admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
risk_object_analysis
splunk-security_content/stories
T
History
Br3akp0int 7293d75700 Tagged Analytics Covering the Axios Compromise Post-Exploitation Activity (#3982) 
---------

Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com>
2026-04-02 16:07:20 +00:00
..
deprecated
remove yamls and update mapping
2025-04-15 15:19:48 -07:00
0bj3ctivity_stealer.yml
objectivity_stealer
2025-08-25 18:46:15 +02:00
3cx_supply_chain_attack.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
abnormal_kubernetes_behavior_using_splunk_infrastructure_monitoring.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
acidpour.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
acidrain.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
active_directory_discovery.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
active_directory_kerberos_attacks.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
active_directory_lateral_movement.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
active_directory_password_spraying.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
active_directory_privilege_escalation.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
adobe_coldfusion_arbitrary_code_execution_cve_2023_29298_cve_2023_26360.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
agenttesla.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
amadey.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
amos_stealer.yml
add analytic story
2025-05-05 15:05:24 +02:00
apache_struts_vulnerability.yml
Updating Terminology for ES8+ (#3875)
2026-01-22 22:59:29 +01:00
apache_tomcat_session_deserialization_attacks.yml
Haag Story 3: Attack Analytics to the Rescue
2025-03-25 14:08:02 -06:00
apt29_diplomatic_deceptions_with_wineloader.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
apt37_rustonotto_and_fadestealer.yml
APT 37 and The No Good Rustonotto (#3686)
2025-10-13 13:54:03 -07:00
arcanedoor.yml
updating links
2025-09-25 16:01:23 -07:00
asset_tracking.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
asyncrat.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
atlassian_confluence_server_and_data_center_cve_2022_26134.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
awfulshred.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
aws_bedrock_security.yml
updating spls to match with output from data sources
2025-04-17 14:49:05 -07:00
aws_defense_evasion.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
aws_iam_privilege_escalation.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
aws_identity_and_access_management_account_takeover.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
aws_network_acl_activity.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
aws_s3_bucket_security_monitoring.yml
first draft
2025-02-12 18:03:06 -05:00
aws_security_hub_alerts.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
aws_user_monitoring.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
axios_supply_chain_post_compromise.yml
Tagged Analytics Covering the Axios Compromise Post-Exploitation Activity (#3982)
2026-04-02 16:07:20 +00:00
azorult.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
azure_active_directory_account_takeover.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
azure_active_directory_persistence.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
azure_active_directory_privilege_escalation.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
backdoor_pingpong.yml
adding status
2025-01-27 19:15:49 -08:00
baron_samedit_cve_2021_3156.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
bishopfox_sliver_adversary_emulation_framework.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
bits_jobs.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
black_basta_ransomware.yml
systembc
2025-03-03 14:12:55 +01:00
blackbyte_ransomware.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
blacklotus_campaign.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
blackmatter_ransomware.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
blacksuit_ransomware.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
blankgrabber_stealer.yml
Add BlankGrabber Stealer Related Analytics and Tagging (#3943)
2026-03-16 18:09:57 +01:00
brand_monitoring.yml
Updating Terminology for ES8+ (#3875)
2026-01-22 22:59:29 +01:00
braodo_stealer.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
browser_hijacking.yml
Add Browser Hijack Analytics (#3841)
2026-01-12 13:05:22 +01:00
brute_ratel_c4.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
cactus_ransomware.yml
Haag's Last Shadow: The Cactus Ransomware Chronicles
2025-03-18 11:53:26 -06:00
caddy_wiper.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
castle_rat.yml
castlerat (#3750)
2025-11-07 11:08:44 -08:00
chaos_ransomware.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
china_nexus_threat_activity.yml
add additional references
2025-08-18 15:23:14 -04:00
cisa_aa22_257a.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
cisa_aa22_264a.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
cisa_aa22_277a.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
cisa_aa22_320a.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
cisa_aa23_347a.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
cisa_aa24_241a.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
cisco_catalyst_sd_wan_analytics.yml
Fix Broken Link, Versions and Pre-Commit (#3956)
2026-03-13 19:17:15 +05:30
cisco_duo_suspicious_activity.yml
feedback review
2025-07-21 09:47:20 +02:00
cisco_ios_xe_software_web_management_user_interface_vulnerability.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
cisco_isovalent_suspicious_activity.yml
Cisco Isovalent - Add first batch of new detections (#3706)
2026-01-06 01:24:39 +01:00
cisco_network_visibility_module_analytics.yml
add new detections, story and other cool things
2025-07-01 23:04:48 +02:00
cisco_secure_firewall_threat_defense_analytics.yml
cisco secure firewall detections - first batch
2025-04-03 14:21:27 +02:00
cisco_smart_install_remote_code_execution_cve_2018_0171.yml
Create cisco_smart_install_remote_code_execution_cve_2018_0171.yml
2025-08-21 08:16:14 -06:00
citrix_netscaler_adc_and_netscaler_gateway_cve_2023_4966.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
citrix_netscaler_adc_and_netscaler_gateway_cve_2025_5777.yml
Update citrix_netscaler_adc_and_netscaler_gateway_cve_2025_5777.yml
2025-07-09 10:46:27 -06:00
citrix_netscaler_adc_cve_2023_3519.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
