admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
run_detections
splunk-security_content/detections
T
History
bpatel 9755770513 detect checks
2019-10-10 14:19:35 -07:00
..
abnormally_high_instance_termination.json
removing html tags
2019-09-04 12:20:27 -04:00
abnormally_high_instances_launched.json
removing html tags
2019-09-04 12:20:27 -04:00
account_harvesting.json
Modified att&ck mappings for these files. Mostly just added the high level tactic, but also tweaked some incluidng smb spike searches and ones about creating accounts
2019-08-22 09:57:45 -06:00
acl_with_open_ports.json
Owner reviewed
2019-08-15 17:37:44 -07:00
activity_related_to_pass_the_hash.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
add_to_untrust_cert_store.json
removing html tags
2019-09-04 12:20:27 -04:00
anomalous_webclick.json
Modified att&ck mappings for these files. Mostly just added the high level tactic, but also tweaked some incluidng smb spike searches and ones about creating accounts
2019-08-22 09:57:45 -06:00
api_acitivity_from_previously_unseen_user_role.json
removing html tags
2019-09-04 12:20:27 -04:00
attackers_scanning_for_vulnerable_jboss_servers.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
attrib_to_hide_files.json
removing html tags
2019-09-04 12:20:27 -04:00
aws_activity_from_non_approved_accounts.json
correcting new line char
2019-09-11 15:58:02 -04:00
aws_activity_in_new_region.json
removing html tags
2019-09-04 12:20:27 -04:00
aws_cloud_provisioning_from_previously_unseen_city.json
correcting new line char
2019-09-11 15:58:02 -04:00
aws_cloud_provisioning_from_previously_unseen_country.json
correcting new line char
2019-09-11 15:58:02 -04:00
aws_cloud_provisioning_from_previously_unseen_ip.json
correcting new line char
2019-09-11 15:58:02 -04:00
aws_cloud_provisioning_from_previously_unseen_region.json
correcting new line char
2019-09-11 15:58:02 -04:00
aws_cross_account_activity_from_new_account.json
correcting new line char
2019-09-11 15:58:02 -04:00
aws_spike_acl_activity.json
correcting new line char
2019-09-11 15:58:02 -04:00
badrabbit_schtasks.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
batch_file_write_system32.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
brand_abuse_dns.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
brand_abuse_email.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
brand_abuse_web.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
change_file_association.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
children_of_spoolsv.json
removing html tags
2019-09-04 12:20:27 -04:00
clients_connecting_to_multiple_dns_servers.json
correcting new line char
2019-09-11 15:58:02 -04:00
common_ransomware_extensions.json
correcting new line char
2019-09-11 15:58:02 -04:00
common_ransomware_notes.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
create_hidden_shares.json
removing html tags
2019-09-04 12:20:27 -04:00
create_local_admin_via_net.json
removing html tags
2019-09-04 12:20:27 -04:00
cred_dump_via_reg.json
fixed channel in stories, minor tweaks to detections.
2019-08-06 14:58:39 -06:00
cscript_via_cmd.json
manifest and search updates
2019-10-04 15:15:53 -07:00
delete_shadow_copies.json
fixed channel in stories, minor tweaks to detections.
2019-08-06 14:58:39 -06:00
deletion_network_acl.json
Owner reviewed
2019-08-15 17:37:44 -07:00
disable_remote_uac.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
dns_amplification_any_query.json
removing html tags
2019-09-04 12:20:27 -04:00
dns_evilginx_subdomains.json
correcting new line char
2019-09-11 15:58:02 -04:00
dns_query_length_mltk.json
correcting new line char
2019-09-11 15:58:02 -04:00
dns_query_length_with_high_standard_deviation.json
updated to v2 spec
2019-08-14 12:03:19 -04:00
dns_record_changed.json
correcting new line char
2019-09-11 15:58:02 -04:00
dns_tunnelling.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
dragonfly_schtasks.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
dyn_dns_queries.json
correcting new line char
2019-09-11 15:58:02 -04:00
dyn_dns_web_traffic.json
correcting new line char
2019-09-11 15:58:02 -04:00
ec2_instance_created_by_previously_unseen_user.json
removing html tags
2019-09-04 12:20:27 -04:00
ec2_instance_modified_by_previously_unseen_user.json
removing html tags
2019-09-04 12:20:27 -04:00
ec2_instance_started_with_previously_unseen_ami.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
ec2_instance_started_with_previously_unseen_instance_type.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
email_attachments_with_spaces.json
correcting new line char
2019-09-11 15:58:02 -04:00
email_files_not_in_outlook_directory.json
