Bhavin Patel 046acb8871 ESCU v4.26.0 Release branch

2024-03-06 19:30:20 +00:00

..

detect_arp_poisoning.yml

minor change for creating PR

2023-09-26 14:03:04 -07:00

detect_dga_domains_using_pretrained_model_in_dsdl.yml

Release v4.24.0

2024-02-14 23:54:00 +00:00

detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml

Update detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml

2023-06-12 14:41:43 -07:00

detect_hosts_connecting_to_dynamic_domain_providers.yml

merged with ba ocsf work

2023-03-03 13:28:14 +01:00

detect_ipv6_network_infrastructure_threats.yml

merged with develop

2023-03-03 12:40:16 +01:00

detect_large_outbound_icmp_packets.yml

merged with ba ocsf work

2023-03-03 13:28:14 +01:00

detect_outbound_ldap_traffic.yml

merged with develop

2023-03-03 12:40:16 +01:00

detect_outbound_smb_traffic.yml

merged with develop

2023-03-03 12:40:16 +01:00

detect_port_security_violation.yml

merged with develop

2023-03-03 12:40:16 +01:00

detect_remote_access_software_usage_dns.yml

ESCU v4.26.0 Release branch

2024-03-06 19:30:20 +00:00

detect_remote_access_software_usage_traffic.yml

ESCU v4.26.0 Release branch

2024-03-06 19:30:20 +00:00

detect_rogue_dhcp_server.yml

merged with develop

2023-03-03 12:40:16 +01:00

detect_snicat_sni_exfiltration.yml

merged with develop

2023-03-03 12:40:16 +01:00

detect_software_download_to_network_device.yml

merged with develop

2023-03-03 12:40:16 +01:00

detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml

addressing review feedback

2023-06-08 12:43:07 -07:00

detect_traffic_mirroring.yml

merged with develop

2023-03-03 12:40:16 +01:00

detect_unauthorized_assets_by_mac_address.yml

merged with develop

2023-03-03 12:40:16 +01:00

detect_windows_dns_sigred_via_splunk_stream.yml

updated with proper format

2023-10-13 13:32:37 -07:00

detect_windows_dns_sigred_via_zeek.yml

updated with proper format

2023-10-13 13:32:37 -07:00

detect_zerologon_via_zeek.yml

Release v4.18.0

2023-12-20 16:18:23 +00:00

dns_query_length_outliers___mltk.yml

merged with ba ocsf work

2023-03-03 13:28:14 +01:00

dns_query_length_with_high_standard_deviation.yml

Release v4.24.0

2024-02-14 23:54:00 +00:00

excessive_dns_failures.yml

merged with ba ocsf work

2023-03-03 13:28:14 +01:00

f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml

T1133 Tags + description updates

2023-06-01 13:44:32 -06:00

high_volume_of_bytes_out_to_url.yml

ESCU v4.26.0 Release branch

2024-03-06 19:30:20 +00:00

hosts_receiving_high_volume_of_network_traffic_from_email_server.yml

merged with develop

2023-03-03 12:40:16 +01:00

large_volume_of_dns_any_queries.yml

merged with develop

2023-03-03 12:40:16 +01:00

multiple_archive_files_http_post_traffic.yml

Release v4.24.0

2024-02-14 23:54:00 +00:00

ngrok_reverse_proxy_on_network.yml

merged with develop

2023-03-03 12:40:16 +01:00

plain_http_post_exfiltrated_data.yml

Release v4.24.0

2024-02-14 23:54:00 +00:00

prohibited_network_traffic_allowed.yml

merged with ba ocsf work

2023-03-03 13:28:14 +01:00

protocol_or_port_mismatch.yml

merged with ba ocsf work

2023-03-03 13:28:14 +01:00

protocols_passing_authentication_in_cleartext.yml

merged with develop

2023-03-03 12:40:16 +01:00

remote_desktop_network_bruteforce.yml

carry over

2023-05-01 12:07:20 -07:00

remote_desktop_network_traffic.yml

merged with develop

2023-03-03 12:40:16 +01:00

smb_traffic_spike___mltk.yml

update baseline time and text

2023-09-08 10:13:28 -07:00

smb_traffic_spike.yml

updated with proper format

2023-10-13 13:32:37 -07:00

splunk_identified_ssl_tls_certificates.yml

Fix a large number of searches with observable issues. Discuss with team before merging changes.

2023-09-22 17:10:03 -07:00

ssl_certificates_with_punycode.yml

merged with develop

2023-03-03 12:40:16 +01:00

tor_traffic.yml

updating tor detection

2023-09-20 11:55:18 -07:00

unusually_long_content_type_length.yml

merged with develop

2023-03-03 12:40:16 +01:00

windows_ad_replication_service_traffic.yml

Fixing some syntactic errors with a number of detections.

2023-04-12 10:09:43 -07:00

windows_ad_rogue_domain_controller_network_activity.yml

Fixing some syntactic errors with a number of detections.

2023-04-12 10:09:43 -07:00

zeek_x509_certificate_with_punycode.yml

merged with develop

2023-03-03 12:40:16 +01:00