admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
fix_risky_command_csv
splunk-security_content/detections/deprecated
T
History
Bhavin Patel 22e5ea3f83 Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
..
abnormally_high_aws_instances_launched_by_user___mltk.yml
merged with develop
2023-03-03 12:40:16 +01:00
abnormally_high_aws_instances_launched_by_user.yml
merged with develop
2023-03-03 12:40:16 +01:00
abnormally_high_aws_instances_terminated_by_user___mltk.yml
merged with develop
2023-03-03 12:40:16 +01:00
abnormally_high_aws_instances_terminated_by_user.yml
merged with develop
2023-03-03 12:40:16 +01:00
asl_aws_createaccesskey.yml
Release Branch - ESCU v4.32.0
2024-05-22 16:47:39 +00:00
asl_aws_excessive_security_scanning.yml
Release Branch - ESCU v4.32.0
2024-05-22 16:47:39 +00:00
asl_aws_password_policy_changes.yml
Release Branch - ESCU v4.32.0
2024-05-22 16:47:39 +00:00
aws_cloud_provisioning_from_previously_unseen_city.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
aws_cloud_provisioning_from_previously_unseen_country.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
aws_cloud_provisioning_from_previously_unseen_ip_address.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
aws_cloud_provisioning_from_previously_unseen_region.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
aws_eks_kubernetes_cluster_sensitive_object_access.yml
merged with develop
2023-03-03 12:40:16 +01:00
clients_connecting_to_multiple_dns_servers.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
cloud_network_access_control_list_deleted.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
correlation_by_repository_and_risk.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
correlation_by_user_and_risk.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
detect_activity_related_to_pass_the_hash_attacks.yml
mionr
2023-05-03 11:58:17 -07:00
detect_api_activity_from_users_without_mfa.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
detect_aws_api_activities_from_unapproved_accounts.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
detect_long_dns_txt_record_response.yml
merged with ba ocsf work
2023-03-03 13:28:14 +01:00
detect_mimikatz_using_loaded_images.yml
Merge branch 'release_v4.13.0' into sysmon_fix
2023-09-28 12:38:50 -07:00
detect_mimikatz_via_powershell_and_eventcode_4703.yml
merged with develop
2023-03-03 12:40:16 +01:00
detect_new_api_calls_from_user_roles.yml
merged with develop
2023-03-03 12:40:16 +01:00
detect_new_user_aws_console_login.yml
merged with develop
2023-03-03 12:40:16 +01:00
detect_spike_in_aws_api_activity.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
detect_spike_in_network_acl_activity.yml
merged with develop
2023-03-03 12:40:16 +01:00
detect_spike_in_security_group_activity.yml
merged with develop
2023-03-03 12:40:16 +01:00
detect_usb_device_insertion.yml
merged with develop
2023-03-03 12:40:16 +01:00
detect_web_traffic_to_dynamic_domain_providers.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
detection_of_dns_tunnels.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
dns_query_requests_resolved_by_unauthorized_dns_servers.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
dns_record_changed.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
dump_lsass_via_procdump_rename.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
ec2_instance_modified_with_previously_unseen_user.yml
merged with develop
2023-03-03 12:40:16 +01:00
ec2_instance_started_in_previously_unseen_region.yml
merged with develop
2023-03-03 12:40:16 +01:00
ec2_instance_started_with_previously_unseen_ami.yml
merged with develop
2023-03-03 12:40:16 +01:00
ec2_instance_started_with_previously_unseen_instance_type.yml
merged with develop
2023-03-03 12:40:16 +01:00
ec2_instance_started_with_previously_unseen_user.yml
merged with develop
2023-03-03 12:40:16 +01:00
execution_of_file_with_spaces_before_extension.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
extended_period_without_successful_netbackup_backups.yml
merged with develop
2023-03-03 12:40:16 +01:00
first_time_seen_command_line_argument.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
gcp_detect_accounts_with_high_risk_roles_by_project.yml
merged with develop
2023-03-03 12:40:16 +01:00
gcp_detect_high_risk_permissions_by_resource_and_account.yml
merged with develop
2023-03-03 12:40:16 +01:00
gcp_detect_oauth_token_abuse.yml
merged with develop
2023-03-03 12:40:16 +01:00
gcp_kubernetes_cluster_scan_detection.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
identify_new_user_accounts.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
kubernetes_aws_detect_most_active_service_accounts_by_pod.yml
merged with develop
2023-03-03 12:40:16 +01:00
kubernetes_aws_detect_rbac_authorization_by_account.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
