admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
fix_detection
splunk-security_content/stories
T
History
github-actions[bot] 84c4943005 Branch was auto-updated.
2021-04-27 17:56:07 +00:00
..
apache_struts_vulnerability.yml
added stories
2021-02-11 11:52:31 -05:00
asset_tracking.yml
added stories
2021-02-11 11:52:31 -05:00
aws_cross_account_activity.yml
added stories
2021-02-11 11:52:31 -05:00
aws_cryptomining.yml
added stories
2021-02-11 11:52:31 -05:00
aws_iam_privilege_escalation.yml
trailing whitespace
2021-03-29 10:54:20 -07:00
aws_network_acl_activity.yml
adding package type support
2021-03-29 16:27:20 -04:00
aws_security_hub_alerts.yml
adding package type support
2021-03-29 16:27:20 -04:00
aws_suspicious_provisioning_activities.yml
added stories
2021-02-11 11:52:31 -05:00
aws_user_monitoring.yml
added stories
2021-02-11 11:52:31 -05:00
baron_samedit_cve_2021_3156.yml
added stories
2021-02-11 11:52:31 -05:00
bits_jobs.yml
T1197 BITS Jobs
2021-03-30 14:49:44 -06:00
brand_monitoring.yml
added stories
2021-02-11 11:52:31 -05:00
cloud_cryptomining.yml
adding package type support
2021-03-29 16:27:20 -04:00
cloud_federated_credential_abuse.yml
adding package type support
2021-03-29 16:27:20 -04:00
cobalt_strike.yml
formatting updates
2021-03-04 06:05:17 -07:00
coldroot_macos_rat.yml
added stories
2021-02-11 11:52:31 -05:00
collection_and_staging.yml
added stories
2021-02-11 11:52:31 -05:00
command_and_control.yml
added stories
2021-02-11 11:52:31 -05:00
common_phishing_frameworks.yml
added stories
2021-02-11 11:52:31 -05:00
container_implantation_monitoring_and_investigation.yml
added stories
2021-02-11 11:52:31 -05:00
credential_dumping.yml
added stories
2021-02-11 11:52:31 -05:00
data_exfiltration.yml
added stories
2021-02-11 11:52:31 -05:00
data_protection.yml
added stories
2021-02-11 11:52:31 -05:00
deobfuscate_decode_files_or_information.yml
Analytic Story for certutil decode
2021-03-25 11:18:10 -06:00
detect_zerologon_attack.yml
added stories
2021-02-11 11:52:31 -05:00
dhs_report_ta18_074a.yml
added stories
2021-02-11 11:52:31 -05:00
disabling_security_tools.yml
added stories
2021-02-11 11:52:31 -05:00
dns_amplification_attacks.yml
added stories
2021-02-11 11:52:31 -05:00
dns_hijacking.yml
added stories
2021-02-11 11:52:31 -05:00
domain_trust_discovery.yml
Found error - typo
2021-03-31 14:18:05 -06:00
dynamic_dns.yml
added stories
2021-02-11 11:52:31 -05:00
emotet_malware__dhs_report_ta18_201a_.yml
added stories
2021-02-11 11:52:31 -05:00
f5_tmui_rce_cve_2020_5902.yml
added stories
2021-02-11 11:52:31 -05:00
gcp_cross_account_activity.yml
added stories
2021-02-11 11:52:31 -05:00
hafnium_group.yml
HAFNIUM and more updates
2021-03-03 14:10:11 -07:00
hidden_cobra_malware.yml
added stories
2021-02-11 11:52:31 -05:00
host_redirection.yml
added stories
2021-02-11 11:52:31 -05:00
ingress_tool_transfer.yml
fix again
2021-03-25 07:08:05 -06:00
jboss_vulnerability.yml
added stories
2021-02-11 11:52:31 -05:00
kubernetes_scanning_activity.yml
added stories
2021-02-11 11:52:31 -05:00
kubernetes_sensitive_object_access_activity.yml
added stories
2021-02-11 11:52:31 -05:00
kubernetes_sensitive_role_activity.yml
added stories
2021-02-11 11:52:31 -05:00
lateral_movement.yml
added stories
2021-02-11 11:52:31 -05:00
malicious_powershell.yml
added stories
2021-02-11 11:52:31 -05:00
masquerading___rename_system_utilities.yml
Masquerading - detections + analytic story
2021-04-26 13:38:52 -06:00
monitor_backup_solution.yml
added stories
2021-02-11 11:52:31 -05:00
monitor_for_unauthorized_software.yml
added stories
2021-02-11 11:52:31 -05:00
monitor_for_updates.yml
added stories
2021-02-11 11:52:31 -05:00
netsh_abuse.yml
added stories
2021-02-11 11:52:31 -05:00
nobelium_group.yml
Detect Mimikatz Using Loaded Images
2021-03-05 13:10:59 -07:00
office_365_detections.yml
adding package type support
2021-03-29 16:27:20 -04:00
orangeworm_attack_group.yml
added stories
