splunk-security_content

account_monitoring.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

apache_struts.yml

removing deadlink

2020-03-04 10:07:28 -05:00

asset_tracking.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_cross_account_activity.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_cryptomining.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_ec2_modifications.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_ec2.yml

CRL-1645 - New detection "Abnormally High AWS Instances Terminated by User - MLTK"

2019-11-25 18:06:33 -08:00

aws_network_acl.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_provisioning.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_s3.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_suspcious_logins.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_suspcious_traffic.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

aws_user_monitoring.yml

fixing broken links in stories

2019-12-09 19:59:39 -05:00

brand_monitoring.yml

fixing broken link

2019-11-18 13:30:26 -05:00

cloud_cryptomining.yml

CRL-1646 - adding Abnormally High AWS Instances Launched [mltk] to cloud_cryptomining story.

2019-11-25 17:01:20 -08:00

coldroot.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

collection_and_staging.yml

CRL-1723 : corrected field name in SPL Filesystem.filepath [which does not exist] to Filesystem.file_path.

2020-02-03 21:00:55 -08:00

command_and_control.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

common_phishing_frameworks.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

container_implant_story.yml

updated manifests

2020-03-02 10:25:28 -08:00

credential_dumping.yml

Update credential_dumping.yml

2020-02-28 11:41:11 -07:00

data_protection.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

defense_evasion.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

detect_unauthorized_processes.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

dhs_report_TA18-074A.yml

story mod updates

2020-02-07 10:00:28 -08:00

disable_security_tools.yml

updating mod dates and version

2020-02-04 09:21:52 -08:00

dns_amplification_attacks.yml

fixing broken links in stories

2019-12-09 19:59:39 -05:00

dns_hijacking.yml

updating mod dates and version

2020-02-04 09:21:52 -08:00

dynamic_dns.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

emotet.yml

update mod dates of stories:

2020-02-07 10:30:32 -08:00

file_extension_abuse.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

hidden_cobra_malware.yml

story mod updates

2020-02-07 10:00:28 -08:00

host_redirection.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

jboss_vulnerabilities.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

kubernetes_scanning_activity.yml

adding new investigation manifest

2020-04-16 11:51:19 -07:00

lateral_movement.yml

updating mod dates and version

2020-02-04 09:21:52 -08:00

malicious_powershell.yml

WIP: Credential Dumping Story

2019-12-11 12:29:41 +01:00

monitor_backups.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

monitor_for_updates.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

mudcarp.yml

story mod updates

2020-02-07 10:00:28 -08:00

netsh_abuse.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

non-secure_communications.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

orangeworm.yml

story mod updates

2020-02-07 10:00:28 -08:00

phishing_payloads.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

prohibited_traffic_and_protocol_mismatch.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

ransomware.yml

removing another dead ref

2020-03-04 10:09:33 -05:00

routers_and_infrastructure.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

samsam.yml

updating bug with samsam docs

2019-12-16 10:21:04 -05:00

service_abuse.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

spectre_meltdown.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

splunk_information_disclosure.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

splunk_vulnerabilities.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

sql_injection.yml

new link

2020-04-16 13:41:59 -07:00

suspicious_cmd_line_executions.yml

Merge branch 'develop' into first_time_seen_cmd_updates

2020-02-07 10:02:26 -08:00

suspicious_dns_traffic.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

suspicious_emails.yml

update mod dates of stories:

2020-02-07 10:30:32 -08:00

suspicious_event_log_activity.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

suspicious_mshta_activities.yml

CRL-1725 - Changed prohibited_apps_spawning_cmdprompt.yml to use parent_process_name as entity. Changed supress field to add user. Bumped detection version number and story version numbers on stories/suspicious_cmd_line_executions.yml and stories/suspicious_mshta_activities.yml.

2020-02-03 15:24:49 -08:00

suspicious_okta_activities.yml

slim failure

2020-04-02 14:57:43 -07:00

suspicious_windows_registry_activities.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

suspicious_wmi.yml

Changed json to yml

2019-10-16 16:38:05 +02:00

unusual_processes.yml

updating files as per Dons feedback

2020-02-04 09:15:39 -08:00

web_fraud.yml

removing bad reference, dead link

2020-02-07 14:15:32 -05:00

windows_persistence.yml

CRL-1646 - Fixing newly broken reference.

2019-11-25 16:32:14 -08:00

windows_privilege_escalation.yml

updating mod dates and version

2020-02-04 09:21:52 -08:00