splunk-security_content

access_lsass_memory_for_dump_creation.yml

Added detection testing service results inAccess LSASS Memory for Dump Creation

2020-11-05 08:46:55 +00:00

attempt_to_add_certificate_to_untrusted_store.yml

Added detection testing service results inAttempt To Add Certificate To Untrusted Store

2020-11-03 16:29:27 +00:00

attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml

new test file

2020-11-06 13:26:45 +01:00

attempt_to_stop_security_service.yml

Added detection testing service results inAttempt To Stop Security Service

2020-11-06 12:44:38 +00:00

attempted_credential_dump_from_registry_via_reg_exe___ssa.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

attempted_credential_dump_from_registry_via_reg_exe.yml

Added detection testing service results inAttempted Credential Dump From Registry via Reg exe

2020-11-04 08:34:58 +00:00

batch_file_write_to_system32.yml

Added detection testing service results inBatch File Write to System32

2020-11-06 12:58:46 +00:00

child_processes_of_spoolsv_exe.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

common_ransomware_extensions.yml

updating with upstream

2020-11-09 11:23:11 -05:00

common_ransomware_notes.yml

updating with upstream

2020-11-09 11:23:11 -05:00

create_local_admin_accounts_using_net_exe.yml

Added detection testing service results inCreate local admin accounts using net exe

2020-10-30 10:13:19 +00:00

create_or_delete_windows_shares_using_net_exe.yml

new test file

2020-11-19 14:11:18 +01:00

create_remote_thread_into_lsass.yml

Added detection testing service results inCreate Remote Thread into LSASS

2020-11-05 10:11:51 +00:00

creation_of_shadow_copy_with_wmic_and_powershell.yml

Added detection testing service results inCreation of Shadow Copy with wmic and powershell

2020-11-04 11:10:33 +00:00

creation_of_shadow_copy.yml

Added detection testing service results inCreation of Shadow Copy

2020-11-04 12:12:26 +00:00

credential_dumping_via_copy_command_from_shadow_copy.yml

Added detection testing service results inCredential Dumping via Copy Command from Shadow Copy

2020-11-04 12:08:51 +00:00

credential_dumping_via_symlink_to_shadow_copy.yml

Added detection testing service results inCredential Dumping via Symlink to Shadow Copy

2020-11-04 12:38:04 +00:00

deleting_shadow_copies.yml

Added detection testing service results inDeleting Shadow Copies

2020-11-09 09:56:18 +00:00

detect_activity_related_to_pass_the_hash_attacks.yml

Added detection testing service results inDetect Activity Related to Pass the Hash Attacks

2020-10-16 08:43:40 +00:00

detect_computer_changed_with_anonymous_account.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

detect_credential_dumping_through_lsass_access.yml

Added detection testing service results inDetect Credential Dumping through LSASS access

2020-11-05 10:20:58 +00:00

detect_dump_lsass_memory_using_comsvcs___ssa.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

detect_excessive_account_lockouts_from_endpoint.yml

Added detection testing service results inDetect Excessive Account Lockouts From Endpoint

2020-11-09 12:43:35 +00:00

detect_excessive_user_account_lockouts.yml

Added detection testing service results inDetect Excessive User Account Lockouts

2020-11-09 12:43:26 +00:00

detect_mshta_exe_running_scripts_in_command_line_arguments.yml

Added detection testing service results inDetect mshta exe running scripts in command-line arguments

2020-11-09 15:59:06 +00:00

detect_new_local_admin_account.yml

Added detection testing service results inDetect New Local Admin account

2020-11-05 18:15:30 +00:00

detect_oulook_exe_writing_a__zip_file.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

detect_path_interception_by_creation_of_program_exe.yml

Added detection testing service results inDetect Path Interception By Creation Of program exe

2020-11-04 13:07:50 +00:00

detect_processes_used_for_system_network_configuration_discovery.yml

Added detection testing service results inDetect processes used for System Network Configuration Discovery

2020-11-10 14:26:41 +00:00

detect_prohibited_applications_spawning_cmd_exe.yml

Added detection testing service results inDetect Prohibited Applications Spawning cmd exe

2020-11-10 08:35:10 +00:00

detect_psexec_with_accepteula_flag.yml

Added detection testing service results inDetect PsExec With accepteula Flag

2020-11-10 15:15:18 +00:00

detect_rare_executables.yml

new test file

2020-11-19 14:11:18 +01:00

detect_use_of_cmd_exe_to_launch_script_interpreters.yml

Added detection testing service results inDetect Use of cmd exe to Launch Script Interpreters

2020-11-10 15:02:17 +00:00

disabling_remote_user_account_control.yml

Added detection testing service results inDisabling Remote User Account Control

2020-11-18 14:55:01 +00:00

dump_lsass_via_comsvcs_dll.yml

Added detection testing service results inDump LSASS via comsvcs DLL

2020-11-04 13:08:57 +00:00

execution_of_file_with_multiple_extensions.yml

Added detection testing service results inExecution of File with Multiple Extensions

