of the .csv file and updated the associated yml file
2020-02-05 16:27:57 -07:00
is_windows_system_file.csv
Masquerading - detections + analytic story
2021-04-26 13:38:52 -06:00
is_windows_system_file.yml
InstallUtil and DotNet Assemblies
2022-01-20 14:34:04 -07:00
legit_domains.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
legit_domains.yml
More language clean up
2021-01-22 09:34:33 -06:00
linux_tool_discovery_process.csv
combined the rest 2
2022-02-17 16:28:19 -08:00
linux_tool_discovery_process.yml
rename typo
2022-02-24 14:14:13 -08:00
local_file_inclusion_paths.csv
new detection
2021-08-23 13:07:23 +02:00
local_file_inclusion_paths.yml
new detection
2021-08-23 10:21:21 +02:00
lolbas_file_path.csv
updating csv
2022-09-15 14:57:53 -04:00
lolbas_file_path.yml
working scripts
2022-09-08 18:01:46 -04:00
loldrivers.csv
Bespoke Drivers
2022-12-31 14:14:11 -07:00
loldrivers.yml
Bespoke Drivers
2022-12-31 14:14:11 -07:00
lookup_rare_process_allow_list_default.yml
More language clean up
2021-01-22 09:34:33 -06:00
lookup_rare_process_allow_list_local.yml
More language clean up
2021-01-22 09:34:33 -06:00
lookup_uncommon_processes_default.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
lookup_uncommon_processes_local.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
mandatory_job_for_workflow.csv
circle ci detecction
2021-09-02 10:42:01 +02:00
mandatory_job_for_workflow.yml
circle ci detecction
2021-09-02 10:42:01 +02:00
mandatory_step_for_job.csv
circle ci detecction
2021-09-01 17:54:38 +02:00
mandatory_step_for_job.yml
circle ci detecction
2021-09-01 17:54:38 +02:00
mitre_enrichment.csv
updating mitre_enrichment lookup
2022-05-20 16:15:18 -05:00
network_acl_activity_baseline.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
network_acl_activity_baseline.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_api_calls_from_user_roles.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_api_calls_from_user_roles.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_aws_cross_account_activity.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_aws_cross_account_activity.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_aws_regions.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_aws_regions.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_cloud_api_calls_per_user_role.yml
Added needed macros and lookups
2020-09-04 09:26:10 -05:00
previously_seen_cloud_compute_creations_by_user.yml
convert to kvstore and spl updates
2020-10-12 12:14:50 -07:00
previously_seen_cloud_compute_images.yml
convert to kvstore and spl updates
2020-10-12 12:14:50 -07:00
previously_seen_cloud_compute_instance_types.yml
spl updates and kvstore file
2020-10-12 11:49:37 -07:00
previously_seen_cloud_instance_modifications_by_user.yml
updating macro fields
2020-11-16 17:22:29 -08:00
previously_seen_cloud_provisioning_activity_sources.yml
Added needed macros and lookups
2020-09-04 09:26:10 -05:00
previously_seen_cloud_regions.yml
lookup errors and consistency
2020-10-12 11:26:57 -07:00
previously_seen_cmd_line_arguments.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_cmd_line_arguments.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_ec2_modifications_by_user.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_ec2_modifications_by_user.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_gcp_storage_access_from_remote_ip.csv
adding lookup files
2022-01-26 15:34:10 -08:00
previously_seen_gcp_storage_access_from_remote_ip.yml
adding lookup files
2022-01-26 15:34:10 -08:00
previously_seen_running_windows_services.yml
Changed running windows service to use kvstore as cache
2020-06-26 08:27:39 -05:00
previously_seen_S3_access_from_remote_ip.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_S3_access_from_remote_ip.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_users_console_logins.yml
creating collections and search updates
2020-09-30 11:25:37 -07:00
privileged_azure_ad_roles.csv
Update appinspect to do more complete inspection,
2023-05-04 16:06:04 -07:00
privileged_azure_ad_roles.yml
fixing lookup name typo
2022-08-29 17:30:34 -04:00
prohibited_apps_launching_cmd.csv
Adding node.exe as an app not allowed to spawn cmd.exe
2022-05-02 14:34:06 -05:00
prohibited_apps_launching_cmd.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
prohibited_processes.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
prohibited_processes.yml
fix_bugs
2020-12-11 10:51:02 +01:00
ransomware_extensions_lookup.yml
JSWorm ransomware notes and extensions added.
2021-06-02 16:26:02 +05:30
ransomware_extensions.csv
Added medusa ransomware file extension and note file names.
2023-03-14 18:35:46 +05:30
ransomware_notes_lookup.yml
Made ransomware notes lookup case insensitive.
2023-03-14 18:38:43 +05:30
ransomware_notes.csv
Code review change. Made change in the right file.
2023-03-20 22:04:10 +05:30
rare_process_allow_list_default.csv
fixing error reported by user
2021-02-16 09:45:00 -05:00
rare_process_allow_list_local.csv
fixing error reported by user
2021-02-16 09:45:00 -05:00
remote_access_software.csv
Fantastic IIS Modules and Where to Find Them
2022-12-21 08:53:03 -07:00
remote_access_software.yml
Remote Access Software
2022-08-22 21:57:53 -06:00
s3_deletion_baseline.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
s3_deletion_baseline.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
security_group_activity_baseline.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
security_group_activity_baseline.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
security_services_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
security_services.csv
Update security_services.csv
2022-07-07 10:43:17 -04:00
splunk_risky_command.csv
Update appinspect to do more complete inspection,
2023-05-04 16:06:04 -07:00
splunk_risky_command.yml
added all detections for release, still need to update dataset links
2023-02-14 06:46:13 -08:00
suspicious_files.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
suspicious_writes_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
uncommon_processes_default.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
uncommon_processes_local.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
windows_protocol_handlers.csv
Windows Protocol Handler
2022-07-12 14:43:39 -06:00
windows_protocol_handlers.yml
proto fix
2022-07-14 09:50:41 -06:00
zoom_first_time_child_process.yml
converted to spec3 and other updates
2020-05-28 13:31:49 -07:00