citrix_sharefile_rce_cve_2023_24489.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
cleo_file_transfer_software.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
clop_ransomware.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
cloud_cryptomining.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
cloud_federated_credential_abuse.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
cobalt_strike.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
coldroot_macos_rat.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
collection_and_staging.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
command_and_control.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
compromised_linux_host.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
compromised_user_account.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
compromised_windows_host.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
confluence_data_center_and_confluence_server_vulnerabilities.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
connectwise_screenconnect_vulnerabilities.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
credential_dumping.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
critical_alerts.yml
Updating Terminology for ES8+ (#3875)
2026-01-22 22:59:29 +01:00
crushftp_vulnerabilities.yml
Haag's Crushed Shell: A Tale of CrushFTP Exploitation
2025-04-14 12:39:07 -06:00
crypto_stealer.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
cve_2022_40684_fortinet_appliance_auth_bypass.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
cve_2023_21716_word_rtf_heap_corruption.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
cve_2023_22515_privilege_escalation_vulnerability_confluence_data_center_and_server.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
cve_2023_23397_outlook_elevation_of_privilege.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
cve_2023_36884_office_and_windows_html_rce_vulnerability.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
cyclops_blink.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
darkcrystal_rat.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
darkgate_malware.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
darkside_ransomware.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
data_destruction.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
data_exfiltration.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
data_protection.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
defense_evasion_or_unauthorized_access_via_sddl_tampering.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
deobfuscate_decode_files_or_information.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
derusbi.yml
adding status
2025-01-27 19:15:49 -08:00
detect_zerologon_attack.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
dev_sec_ops.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
dhs_report_ta18_074a.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
disabling_security_tools.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
disk_wiper.yml
diskwiper
2025-06-27 09:44:32 +02:00
dns_amplification_attacks.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
dns_hijacking.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
domain_trust_discovery.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
double_zero_destructor.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
dynamic_dns.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
dynowiper.yml
Tag Content Related to Dynowiper/Zovwiper (#3907)
2026-02-17 23:52:23 +01:00
earth_alux.yml
Ground Control to Major Haag: Earth Alux
2025-04-16 21:55:12 -06:00
emotet_malware_dhs_report_ta18_201a.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
esxi_post_compromise.yml
Initial batch of ESXi content
2025-07-11 11:59:37 -04:00
f5_authentication_bypass_with_tmui.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
f5_big_ip_vulnerability_cve_2022_1388.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
f5_tmui_rce_cve_2020_5902.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
fake_captcha_campaigns.yml
CAPTCHA if you Can
2025-05-19 12:08:58 -06:00
fin7.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
flax_typhoon.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
forest_blizzard.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
fortinet_fortinac_cve_2022_39952.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
gcp_account_takeover.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
gcp_cross_account_activity.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
gh0st_rat.yml
gh0st (#3973)
2026-03-30 19:46:33 +05:30
ghostredirector_iis_module_and_rungan_backdoor.yml
GhostRedirectors
2025-09-18 13:39:40 -06:00
github_malicious_activity.yml
missing status field
2025-02-06 15:56:30 +01:00
gomir.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
gozi_malware.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
graceful_wipe_out_attack.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
hafnium_group.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
handala_wiper.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
hellcat_ransomware.yml
Hellcat United (#3723)
2025-10-16 16:53:02 -07:00
hermetic_wiper.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
hidden_cobra_malware.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
http_request_smuggling.yml
HTTP Request Smuggling (#3731)
2025-10-21 14:08:57 -07:00
icedid.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
iis_components.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
industroyer2.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
information_sabotage.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
ingress_tool_transfer.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
insider_threat.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
interlock_ransomware.yml
interlock_ransomware
2025-07-28 11:13:15 +02:00
interlock_rat.yml
interlock_ransomware
2025-07-29 12:05:44 +02:00
ivanti_connect_secure_vpn_vulnerabilities.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
ivanti_epm_vulnerabilities.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
ivanti_epmm_remote_unauthenticated_access.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
ivanti_sentry_authentication_bypass_cve_2023_38035.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
ivanti_virtual_traffic_manager_cve_2024_7593.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
jboss_vulnerability.yml