removing html tags
2019-09-04 12:20:27 -04:00
emailserver_high_volume_outbound_traffic_to_hosts.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
excessive_dns_failures.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
excessive_lockouts_from_endpoint.json
correcting new line char
2019-09-11 15:58:02 -04:00
excessive_user_account_lockouts.json
Modified att&ck mappings for these files. Mostly just added the high level tactic, but also tweaked some incluidng smb spike searches and ones about creating accounts
2019-08-22 09:57:45 -06:00
execution_of_nirsoft_tools.json
Modified att&ck mappings for these files. Mostly just added the high level tactic, but also tweaked some incluidng smb spike searches and ones about creating accounts
2019-08-22 09:57:45 -06:00
file_write_spikes.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
first_time_seen_cmd_line.json
manifest and search updates
2019-10-04 15:15:53 -07:00
first_time_seen_running_windows_service.json
removing html tags
2019-09-04 12:20:27 -04:00
fsutil_deleting_journals.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
hosts_file_modification.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
hosts_receiving_high_volume_network_traffic_from_email_servers.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
large_icmp_outbound.json
removing html tags
2019-09-04 12:20:27 -04:00
lnk_executing_a_process.json
Modified att&ck mappings for these files. Mostly just added the high level tactic, but also tweaked some incluidng smb spike searches and ones about creating accounts
2019-08-22 09:57:45 -06:00
local_admin_account_creation.json
correcting new line char
2019-09-11 15:58:02 -04:00
long_dns_text_response.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
malicious_application_shimming_via_registry.json
removing html tags
2019-09-04 12:20:27 -04:00
malicious_powershell_process_connect_to_internet_with_hidden_window.json
updating entities in manifest
2019-09-26 16:34:12 -07:00
malicious_powershell_process_encoded_command.json
updating entities in manifest
2019-09-26 16:34:12 -07:00
malicious_powershell_process_execpolicy.json
removing html tags
2019-09-04 12:20:27 -04:00
malicious_powershell_process_multiple_suspicious_arguments.json
updating entities in manifest
2019-09-26 16:34:12 -07:00
malicious_powershell_process_obfuscation_techniques.json
removing html tags
2019-09-04 12:20:27 -04:00
malicious_requests_to_exploit_jboss_servers.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
mshta_launching_scripts.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
netbackup_failed_backup.json
removing html tags
2019-09-04 12:20:27 -04:00
netbackup_no_backups_in_time_period.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
netsh_launching_process.json
correcting new line char
2019-09-11 15:58:02 -04:00
new_aws_console_login_by_user.json
removing html tags
2019-09-04 12:20:27 -04:00
new_aws_console_login_city_by_user.json
removing html tags
2019-09-04 12:20:27 -04:00
new_aws_console_login_country_by_user.json
removing html tags
2019-09-04 12:20:27 -04:00
new_aws_console_login_region_by_user.json
removing html tags
2019-09-04 12:20:27 -04:00
new_connections_to_routers.json
removing html tags
2019-09-04 12:20:27 -04:00
new_open_s3_buckets.json
Owner reviewed
2019-08-15 17:37:44 -07:00
new_user_accounts.json
Modified att&ck mappings for these files. Mostly just added the high level tactic, but also tweaked some incluidng smb spike searches and ones about creating accounts
2019-08-22 09:57:45 -06:00
no_win_updates_in_timeframe.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
open_redirect_in_splunk_web.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
osx_coldroot_pack.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
osx_keyboard_taps.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
outbound_smb_connections.json
removing html tags
2019-09-04 12:20:27 -04:00
outlook_writing_zip.json
Modified att&ck mappings for these files. Mostly just added the high level tactic, but also tweaked some incluidng smb spike searches and ones about creating accounts
2019-08-22 09:57:45 -06:00
overwrite_accessibility_binaries.json
removing html tags
2019-09-04 12:20:27 -04:00
password_sharing.json
removing html tags
2019-09-04 12:20:27 -04:00
path_interception_program.exe.json
removing html tags
2019-09-04 12:20:27 -04:00
port_monitor_via_registry.json
removing html tags
2019-09-04 12:20:27 -04:00
powershell_get_sedebug.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
powershell_read_from_lsass.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
powershell_reg_key_mod.json
fixed channel in stories, minor tweaks to detections.
