admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
fix_potential_input_output_lookup_issues
splunk-security_content/detections/network
T
History
Bhavin Patel 1c4c409f99 Branch was auto-updated.
2024-09-25 22:43:28 +05:30
..
detect_arp_poisoning.yml
network detections
2024-08-15 15:38:15 -05:00
detect_dga_domains_using_pretrained_model_in_dsdl.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
detect_hosts_connecting_to_dynamic_domain_providers.yml
First pass at required changes for lookups to detection files.
2024-08-15 15:31:54 -07:00
detect_ipv6_network_infrastructure_threats.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
detect_large_outbound_icmp_packets.yml
First pass at required changes for lookups to detection files.
2024-08-15 15:31:54 -07:00
detect_outbound_ldap_traffic.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
detect_outbound_smb_traffic.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
detect_port_security_violation.yml
Missed version and date updates
2024-08-16 08:41:51 -05:00
detect_remote_access_software_usage_dns.yml
Branch was auto-updated.
2024-09-04 15:58:10 +05:30
detect_remote_access_software_usage_traffic.yml
First pass at required changes for lookups to detection files.
2024-08-15 15:31:54 -07:00
detect_rogue_dhcp_server.yml
network detections
2024-08-15 15:38:15 -05:00
detect_snicat_sni_exfiltration.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
detect_software_download_to_network_device.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
detect_traffic_mirroring.yml
network detections
2024-08-15 15:38:15 -05:00
detect_unauthorized_assets_by_mac_address.yml
First pass at required changes for lookups to detection files.
2024-08-15 15:31:54 -07:00
detect_windows_dns_sigred_via_splunk_stream.yml
network detections
2024-08-15 15:38:15 -05:00
detect_windows_dns_sigred_via_zeek.yml
second pass at fixing whitespace and related update fields
2024-09-24 16:53:25 -07:00
detect_zerologon_via_zeek.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
dns_query_length_outliers___mltk.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
dns_query_length_with_high_standard_deviation.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
excessive_dns_failures.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml
The Haag Element: Breaking Down AA24-241A
2024-09-03 13:03:21 -06:00
high_volume_of_bytes_out_to_url.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
hosts_receiving_high_volume_of_network_traffic_from_email_server.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
internal_horizontal_port_scan.yml
updating risk_message
2024-08-07 12:50:29 -07:00
internal_vertical_port_scan.yml
updating data source files
2024-07-16 08:11:24 -07:00
internal_vulnerability_scan.yml
updating descriptions
2024-07-11 18:06:51 +10:00
large_volume_of_dns_any_queries.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
multiple_archive_files_http_post_traffic.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
ngrok_reverse_proxy_on_network.yml
The Haag Element: Breaking Down AA24-241A
2024-09-03 13:03:21 -06:00
plain_http_post_exfiltrated_data.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
prohibited_network_traffic_allowed.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
protocol_or_port_mismatch.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
protocols_passing_authentication_in_cleartext.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
remote_desktop_network_bruteforce.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
remote_desktop_network_traffic.yml
First pass at required changes for lookups to detection files.
2024-08-15 15:31:54 -07:00
smb_traffic_spike___mltk.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
smb_traffic_spike.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
ssl_certificates_with_punycode.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
tor_traffic.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
unusually_long_content_type_length.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
windows_ad_replication_service_traffic.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
windows_ad_rogue_domain_controller_network_activity.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
zeek_x509_certificate_with_punycode.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00