Updating Terminology for ES8+ (#3875)
2026-01-22 22:59:29 +01:00
jenkins_server_vulnerabilities.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
jetbrains_teamcity_unauthenticated_rce.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
jetbrains_teamcity_vulnerabilities.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
juniper_junos_remote_code_execution.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
kerberos_coercion_with_dns.yml
NTLM Reflection via DNS Object SPN Spoofing (#3789)
2025-11-18 12:59:34 -08:00
kubernetes_scanning_activity.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
kubernetes_security.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
kubernetes_sensitive_object_access_activity.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
lamehug.yml
lamehug
2025-08-27 13:50:38 +02:00
linux_living_off_the_land.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
linux_persistence_techniques.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
linux_post_exploitation.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
linux_privilege_escalation.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
linux_rootkit.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
living_off_the_land.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
local_privilege_escalation_with_krbrelayup.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
lockbit_ransomware.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
log4shell_cve_2021_44228.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
lokibot.yml
lokibot (#3701)
2025-10-10 18:32:18 +00:00
lotus_blossom_chrysalis_backdoor.yml
Add Lotus Blossom Related Analytics and Tagging (#3953)
2026-03-16 15:47:02 +01:00
lumma_stealer.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
malicious_inno_setup_loader.yml
quick fixes and updates
2025-06-17 20:32:55 +02:00
malicious_powershell.yml
Updating Terminology for ES8+ (#3875)
2026-01-22 22:59:29 +01:00
masquerading___rename_system_utilities.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
medusa_ransomware.yml
medusa_ransomware
2025-03-28 11:08:44 +01:00
medusa_rootkit.yml
Add Medusa content
2025-08-06 10:16:03 -05:00
meduza_stealer.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
metasploit.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
meterpreter.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
microsoft_mshtml_remote_code_execution_cve_2021_40444.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
microsoft_sharepoint_server_elevation_of_privilege_cve_2023_29357.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
microsoft_sharepoint_vulnerabilities.yml
Sharing is Caring: A story of CVE-2025-53770
2025-07-20 17:03:37 -06:00
microsoft_support_diagnostic_tool_vulnerability_cve_2022_30190.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
microsoft_wsus_cve_2025_59287.yml
WSUSpect in Custody: CVE-2025-59287 (#3743)
2025-10-27 09:48:44 -07:00
monitor_for_updates.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
moonpeak.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
moveit_transfer_authentication_bypass.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
moveit_transfer_critical_vulnerability.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
msix_package_abuse.yml
The Lost Payload: MSIX Resurrection
2025-08-18 11:46:34 -06:00
muddywater.yml
Add Analytic Story Tagging for Muddy Water (#3947)
2026-03-12 16:30:09 +00:00
nailaolocker_ransomware.yml
interlock_ransomware
2025-07-29 12:34:34 +02:00
netsh_abuse.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
netsupport_rmm_tool_abuse.yml
netsupport (#3798)
2025-11-21 13:27:52 -08:00
network_discovery.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
njrat.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
nobelium_group.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
notdoor_malware.yml
NotDoor Outlook Macro Detections
2025-09-11 11:42:25 -04:00
npm_supply_chain_compromise.yml
npm Supply Chain Compromise & Lifecycle Hook Abuse Detection (#3806)
2025-11-25 14:56:20 -08:00
office_365_account_takeover.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
office_365_collection_techniques.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
office_365_persistence_mechanisms.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
okta_account_takeover.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
okta_mfa_exhaustion.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
openssl_cve_2022_3602.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
oracle_e_business_suite_exploitation.yml
Add Oracle Exploitation Snort Coverage (#3742)
2025-10-23 14:49:04 -07:00
orangeworm_attack_group.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
outlook_rce_cve_2024_21378.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
papercut_mf_ng_vulnerability.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
pathwiper.yml
Update stories/pathwiper.yml
2025-08-25 13:22:30 +02:00
petitpotam_ntlm_relay_on_active_directory_certificate_services.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
phemedrone_stealer.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
php_cgi_rce_attack_on_japanese_organizations.yml
PHP-CGI RCE Attack on Japanese Organizations
2025-03-17 12:28:10 -06:00
plugx.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
prestige_ransomware.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
printnightmare_cve_2021_34527.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
prohibited_traffic_allowed_or_protocol_mismatch.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
promptflux.yml
Add New Analytics Covering SesameOp and PromptFlux (#3827)
2026-01-08 00:58:33 +01:00
promptlock.yml
promptlock
2025-09-10 09:55:05 +02:00
proxynotshell.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
proxyshell.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
pxa_stealer.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
qakbot.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
quasar_rat.yml
quasar_and_loader
2025-07-16 10:23:20 +02:00
quietvault.yml
Add Coverage For QuietVault (#3952)
2026-03-14 01:11:44 +01:00
ransomware_cloud.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
ransomware.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
react2shell.yml
React2Shell Analytics (#3819)
2025-12-08 15:47:53 +01:00
redline_stealer.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
remcos.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
remote_employment_fraud.yml
Initial remote employment fraud detections.
