admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
ssa-failures-debugging
splunk-security_content/dist/ssa/detections
T
History
research bot 750c81fb5b updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
..
anomalous_usage_of_archive_tools.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
applying_stolen_credentials_via_mimikatz_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
applying_stolen_credentials_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
assessment_of_credential_strength_via_dsinternals_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
attempt_to_delete_services.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
attempt_to_disable_services.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
attempted_credential_dump_from_registry_via_reg_exe.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
credential_extraction_indicative_of_lazagne_command_line_options.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
credential_extraction_indicative_of_use_of_dsinternals_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
credential_extraction_indicative_of_use_of_mimikatz_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
credential_extraction_indicative_of_use_of_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
delete_a_net_user.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
deny_permission_using_cacls_utility.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
detect_dump_lsass_memory_using_comsvcs.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
detect_kerberoasting.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
detect_pass_the_hash.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
detect_prohibited_applications_spawning_cmd_exe.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
disable_net_user_account.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
first_time_seen_command_line_argument.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
grant_permission_using_cacls_utility.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
illegal_access_to_user_content_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
illegal_account_creation_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
illegal_deletion_of_logs_via_mimikatz_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
illegal_privilege_elevation_via_mimikatz_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
illegal_service_and_process_control_via_mimikatz_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
illegal_service_and_process_control_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
modify_acls_permission_of_files_or_folders.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
more_than_usual_number_of_lolbas_applications_in_short_time_period.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
phishing_email_detection_by_machine_learning_method_-_ssa.yml
updating with no savedsearches_annotations
2021-11-01 20:01:33 -04:00
potential_pass_the_token_or_hash_observed_at_the_destination_device.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
probing_access_with_stolen_credentials_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
rare_parent-child_process_relationship.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
reconnaissance_and_access_to_computers_via_mimikatz_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
reconnaissance_of_connectivity_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
reconnaissance_of_defensive_tools_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
resize_shadowstorage_volume.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
sdelete_application_execution.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
setting_credentials_via_dsinternals_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
setting_credentials_via_mimikatz_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
setting_credentials_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
system_process_running_from_unexpected_location.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
unusually_long_command_line.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
wevtutil_usage_to_clear_logs.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
wevtutil_usage_to_disable_logs.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00