kubernetes_aws_detect_sensitive_role_access.yml
merged with develop
2023-03-03 12:40:16 +01:00
kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml
merged with develop
2023-03-03 12:40:16 +01:00
kubernetes_azure_active_service_accounts_by_pod_namespace.yml
merged with develop
2023-03-03 12:40:16 +01:00
kubernetes_azure_detect_rbac_authorization_by_account.yml
merged with develop
2023-03-03 12:40:16 +01:00
kubernetes_azure_detect_sensitive_object_access.yml
merged with develop
2023-03-03 12:40:16 +01:00
kubernetes_azure_detect_sensitive_role_access.yml
merged with develop
2023-03-03 12:40:16 +01:00
kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml
merged with develop
2023-03-03 12:40:16 +01:00
kubernetes_azure_detect_suspicious_kubectl_calls.yml
merged with develop
2023-03-03 12:40:16 +01:00
kubernetes_azure_pod_scan_fingerprint.yml
merged with develop
2023-03-03 12:40:16 +01:00
kubernetes_azure_scan_fingerprint.yml
merged with develop
2023-03-03 12:40:16 +01:00
kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml
merged with develop
2023-03-03 12:40:16 +01:00
kubernetes_gcp_detect_rbac_authorizations_by_account.yml
merged with develop
2023-03-03 12:40:16 +01:00
kubernetes_gcp_detect_sensitive_object_access.yml
merged with develop
2023-03-03 12:40:16 +01:00
kubernetes_gcp_detect_sensitive_role_access.yml
merged with develop
2023-03-03 12:40:16 +01:00
kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml
merged with develop
2023-03-03 12:40:16 +01:00
kubernetes_gcp_detect_suspicious_kubectl_calls.yml
merged with develop
2023-03-03 12:40:16 +01:00
monitor_dns_for_brand_abuse.yml
merged with develop
2023-03-03 12:40:16 +01:00
multiple_okta_users_with_invalid_credentials_from_the_same_ip.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
o365_suspicious_admin_email_forwarding.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
o365_suspicious_rights_delegation.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
o365_suspicious_user_email_forwarding.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
okta_account_locked_out.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
okta_account_lockout_events.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
okta_failed_sso_attempts.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
okta_threatinsight_login_failure_with_high_unknown_users.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
okta_threatinsight_suspected_passwordspray_attack.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
okta_two_or_more_rejected_okta_pushes.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
open_redirect_in_splunk_web.yml
merged with develop
2023-03-03 12:40:16 +01:00
osquery_pack___coldroot_detection.yml
merged with develop
2023-03-03 12:40:16 +01:00
processes_created_by_netsh.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
prohibited_software_on_endpoint.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
reg_exe_used_to_hide_files_directories_via_registry_keys.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
remote_registry_key_modifications.yml
merged with develop
2023-03-03 12:40:16 +01:00
scheduled_tasks_used_in_badrabbit_ransomware.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
spectre_and_meltdown_vulnerable_systems.yml
merged with develop
2023-03-03 12:40:16 +01:00
splunk_enterprise_information_disclosure.yml
merged with develop
2023-03-03 12:40:16 +01:00
suspicious_changes_to_file_associations.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
suspicious_email___uba_anomaly.yml
merged with develop
2023-03-03 12:40:16 +01:00
suspicious_file_write.yml
merged with develop
2023-03-03 12:40:16 +01:00
suspicious_powershell_command_line_arguments.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
suspicious_rundll32_rename.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
suspicious_writes_to_system_volume_information.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
uncommon_processes_on_endpoint.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
unsigned_image_loaded_by_lsass.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
unsuccessful_netbackup_backups.yml
merged with develop
2023-03-03 12:40:16 +01:00
web_fraud___account_harvesting.yml
merged with develop
2023-03-03 12:40:16 +01:00
web_fraud___anomalous_user_clickspeed.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
web_fraud___password_sharing_across_accounts.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
windows_connhost_exe_started_forcefully.yml
Edit how_to_implement for Endpoint.Processes
2023-09-15 10:58:38 -07:00
windows_dll_search_order_hijacking_hunt.yml
Release Branch - ESCU v4.32.0
2024-05-22 16:47:39 +00:00
windows_hosts_file_modification.yml
merged with develop
2023-03-03 12:40:16 +01:00