Nasreddine Bencherchali bc1b413923 Fix Reported Issues - April Batch (#3962) ...

* Fix #3961

* Fix #3909

* Fix output fields

* Remove duplicate process_name entry

* Update outbound_network_connection_from_java_using_default_ports.yml

* Update detect_computer_changed_with_anonymous_account.yml

* Update detect_computer_changed_with_anonymous_account.yml

* Fix #3969

* update palo alto TA and beautify analytics

* Update vmware_aria_operations_exploit_attempt.yml

* fix source

* enhance metadata and fp info

* beautify spl for ease of reading

* add some missing attack techniques

* remove unnecessary usage of regex

* Update windows_uac_bypass_suspicious_escalation_behavior.yml

* small fix

* Refine description and improve regex

* Update windows_uac_bypass_suspicious_escalation_behavior.yml

* Update possible_lateral_movement_powershell_spawn.yml

* Update possible_lateral_movement_powershell_spawn.yml

* Update windows_event_log_security_4756.yml

* description update

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>

2026-03-30 14:34:11 +05:30

..

cisco_ai_defense_security_alerts_by_application_name.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_asa___aaa_policy_tampering.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_asa___core_syslog_message_volume_drop.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_asa___device_file_copy_activity.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_asa___device_file_copy_to_remote_location.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_asa___logging_disabled_via_cli.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

cisco_asa___logging_filters_configuration_tampering.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_asa___logging_message_suppression.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_asa___new_local_user_account_created.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_asa___packet_capture_activity.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_asa___reconnaissance_command_activity.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_asa___user_account_deleted_from_local_database.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_asa___user_account_lockout_threshold_exceeded.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_asa___user_privilege_level_change.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_duo_admin_login_unusual_browser.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

cisco_duo_admin_login_unusual_country.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

cisco_duo_admin_login_unusual_os.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

cisco_duo_bulk_policy_deletion.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

cisco_duo_bypass_code_generation.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

cisco_duo_policy_allow_devices_without_screen_lock.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

cisco_duo_policy_allow_network_bypass_2fa.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

cisco_duo_policy_allow_old_flash.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

cisco_duo_policy_allow_old_java.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

cisco_duo_policy_allow_tampered_devices.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

cisco_duo_policy_bypass_2fa.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

cisco_duo_policy_deny_access.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

cisco_duo_policy_skip_2fa_for_other_countries.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

cisco_duo_set_user_status_to_bypass_2fa.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

crushftp_server_side_template_injection.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

detect_distributed_password_spray_attempts.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

detect_html_help_spawn_child_process.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

detect_new_login_attempts_to_routers.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

detect_password_spray_attempts.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

email_attachments_with_lots_of_spaces.yml

Fix Reported Issues - April Batch (#3962)

2026-03-30 14:34:11 +05:30

email_files_written_outside_of_the_outlook_directory.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

email_servers_sending_high_volume_traffic_to_hosts.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

esxi_account_modified.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

esxi_audit_tampering.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

esxi_bulk_vm_termination.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

esxi_download_errors.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

esxi_encryption_settings_modified.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

esxi_external_root_login_activity.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

esxi_firewall_disabled.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

esxi_lockdown_mode_disabled.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

esxi_loghost_config_tampering.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

esxi_malicious_vib_forced_install.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

esxi_reverse_shell_patterns.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

esxi_sensitive_files_accessed.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

esxi_shared_or_stolen_root_account.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

esxi_shell_access_enabled.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

esxi_ssh_brute_force.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

esxi_ssh_enabled.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

esxi_syslog_config_change.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

esxi_system_clock_manipulation.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

esxi_system_information_discovery.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

esxi_user_granted_admin_role.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

esxi_vib_acceptance_level_tampering.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

esxi_vm_discovery.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

esxi_vm_exported_via_remote_tool.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

ivanti_vtm_new_account_creation.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

m365_copilot_agentic_jailbreak_attack.yml

Tweaking attack_data links (#3966)

2026-03-23 14:38:28 +01:00

m365_copilot_application_usage_pattern_anomalies.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

m365_copilot_failed_authentication_patterns.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

m365_copilot_impersonation_jailbreak_attack.yml

Tweaking attack_data links (#3966)

2026-03-23 14:38:28 +01:00

m365_copilot_information_extraction_jailbreak_attack.yml

Tweaking attack_data links (#3966)

2026-03-23 14:38:28 +01:00

m365_copilot_jailbreak_attempts.yml

Tweaking attack_data links (#3966)

2026-03-23 14:38:28 +01:00

m365_copilot_non_compliant_devices_accessing_m365_copilot.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

m365_copilot_session_origin_anomalies.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

mcp_filesystem_server_suspicious_extension_write.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

mcp_github_suspicious_operation.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

mcp_postgres_suspicious_query.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

mcp_prompt_injection.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

mcp_sensitive_system_file_search.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

monitor_email_for_brand_abuse.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

no_windows_updates_in_a_time_frame.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

okta_authentication_failed_during_mfa_challenge.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

okta_idp_lifecycle_modifications.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

okta_mfa_exhaustion_hunt.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

okta_mismatch_between_source_and_response_for_verify_push_request.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

okta_multi_factor_authentication_disabled.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

okta_multiple_accounts_locked_out.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

okta_multiple_failed_mfa_requests_for_user.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

okta_multiple_failed_requests_to_access_applications.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

okta_multiple_users_failing_to_authenticate_from_ip.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

okta_new_api_token_created.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

okta_new_device_enrolled_on_account.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

okta_phishing_detection_with_fastpass_origin_check.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

okta_risk_threshold_exceeded.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

okta_successful_single_factor_authentication.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

okta_suspicious_activity_reported.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

okta_suspicious_use_of_a_session_cookie.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

okta_threatinsight_threat_detected.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

okta_unauthorized_access_to_application.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

okta_user_logins_from_multiple_cities.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

ollama_abnormal_network_connectivity.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

ollama_abnormal_service_crash_availability_attack.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

ollama_excessive_api_requests.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

ollama_possible_api_endpoint_scan_reconnaissance.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

ollama_possible_memory_exhaustion_resource_abuse.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

ollama_possible_model_exfiltration_data_leakage.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

ollama_possible_rce_via_model_loading.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

ollama_suspicious_prompt_injection_jailbreak.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

pingid_mismatch_auth_source_and_verification_response.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

pingid_multiple_failed_mfa_requests_for_user.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

pingid_new_mfa_method_after_credential_reset.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

pingid_new_mfa_method_registered_for_user.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

splunk_appdynamics_secure_application_alerts.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

suspicious_email_attachment_extensions.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

suspicious_java_classes.yml

Fix Reported Issues - April Batch (#3962)

2026-03-30 14:34:11 +05:30

zoom_high_video_latency.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

zoom_rare_audio_devices.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

zoom_rare_input_devices.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

zoom_rare_video_devices.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30