splunk-security_content

contextual_aws_network_interface_details.json

precommit check fixes

2018-12-20 14:32:13 -05:00

contextual_aws_s3_bucket_details.json

precommit check fixes

2018-12-20 14:32:13 -05:00

contextual_first_occurrence_mac_address.json

precommit check fixes

2018-12-20 14:32:13 -05:00

contextual_get_acl_details.json

precommit check fixes

2018-12-20 14:32:13 -05:00

contextual_get_authentication_logs_for_endpoint.json

precommit check fixes

2018-12-20 14:32:13 -05:00

contextual_get_backup_logs_for_endpoint.json

precommit check fixes

2018-12-20 14:32:13 -05:00

contextual_get_ec2_details_by_instance_id.json

precommit check fixes

2018-12-20 14:32:13 -05:00

contextual_get_ec2_launch_details.json

precommit check fixes

2018-12-20 14:32:13 -05:00

contextual_get_notable_history_for_endpoint.json

precommit check fixes

2018-12-20 14:32:13 -05:00

contextual_get_notable_info.json

precommit check fixes

2018-12-20 14:32:13 -05:00

contextual_get_risk_for_endpoint.json

precommit check fixes

2018-12-20 14:32:13 -05:00

contextual_get_risk_for_user.json

precommit check fixes

2018-12-20 14:32:13 -05:00

contextual_get_update_logs_for_endpoint.json

precommit check fixes

2018-12-20 14:32:13 -05:00

contextual_get_user_info_from_identity_table.json

precommit check fixes

2018-12-20 14:32:13 -05:00

contextual_get_vulnerability_logs_for_endpoint.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_abnormally_high_instance_termination.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_abnormally_high_instances_launched.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_account_harvesting.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_acl_with_open_ports.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_activity_related_to_pass_the_hash.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_add_to_untrust_cert_store.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_anomalous_webclick.json

bringing specs up to date with develop

2019-02-04 18:22:25 -05:00

detection_api_acitivity_from_previously_unseen_user_role.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_attackers_scanning_for_vulnerable_jboss_servers.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_attrib_to_hide_files.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_aws_activity_from_non_approved_accounts.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_aws_activity_in_new_region.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_aws_cloud_provisioning_from_previously_unseen_city.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_aws_cloud_provisioning_from_previously_unseen_country.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_aws_cloud_provisioning_from_previously_unseen_ip.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_aws_cloud_provisioning_from_previously_unseen_region.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_aws_cross_account_activity_from_new_account.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_aws_spike_acl_activity.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_badrabbit_schtasks.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_batch_file_write_system32.json

bringing specs up to date with develop

2019-02-04 18:22:25 -05:00

detection_brand_abuse_dns.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_brand_abuse_email.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_brand_abuse_web.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_change_file_association.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_children_of_spoolsv.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_clients_connecting_to_multiple_dns_servers.json

bringing specs up to date with develop

2019-02-04 18:22:25 -05:00

detection_common_ransomware_extensions.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_common_ransomware_notes.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_create_hidden_shares.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_create_local_admin_via_net.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_cred_dump_via_reg.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_cscript_via_cmd.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_delete_shadow_copies.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_deletion_network_acl.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_disable_remote_uac.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_dns_amplification_any_query.json

bringing specs up to date with develop

2019-02-04 18:22:25 -05:00

detection_dns_query_length_with_high_standard_deviation.json

bringing specs up to date with develop

2019-02-04 18:22:25 -05:00

detection_dns_tunnelling.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_dragonfly_schtasks.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_dyn_dns_queries.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_dyn_dns_web_traffic.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_ec2_instance_created_by_previously_unseen_user.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_ec2_instance_modified_by_previously_unseen_user.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_ec2_instance_started_with_previously_unseen_ami.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_ec2_instance_started_with_previously_unseen_instance_type.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_email_attachments_with_spaces.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_email_files_not_in_outlook_directory.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_emailserver_high_volume_outbound_traffic_to_hosts.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_excessive_dns_failures.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_excessive_lockouts_from_endpoint.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_excessive_user_account_lockouts.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_execution_of_nirsoft_tools.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_file_write_spikes.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_first_time_seen_cmd_line.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_first_time_seen_running_windows_service.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_fsutil_deleting_journals.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_hosts_file_modification.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_hosts_receiving_high_volume_network_traffic_from_email_servers.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_large_icmp_outbound.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_local_admin_account_creation.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_long_dns_text_response.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_malicious_application_shimming_via_registry.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_malicious_powershell_process_connect_to_internet_with_hidden_window.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_malicious_powershell_process_encoded_command.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_malicious_powershell_process_execpolicy.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_malicious_powershell_process_multiple_suspicious_arguments.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_malicious_powershell_process_obfuscation_techniques.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_malicious_requests_to_exploit_jboss_servers.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_mshta_launching_scripts.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_netbackup_failed_backup.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_netbackup_no_backups_in_time_period.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_netsh_launching_process.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_new_aws_console_login_by_user.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_new_connections_to_routers.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_new_open_s3_buckets.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_new_user_accounts.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_no_win_updates_in_timeframe.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_open_redirect_in_splunk_web.json

