admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
ocsf_detection_example
splunk-security_content/detections/experimental/endpoint
T
History
Michael Haag 9fc418583b Renamed story Outlook Elevation of Privilege
2023-03-21 12:05:31 -06:00
..
.untested
detection/experimental folder for untested detections
2020-11-06 10:37:11 -08:00
child_processes_of_spoolsv_exe.yml
secondbatchwinprivesctaghermeticwiper
2022-04-05 08:02:47 -07:00
detect_baron_samedit_cve_2021_3156_segfault.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_baron_samedit_cve_2021_3156_via_osquery.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_baron_samedit_cve_2021_3156.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_computer_changed_with_anonymous_account.yml
The Unbroken Haag
2021-12-06 11:57:20 -07:00
detect_outlook_exe_writing_a_zip_file.yml
Haageddon
2023-02-09 14:09:20 -07:00
detect_rare_executables.yml
SPL update
2022-11-10 12:45:28 -08:00
detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml
Detection name update
2023-02-07 18:42:51 +01:00
detection_of_tools_built_by_nirsoft.yml
Refactored security content
2022-03-09 14:43:09 +01:00
dllhost_with_no_command_line_arguments_with_network.yml
Merge branch 'develop' into duplicate_nter
2023-02-06 16:58:51 -08:00
exchange_powershell_abuse_via_ssrf.yml
rename
2022-10-09 06:58:13 -06:00
first_time_seen_child_process_of_zoom.yml
Refactored security content
2022-03-09 14:43:09 +01:00
first_time_seen_running_windows_service.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_stdout_redirection_to_dev_null_file.yml
fixedtagcb
2022-05-03 09:45:47 -07:00
macos___re_opened_applications.yml
Added automaticc generation of finding report
2022-03-14 12:12:48 +01:00
ms_exchange_mailbox_replication_service_writing_active_server_pages.yml
all the changes again
2022-03-16 13:35:48 -07:00
print_processor_registry_autostart.yml
secondbatchwinprivesctaghermeticwiper
2022-04-05 08:02:47 -07:00
processes_tapping_keyboard_events.yml
Added automaticc generation of finding report
2022-03-14 12:12:48 +01:00
randomly_generated_scheduled_task_name.yml
CISA AA22-257A tag
2022-09-15 10:07:38 -06:00
randomly_generated_windows_service_name.yml
Refactored security content
2022-03-09 14:43:09 +01:00
remote_desktop_process_running_on_system.yml
Refactored security content
2022-03-09 14:43:09 +01:00
spike_in_file_writes.yml
Refactored security content
2022-03-09 14:43:09 +01:00
sunburst_correlation_dll_and_network_event.yml
Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.
2022-05-02 17:12:50 -07:00
suspicious_curl_network_connection.yml
Analytic Stories + Tagging
2022-07-27 10:29:47 -06:00
suspicious_plistbuddy_usage_via_osquery.yml
Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.
2022-05-02 17:12:50 -07:00
suspicious_plistbuddy_usage.yml
Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.
2022-05-02 17:12:50 -07:00
suspicious_sqlite3_lsquarantine_behavior.yml
Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.
2022-05-02 17:12:50 -07:00
unusual_number_of_computer_service_tickets_requested.yml
minor changes
2022-03-22 12:48:09 -04:00
unusual_number_of_remote_endpoint_authentication_events.yml
Refactored security content
2022-03-09 14:43:09 +01:00
unusually_long_command_line___mltk.yml
Refactored security content
2022-03-09 14:43:09 +01:00
unusually_long_command_line.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_ad_domain_controller_audit_policy_disabled.yml
search formatting errors
2023-03-07 13:48:44 -08:00
windows_ad_domain_replication_acl_addition.yml
one more time
2023-03-07 14:34:30 -08:00
windows_ad_privileged_account_sid_history_addition.yml
fixing name
2023-03-03 17:33:42 -05:00
windows_driver_inventory.yml
experimental
2023-02-06 11:35:04 -07:00
windows_java_spawning_shells.yml
Haag is Back 🎆
2023-03-10 06:21:30 -07:00
windows_rundll32_webdav_with_network_connection.yml
Renamed story Outlook Elevation of Privilege
2023-03-21 12:05:31 -06:00
windows_vulnerable_driver_loaded.yml
Moving failing tests to experimental
2023-02-02 16:32:24 -08:00
winrm_spawning_a_process.yml
Updated a large number of the links in other detections. Also, adjusted the number of threads that run and tweaked the timeout time.
2022-05-03 10:34:10 -07:00
wmi_permanent_event_subscription.yml
Refactored security content
2022-03-09 14:43:09 +01:00
wmi_temporary_event_subscription.yml
Refactored security content
2022-03-09 14:43:09 +01:00