admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
no_docker
splunk-security_content/detections/experimental/endpoint
T
History
Lou Stella 986716a55f IceID -> IcedID
2022-09-22 09:20:02 -05:00
..
.untested
detection/experimental folder for untested detections
2020-11-06 10:37:11 -08:00
child_processes_of_spoolsv_exe.yml
secondbatchwinprivesctaghermeticwiper
2022-04-05 08:02:47 -07:00
detect_baron_samedit_cve_2021_3156_segfault.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_baron_samedit_cve_2021_3156_via_osquery.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_baron_samedit_cve_2021_3156.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_computer_changed_with_anonymous_account.yml
The Unbroken Haag
2021-12-06 11:57:20 -07:00
detect_outlook_exe_writing_a_zip_file.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_rare_executables.yml
Added automaticc generation of finding report
2022-03-14 12:12:48 +01:00
detection_of_tools_built_by_nirsoft.yml
Refactored security content
2022-03-09 14:43:09 +01:00
exchange_powershell_abuse_via_ssrf.yml
Refactored security content
2022-03-09 14:43:09 +01:00
exchange_powershell_module_usage.yml
Update exchange_powershell_module_usage.yml
2022-05-02 06:32:55 -06:00
first_time_seen_child_process_of_zoom.yml
Refactored security content
2022-03-09 14:43:09 +01:00
first_time_seen_running_windows_service.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_stdout_redirection_to_dev_null_file.yml
fixedtagcb
2022-05-03 09:45:47 -07:00
macos___re_opened_applications.yml
Added automaticc generation of finding report
2022-03-14 12:12:48 +01:00
ms_exchange_mailbox_replication_service_writing_active_server_pages.yml
all the changes again
2022-03-16 13:35:48 -07:00
print_processor_registry_autostart.yml
secondbatchwinprivesctaghermeticwiper
2022-04-05 08:02:47 -07:00
processes_tapping_keyboard_events.yml
Added automaticc generation of finding report
2022-03-14 12:12:48 +01:00
randomly_generated_scheduled_task_name.yml
CISA AA22-257A tag
2022-09-15 10:07:38 -06:00
randomly_generated_windows_service_name.yml
Refactored security content
2022-03-09 14:43:09 +01:00
remote_desktop_process_running_on_system.yml
Refactored security content
2022-03-09 14:43:09 +01:00
spike_in_file_writes.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___anomalous_usage_of_account_credentials.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___detect_kerberoasting.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___disable_defender_antivirus_registry.yml
IceID -> IcedID
2022-09-22 09:20:02 -05:00
ssa___excessive_number_of_office_files_copied.yml
adding insider threat, fixing minor display bug
2022-05-19 21:19:35 -04:00
ssa___first_time_seen_cmd_line.yml
Added automaticc generation of finding report
2022-03-14 12:12:48 +01:00
ssa___high_file_deletion_frequency.yml
Branch was auto-updated.
2022-05-19 21:21:59 -04:00
ssa___rare_parent_process_relationship_lolbas.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ssa___windows_wsreset_uac_bypass.yml
Refactored security content
2022-03-09 14:43:09 +01:00
sunburst_correlation_dll_and_network_event.yml
Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.
2022-05-02 17:12:50 -07:00
suspicious_curl_network_connection.yml
Analytic Stories + Tagging
2022-07-27 10:29:47 -06:00
suspicious_plistbuddy_usage_via_osquery.yml
Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.
2022-05-02 17:12:50 -07:00
suspicious_plistbuddy_usage.yml
Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.
2022-05-02 17:12:50 -07:00
suspicious_sqlite3_lsquarantine_behavior.yml
Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.
2022-05-02 17:12:50 -07:00
unusual_number_of_computer_service_tickets_requested.yml
minor changes
2022-03-22 12:48:09 -04:00
unusual_number_of_remote_endpoint_authentication_events.yml
Refactored security content
2022-03-09 14:43:09 +01:00
unusually_long_command_line___mltk.yml
Refactored security content
2022-03-09 14:43:09 +01:00
unusually_long_command_line.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_java_spawning_shells.yml
Refactored security content
2022-03-09 14:43:09 +01:00
winrm_spawning_a_process.yml
Updated a large number of the links in other detections. Also, adjusted the number of threads that run and tweaked the timeout time.
2022-05-03 10:34:10 -07:00
wmi_permanent_event_subscription.yml
Refactored security content
2022-03-09 14:43:09 +01:00
wmi_temporary_event_subscription.yml
Refactored security content
2022-03-09 14:43:09 +01:00