bringing specs up to date with develop

2019-02-04 18:22:25 -05:00

detection_osx_coldroot_pack.json

fixed manifest issues, updated providing technologies

2019-02-05 16:05:18 -05:00

detection_osx_keyboard_taps.json

fixed manifest issues, updated providing technologies

2019-02-05 16:05:18 -05:00

detection_outbound_smb_connections.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_overwrite_accessibility_binaries.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_password_sharing.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_path_interception_program.exe.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_port_monitor_via_registry.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_powershell_get_sedebug.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_powershell_read_from_lsass.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_powershell_reg_key_mod.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_process_launching_netsh.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_process_with_double_extension.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_process_with_spaces_before_extension.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_prohibited_allowed_through_fw.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_prohibited_apps_spawning_cmdprompt.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_prohibited_software_on_endpoint.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_protocol_mismatch.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_protocols_authenticating_in_cleartext.json

bringing specs up to date with develop

2019-02-04 18:22:25 -05:00

detection_psexec_accepteula.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_rare_executables_on_endpoint.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_reg_manipulating_services.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_reg_used_to_hide_files.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_registry_persistence.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_registry_privilege_escalation.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_remote_desktop_bruteforce.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_remote_desktop_network_traffic.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_remote_desktop_process_running_on_system.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_remote_registry_modifications.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_remote_wmi_command_attempt.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_remote_wmi_process_instantiation.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_rundll_loading_dll_by_ordinal.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_s3_access_from_new_ip.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_samsam_payload_extensions.json

bringing specs up to date with develop

2019-02-04 18:22:25 -05:00

detection_samsam_test_file_write.json

bringing specs up to date with develop

2019-02-04 18:22:25 -05:00

detection_sc_manipulating_services.json

pretty print

2018-12-20 11:53:20 -08:00

detection_schtasks_forced_reboot.json

pretty print

2018-12-20 11:53:20 -08:00

detection_schtasks_scheduling_job_on_remote_system.json

pretty print

2018-12-20 11:53:20 -08:00

detection_shim_database_file_creation.json

pretty print

2018-12-20 11:53:20 -08:00

detection_shim_database_installation.json

pretty print

2018-12-20 11:53:20 -08:00

detection_short_lived_accounts.json

pretty print

2018-12-20 11:53:20 -08:00

detection_single_letter_executables.json

pretty print

2018-12-20 11:53:20 -08:00

detection_smb_traffic_spike.json

pretty print

2018-12-20 11:53:20 -08:00

detection_sncd_processes.json

pretty print

2018-12-20 11:53:20 -08:00

detection_spectre_meltdown_vulnerabilities.json

pretty print

2018-12-20 11:53:20 -08:00

detection_spike_aws_api_call_per_account.json

pretty print

2018-12-20 11:53:20 -08:00

detection_spike_aws_security_group_activity.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_spike_s3_deletion.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_spike_vpc_blocked_traffic.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_splunk_information_disclosure.json

bringing specs up to date with develop

2019-02-04 18:22:25 -05:00

detection_sql_injection_with_long_urls.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_stop_security_services.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_suspicious_email_attachments.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_suspicious_file_writes.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_suspicious_java_classes.json

bringing specs up to date with develop

2019-02-04 18:22:25 -05:00

detection_suspicious_reg_process.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_suspicious_wevtutil_usage.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_suspicious_write_to_recycler.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_suspicious_write_to_sysvol.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_system_processes_run_from_unexpected_locations.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_tor_traffic.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_unauthorized_assets_via_mac_address.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_unauthorized_dns_servers.json

bringing specs up to date with develop

2019-02-04 18:22:25 -05:00

detection_uncommon_processes.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_unusually_long_commandlines.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_unusually_long_content-type_length.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_usb_insertion.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_users_without_mfa.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_web_servers_executing_suspicious_processes.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_windows_event_log_cleared.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_wmi_perm_event_subscription_sysmon.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_wmi_perm_event_subscription.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_wmi_process_launch.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_wmi_script_execution.json