2025-06-12 14:43:59 -04:00
remote_monitoring_and_management_software.yml
normalize all legacy line endings (#3931)
2026-03-02 23:34:35 +01:00
reverse_network_proxy.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
revil_ransomware.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
rhysida_ransomware.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
router_and_infrastructure_security.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
ryuk_ransomware.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
salt_typhoon.yml
renamed_earth_erties
2025-03-19 16:07:11 +01:00
samaccountname_spoofing_and_domain_controller_impersonation.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
samsam_ransomware.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
sandworm_tools.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
sap_netweaver_exploitation.yml
BasketNetWeaving with Haag: No Shell Left Behind!
2025-04-28 10:33:17 -06:00
scattered_lapsus$_hunters.yml
Scattered Lapsus$ Hunters (#3724)
2025-10-21 11:27:25 -07:00
scattered_spider.yml
Updating Terminology for ES8+ (#3875)
2026-01-22 22:59:29 +01:00
scheduled_tasks.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
seashell_blizzard.yml
Update seashell_blizzard.yml
2025-03-28 12:02:11 -07:00
secret_blizzard.yml
Update stories/secret_blizzard.yml
2025-08-25 13:12:56 +02:00
security_solution_tampering.yml
Update security_solution_tampering.yml
2025-01-29 01:22:48 +01:00
sesameop.yml
Add New Analytics Covering SesameOp and PromptFlux (#3827)
2026-01-08 00:58:33 +01:00
shrinklocker.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
signed_binary_proxy_execution_installutil.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
silver_sparrow.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
snake_keylogger.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
snake_malware.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
snappybee.yml
headless_bee
2025-02-07 11:06:55 +01:00
sneaky_active_directory_persistence_tricks.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
solarwinds_whd_rce_post_exploitation.yml
Add SolarWinds WHD RCE Post Exploitation Coverage/Tagging (#3902)
2026-02-17 20:02:11 +01:00
spearphishing_attachments.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
spring4shell_cve_2022_22965.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
sql_injection.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
sql_server_abuse.yml
Haag's SQL Server Story Time: Tales of SQLCMD and Suspicious Queries 📚
2025-02-13 17:14:27 -07:00
stealc_stealer.yml
stealc (#3833)
2026-01-22 18:51:16 +05:30
storm_0501_ransomware.yml
Storm-0501 Ransomware Analytic Story and Tagging (#3871)
2026-01-22 22:32:14 +01:00
storm_2460_clfs_zero_day_exploitation.yml
The Haag Identity: Storm-2460 CLFS Zero Day
2025-04-16 21:25:23 -06:00
subvert_trust_controls_sip_and_trust_provider_hijacking.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
suspicious_aws_login_activities.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
suspicious_aws_s3_activities.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
suspicious_aws_traffic.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
suspicious_cisco_adaptive_security_appliance_activity.yml
Add New ASA Analytics (#3794)
2025-11-21 14:50:18 -08:00
suspicious_cloud_authentication_activities.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
suspicious_cloud_instance_activities.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
suspicious_cloud_provisioning_activities.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
suspicious_cloud_user_activities.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
suspicious_command_line_executions.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
suspicious_compiled_html_activity.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
suspicious_dns_traffic.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
suspicious_emails.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
suspicious_gcp_storage_activities.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
suspicious_local_llm_frameworks.yml
Rod- Suspicious Local LLM Frameworks (#3780)
2025-11-24 13:06:41 -08:00
suspicious_mcp_activities.yml
Add New MCP Related Detections (#3895)
2026-02-17 23:39:01 +01:00
suspicious_microsoft_365_copilot_activities.yml
Copilot based Detections (#3693)
2025-10-13 12:14:09 -07:00
suspicious_mshta_activity.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
suspicious_okta_activity.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
suspicious_ollama_activities.yml
Fixing typo in suspicious_ollama_activities.yml (#3783)
2025-11-13 17:14:15 -08:00
suspicious_regsvcs_regasm_activity.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
suspicious_regsvr32_activity.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
suspicious_rundll32_activity.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