2021-02-11 11:52:31 -05:00
possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.yml
added stories
2021-02-11 11:52:31 -05:00
prohibited_traffic_allowed_or_protocol_mismatch.yml
added stories
2021-02-11 11:52:31 -05:00
ransomware_clop.yml
fixeddateandfirstsearch
2021-03-17 10:22:40 -04:00
ransomware_cloud.yml
adding package type support
2021-03-29 16:27:20 -04:00
ransomware_ryuk.yml
added stories
2021-02-11 11:52:31 -05:00
ransomware_samsam.yml
added stories
2021-02-11 11:52:31 -05:00
ransomware.yml
added stories
2021-02-11 11:52:31 -05:00
router_and_infrastructure_security.yml
added stories
2021-02-11 11:52:31 -05:00
silver_sparrow.yml
Fixes
2021-03-01 06:52:02 -07:00
spearphishing_attachments.yml
rename phishing payloads to spearphishing attachments
2021-04-21 10:04:40 -06:00
spectre_and_meltdown_vulnerabilities.yml
added stories
2021-02-11 11:52:31 -05:00
splunk_enterprise_vulnerability_cve_2018_11409.yml
added stories
2021-02-11 11:52:31 -05:00
splunk_enterprise_vulnerability.yml
added stories
2021-02-11 11:52:31 -05:00
sql_injection.yml
added stories
2021-02-11 11:52:31 -05:00
suspicious_aws_ec2_activities.yml
added stories
2021-02-11 11:52:31 -05:00
suspicious_aws_login_activities.yml
adding package type support
2021-03-29 16:27:20 -04:00
suspicious_aws_s3_activities.yml
adding package type support
2021-03-29 16:27:20 -04:00
suspicious_aws_traffic.yml
added stories
2021-02-11 11:52:31 -05:00
suspicious_cloud_authentication_activities.yml
adding package type support
2021-03-29 16:27:20 -04:00
suspicious_cloud_instance_activities.yml
adding package type support
2021-03-29 16:27:20 -04:00
suspicious_cloud_provisioning_activities.yml
adding package type support
2021-03-29 16:27:20 -04:00
suspicious_cloud_user_activities.yml
minor
2021-04-05 13:20:45 -07:00
suspicious_command_line_executions.yml
added stories
2021-02-11 11:52:31 -05:00
suspicious_compiled_html_activity.yml
Stories and analytics
2021-02-17 13:41:32 -07:00
suspicious_dns_traffic.yml
added stories
2021-02-11 11:52:31 -05:00
suspicious_emails.yml
added stories
2021-02-11 11:52:31 -05:00
suspicious_gcp_storage_activities.yml
fixing merge conflicts
2021-02-12 12:27:00 -05:00
suspicious_mshta_activity.yml
Fixes
2021-03-01 06:52:02 -07:00
suspicious_okta_activity.yml
added stories
2021-02-11 11:52:31 -05:00
suspicious_regsvcs_regasm_activity.yml
Stories and analytics
2021-02-17 13:41:32 -07:00
suspicious_regsvr32_activity.yml
fixing merge conflicts
2021-02-12 12:27:00 -05:00
suspicious_rundll32_activity.yml
fixing merge conflicts
2021-02-12 12:27:00 -05:00
suspicious_windows_registry_activities.yml
added stories
2021-02-11 11:52:31 -05:00
suspicious_wmi_use.yml
added stories
2021-02-11 11:52:31 -05:00
suspicious_zoom_child_processes.yml
added stories
2021-02-11 11:52:31 -05:00
trickbot.yml
trickbot
2021-04-26 17:01:03 +02:00
trusted_developer_utilities_proxy_execution_msbuild.yml
fixing merge conflicts
2021-02-12 12:27:00 -05:00
trusted_developer_utilities_proxy_execution.yml
added stories
2021-02-11 11:52:31 -05:00
unusual_aws_ec2_modifications.yml
added stories
2021-02-11 11:52:31 -05:00
unusual_processes.yml
added stories
2021-02-11 11:52:31 -05:00
use_of_cleartext_protocols.yml
added stories
2021-02-11 11:52:31 -05:00
web_fraud_detection.yml
added stories
2021-02-11 11:52:31 -05:00
windows_defense_evasion_tactics.yml
added stories
2021-02-11 11:52:31 -05:00
windows_discovery_techniques.yml
renaming product to new name
2021-04-21 18:23:09 -04:00
windows_dns_sigred_cve_2020_1350.yml
added stories
2021-02-11 11:52:31 -05:00
windows_file_extension_and_association_abuse.yml
added stories
2021-02-11 11:52:31 -05:00
windows_log_manipulation.yml
added stories
2021-02-11 11:52:31 -05:00
windows_persistence_techniques.yml
added stories
2021-02-11 11:52:31 -05:00
windows_privilege_escalation.yml
added stories
2021-02-11 11:52:31 -05:00
windows_service_abuse.yml
added stories
2021-02-11 11:52:31 -05:00