precommit check fixes

2018-12-20 14:32:13 -05:00

detection_wmi_temp_event_subscription.json

precommit check fixes

2018-12-20 14:32:13 -05:00

investigative_aws_activity_via_region.json

precommit check fixes

2018-12-20 14:32:13 -05:00

investigative_aws_user_activities_by_user_field.json

precommit check fixes

2018-12-20 14:32:13 -05:00

investigative_aws_user_activity_by_accesskeyid.json

precommit check fixes

2018-12-20 14:32:13 -05:00

investigative_aws_user_activity_by_src_user.json

precommit check fixes

2018-12-20 14:32:13 -05:00

investigative_dns_server_history.json

precommit check fixes

2018-12-20 14:32:13 -05:00

investigative_dns_traffic_stats.json

precommit check fixes

2018-12-20 14:32:13 -05:00

investigative_email_sent_to_hidden_cobra_actors.json

precommit check fixes

2018-12-20 14:32:13 -05:00

investigative_get_all_aws_activitiy_from_city.json

precommit check fixes

2018-12-20 14:32:13 -05:00

investigative_get_all_aws_activitiy_from_country.json

precommit check fixes

2018-12-20 14:32:13 -05:00

investigative_get_all_aws_activitiy_from_region.json

precommit check fixes

2018-12-20 14:32:13 -05:00

investigative_get_all_aws_activitiy_from_src_ip.json

precommit check fixes

2018-12-20 14:32:13 -05:00

investigative_get_all_backup_data_for_host.json

precommit check fixes

2018-12-20 14:32:13 -05:00

investigative_get_email_info.json

precommit check fixes

2018-12-20 14:32:13 -05:00

investigative_get_emails_from_sender.json

precommit check fixes

2018-12-20 14:32:13 -05:00

investigative_get_logon_rights_modifications_for_endpoint.json

precommit check fixes

2018-12-20 14:32:13 -05:00

investigative_get_logon_rights_modifications_for_user.json

precommit check fixes

2018-12-20 14:32:13 -05:00

investigative_get_network_traffic_from_src_ip.json

precommit check fixes

2018-12-20 14:32:13 -05:00

investigative_get_parent_process_info.json

precommit check fixes

2018-12-20 14:32:13 -05:00

investigative_get_process_creating_dns_traffic.json

precommit check fixes

2018-12-20 14:32:13 -05:00

investigative_get_process_info_for_port.json

precommit check fixes

2018-12-20 14:32:13 -05:00

investigative_get_process_info.json

precommit check fixes

2018-12-20 14:32:13 -05:00

investigative_get_rdp_authentications.json

bringing specs up to date with develop

2019-02-04 18:22:25 -05:00

investigative_get_registry_activities.json

precommit check fixes

2018-12-20 14:32:13 -05:00

investigative_get_web_activity_by_src_ip.json

precommit check fixes

2018-12-20 14:32:13 -05:00

investigative_get_web_activity.json

precommit check fixes

2018-12-20 14:32:13 -05:00

investigative_get_web_posts_by_src.json

bringing specs up to date with develop

2019-02-04 18:22:25 -05:00

investigative_get_web_session_info.json

precommit check fixes

2018-12-20 14:32:13 -05:00

investigative_get_wmi_sysmon_events.json

precommit check fixes

2018-12-20 14:32:13 -05:00

investigative_suspicious_strings_in_HTTP_header.json

precommit check fixes

2018-12-20 14:32:13 -05:00

investigative_user_activity_via_cloudtrail.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_add_prohibited_processes_to_es.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_approved_aws_service_accounts.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_assets_sorted_by_category.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_baseline_api_calls_per_user_arn.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_baseline_aws_regions.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_baseline_blocked_vpc_traffic.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_baseline_network_acl_modifications.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_baseline_s3_deletion_by_arn.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_baseline_security_group_activity_by_arn.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_brand_abuse_dnstwist_domains.json

bringing specs up to date with develop

2019-02-04 18:22:25 -05:00

support_identify_ports_on_network.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_identify_systems_creating_rdp_traffic.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_identify_systems_receiving_rdp_traffic.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_identify_systems_using_remote_desktop.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_monitor_successful_backups.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_monitor_successful_windows_updates.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_monitor_unsuccessful_backups.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_monitor_unsuccessful_windows_updates.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_previously_seen_aws_cross_account_activity.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_previously_seen_cmd_arguments.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_previously_seen_ec2_amis.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_previously_seen_ec2_instance_types.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_previously_seen_ec2_launches_by_user.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_previously_seen_ec2_modifications.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_previously_seen_provisioning_activity_src.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_previously_seen_s3_remote_ip.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_previously_seen_user_roles.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_previously_seen_users.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_previously_seen_windows_service_starts.json

precommit check fixes

2018-12-20 14:32:13 -05:00

support_systems_ready_for_spectre_meltdown_patch.json

precommit check fixes

2018-12-20 14:32:13 -05:00