suspicious_user_agents.yml
Detections for default user agents (#3842)
2026-01-07 09:34:04 +05:30
suspicious_windows_registry_activities.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
suspicious_wmi_use.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
suspicious_zoom_child_processes.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
swift_slicer.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
sysaid_on_prem_software_cve_2023_47246_vulnerability.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
systembc.yml
systembc
2025-02-28 12:00:07 +01:00
telnetd_cve_2026_24061.yml
Telnet Auth Bypass CVE (#3883)
2026-01-31 10:32:53 +05:30
termite_ransomware.yml
medusa_ransomware
2025-04-01 12:54:03 +02:00
text4shell_cve_2022_42889.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
trickbot.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
trusted_developer_utilities_proxy_execution_msbuild.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
trusted_developer_utilities_proxy_execution.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
tuoni.yml
Add tuoni content and named pipe detection (#3816)
2025-12-08 21:25:09 +01:00
unusual_processes.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
use_of_cleartext_protocols.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
valleyrat.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
vanhelsing_ransomware.yml
Update vanhelsing_ransomware.yml
2025-03-28 09:48:48 -07:00
vmware_aria_operations_vrealize_cve_2023_20887.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
vmware_esxi_ad_integration_authentication_bypass_cve_2024_37085.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
vmware_server_side_injection_and_privilege_escalation.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
void_manticore.yml
Add Tagging and Analytic Story for Void Manticore (#3959)
2026-03-23 17:19:07 +01:00
voidlink_cloud_native_linux_malware.yml
VoidLink Tagging (#3870)
2026-01-22 19:53:15 +05:30
volt_typhoon.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
warzone_rat.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
water_gamayun.yml
Water Gamayun
2025-04-17 11:26:37 -06:00
whispergate.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
windealer_rat.yml
adding status
2025-01-27 19:15:49 -08:00
windows_applocker.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
windows_attack_surface_reduction.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
windows_audit_policy_tampering.yml
Update windows_audit_policy_tampering.yml
2025-02-19 11:22:57 +01:00
windows_bootkits.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
windows_certificate_services.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
windows_defense_evasion_tactics.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
windows_discovery_techniques.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
windows_dns_sigred_cve_2020_1350.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
windows_drivers.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
windows_error_reporting_service_elevation_of_privilege_vulnerability.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
windows_file_extension_and_association_abuse.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
windows_log_manipulation.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
windows_persistence_techniques.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
windows_post_exploitation.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
windows_privilege_escalation.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
windows_rdp_artifacts_and_defense_evasion.yml
rdp_artifacts_and_evasion
2025-08-18 16:17:51 +02:00
windows_registry_abuse.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
windows_service_abuse.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
windows_system_binary_proxy_execution_msiexec.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
winrar_spoofing_attack_cve_2023_38831.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
winter_vivern.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
wordpress_vulnerabilities.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
ws_ftp_server_critical_vulnerabilities.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
xml_runner_loader.yml
Add Coverage and Tagging for the XML Runner Loader (#3897)
2026-02-17 20:20:36 +01:00
xmrig.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
xorddos.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00
xworm.yml
xworm
2025-05-08 11:00:32 +02:00
zdi_can_25373_windows_shortcut_exploit_abused_as_zero_day.yml
fixor
2025-04-01 14:37:35 -06:00
zovwiper.yml
Tag Content Related to Dynowiper/Zovwiper (#3907)
2026-02-17 23:52:23 +01:00
zscaler_browser_proxy_threats.yml
Add status deprecated/production to all stories and baselines as appropriate
2025-01-24 17:08:40 -08:00