2019-08-06 14:58:39 -06:00
process_launching_netsh.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
process_with_double_extension.json
removing html tags
2019-09-04 12:20:27 -04:00
process_with_spaces_before_extension.json
removing html tags
2019-09-04 12:20:27 -04:00
prohibited_allowed_through_fw.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
prohibited_apps_spawning_cmdprompt.json
manifest and search updates
2019-10-04 15:15:53 -07:00
prohibited_software_on_endpoint.json
changed process to process name
2019-09-12 09:55:57 -07:00
protocol_mismatch.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
protocols_authenticating_in_cleartext.json
removing html tags
2019-09-04 12:20:27 -04:00
psexec_accepteula.json
removing html tags
2019-09-04 12:20:27 -04:00
rare_executables_on_endpoint.json
removing html tags
2019-09-04 12:20:27 -04:00
reg_manipulating_services.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
reg_used_to_hide_files.json
removing html tags
2019-09-04 12:20:27 -04:00
registry_persistence.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
registry_privilege_escalation.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
remote_desktop_bruteforce.json
detect checks
2019-10-10 14:19:35 -07:00
remote_desktop_network_traffic.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
remote_desktop_process_running_on_system.json
removing html tags
2019-09-04 12:20:27 -04:00
remote_registry_modifications.json
removing html tags
2019-09-04 12:20:27 -04:00
remote_wmi_command_attempt.json
removing html tags
2019-09-04 12:20:27 -04:00
remote_wmi_process_instantiation.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
rundll_loading_dll_by_ordinal.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
s3_access_from_new_ip.json
removing html tags
2019-09-04 12:20:27 -04:00
samsam_payload_extensions.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
samsam_test_file_write.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
sc_manipulating_services.json
fixing merge conflicts
2019-08-06 17:45:35 -04:00
schtasks_forced_reboot.json
fixed channel in stories, minor tweaks to detections.
2019-08-06 14:58:39 -06:00
schtasks_scheduling_job_on_remote_system.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
shim_database_file_creation.json
removing html tags
2019-09-04 12:20:27 -04:00
shim_database_installation.json
removing html tags
2019-09-04 12:20:27 -04:00
short_lived_accounts.json
Modified att&ck mappings for these files. Mostly just added the high level tactic, but also tweaked some incluidng smb spike searches and ones about creating accounts
2019-08-22 09:57:45 -06:00
single_letter_executables.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
smb_traffic_spike_mltk.json
correcting new line char
2019-09-11 15:58:02 -04:00
smb_traffic_spike.json
removing html tags
2019-09-04 12:20:27 -04:00
sncd_processes.json
removing html tags
2019-09-04 12:20:27 -04:00
spectre_meltdown_vulnerabilities.json
removing html tags
2019-09-04 12:20:27 -04:00
spike_aws_api_call_per_account.json
correcting new line char
2019-09-11 15:58:02 -04:00
spike_aws_security_group_activity.json
correcting new line char
2019-09-11 15:58:02 -04:00
spike_s3_deletion.json
correcting new line char
2019-09-11 15:58:02 -04:00
spike_vpc_blocked_traffic.json
correcting new line char
2019-09-11 15:58:02 -04:00
splunk_information_disclosure.json
removing html tags
2019-09-04 12:20:27 -04:00
sql_injection_with_long_urls.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
stop_security_services.json
removing html tags
2019-09-04 12:20:27 -04:00
suspicious_email_attachments.json
correcting new line char
2019-09-11 15:58:02 -04:00
suspicious_file_writes.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
suspicious_java_classes.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
suspicious_reg_process.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
suspicious_wevtutil_usage.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
suspicious_write_to_recycler.json
removing html tags
2019-09-04 12:20:27 -04:00
suspicious_write_to_sysvol.json
removing html tags
2019-09-04 12:20:27 -04:00
system_processes_run_from_unexpected_locations.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
tor_traffic.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
uba_email_anomaly.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
unauthorized_assets_via_mac_address.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
unauthorized_dns_servers.json
removing html tags
2019-09-04 12:20:27 -04:00
uncommon_processes.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
unusually_long_commandlines_mltk.json
search update and adding checks in detect
2019-10-10 12:39:39 -07:00
unusually_long_commandlines.json
manifest and search updates
2019-10-04 15:15:53 -07:00
unusually_long_content-type_length.json
fixed channel in stories, minor tweaks to detections.
2019-08-06 14:58:39 -06:00
usb_insertion.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
users_without_mfa.json
correcting new line char
2019-09-11 15:58:02 -04:00
web_servers_executing_suspicious_processes.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
windows_event_log_cleared.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
wmi_perm_event_subscription_sysmon.json
removing html tags
2019-09-04 12:20:27 -04:00
wmi_perm_event_subscription.json
removing html tags
2019-09-04 12:20:27 -04:00
wmi_process_launch.json
fixing merge conflicts
2019-08-06 17:45:35 -04:00
wmi_script_execution.json
removing html tags
2019-09-04 12:20:27 -04:00
wmi_temp_event_subscription.json
removing html tags
2019-09-04 12:20:27 -04:00