2020-11-19 10:55:54 +00:00

file_with_samsam_extension.yml

Added detection testing service results inFile with Samsam Extension

2020-11-19 13:30:29 +00:00

first_time_seen_child_process_of_zoom.yml

Added detection testing service results inFirst Time Seen Child Process of Zoom

2020-11-19 13:44:55 +00:00

first_time_seen_cmd_line___ssa.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

first_time_seen_command_line_argument.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

first_time_seen_running_windows_service.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

hiding_files_and_directories_with_attrib_exe.yml

Added detection testing service results inHiding Files And Directories With Attrib exe

2020-11-19 15:49:55 +00:00

kerberoasting_spn_request_with_rc4_encryption.yml

Added detection testing service results inKerberoasting spn request with RC4 encryption

2020-10-16 09:57:44 +00:00

macos___re_opened_applications.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

malicious_powershell_process___connect_to_internet_with_hidden_window.yml

Added detection testing service results inMalicious PowerShell Process - Connect To Internet With Hidden Window

2020-11-20 10:24:45 +00:00

malicious_powershell_process___encoded_command.yml

Added detection testing service results inMalicious PowerShell Process - Encoded Command

2020-11-04 13:58:12 +00:00

malicious_powershell_process___execution_policy_bypass.yml

Added detection testing service results inMalicious PowerShell Process - Execution Policy Bypass

2020-11-20 14:56:44 +00:00

monitor_registry_keys_for_print_monitors.yml

Added detection testing service results inMonitor Registry Keys for Print Monitors

2020-11-23 10:55:34 +00:00

osquery_pack___coldroot_detection.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

overwriting_accessibility_binaries.yml

Added detection testing service results inOverwriting Accessibility Binaries

2020-11-23 11:59:15 +00:00

process_execution_via_wmi.yml

Added detection testing service results inProcess execution via wmi

2020-11-04 14:37:23 +00:00

processes_launching_netsh.yml

Added detection testing service results inProcesses created by netsh

2020-11-23 13:38:44 +00:00

processes_tapping_keyboard_events.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

prohibited_apps_spawning_cmdprompt___ssa.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

rare_parent_process_relationship_lolbas___ssa.yaml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

reg_exe_manipulating_windows_services_registry_keys.yml

Added detection testing service results inReg exe Manipulating Windows Services Registry Keys

2020-11-26 16:26:31 +00:00

registry_keys_for_creating_shim_databases.yml

Added detection testing service results inRegistry Keys for Creating SHIM Databases

2020-11-27 07:43:34 +00:00

registry_keys_used_for_persistence.yml

Added detection testing service results inRegistry Keys Used For Persistence

2020-11-27 09:17:39 +00:00

registry_keys_used_for_privilege_escalation.yml

Added detection testing service results inRegistry Keys Used For Privilege Escalation

2020-11-27 09:42:21 +00:00

remote_desktop_process_running_on_system.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

remote_process_instantiation_via_wmi.yml

Added detection testing service results inRemote Process Instantiation via WMI

2020-11-30 14:20:03 +00:00

rundll_loading_dll_by_ordinal.yml

Added detection testing service results inRunDLL Loading DLL By Ordinal

2020-11-30 16:02:55 +00:00

ryuk_test_files_detected.yml

Added detection testing service results inRyuk Test Files Detected

2020-11-16 13:59:03 +00:00

samsam_test_file_write.yml

fixed validation errors

2020-11-06 19:07:54 -05:00

sc_exe_manipulating_windows_services.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

scheduled_task_name_used_by_dragonfly_threat_actors.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

scheduled_tasks_used_in_badrabbit_ransomware.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

schtasks_scheduling_job_on_remote_system.yml

Added detection testing service results inSchtasks scheduling job on remote system

2020-11-04 14:09:44 +00:00

schtasks_used_for_forcing_a_reboot.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

script_execution_via_wmi.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

shim_database_file_creation.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

shim_database_installation_with_suspicious_parameters.yml

Added detection testing service results inShim Database Installation With Suspicious Parameters

2020-11-26 15:59:55 +00:00

short_lived_windows_accounts.yml

Added detection testing service results inShort Lived Windows Accounts

2020-11-04 14:09:57 +00:00

single_letter_process_on_endpoint.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

spike_in_file_writes.yml

ryuk story and detections

2020-11-06 12:32:48 -05:00

ssa___applying_stolen_credentials_via_mimikatz_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___applying_stolen_credentials_via_powersploit_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___assess_credential_strength_via_dsinternals_modules.yml

Update ssa___assess_credential_strength_via_dsinternals_modules.yml

2020-11-18 10:07:53 -08:00

ssa___credential_extraction_dsinternals_conversion_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___credential_extraction_dsinternals_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___credential_extraction_fgdump_cachedump_s_option.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___credential_extraction_fgdump_cachedump_v_option.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___credential_extraction_getaddbaccount_from_dump.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___credential_extraction_lazagne_command_options.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___credential_extraction_mimikatz_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___credential_extraction_ms_debuggers_kernel_peek.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___credential_extraction_ms_debuggers_z_option.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___credential_extraction_powersploit_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___detect_kerberoasting.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___detect_pass_hash.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___illegal_access_user_content_via_powersploit_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___illegal_account_creation_via_powersploit_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___illegal_account_enable_disable_via_dsinternals_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___illegal_log_deletion_via_mimikatz_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___illegal_privilege_elevation_via_mimikatz_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___illegal_service_and_process_control_via_mimikatz_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___illegal_service_and_process_control_via_powersploit_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml

Update ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml

2020-11-18 10:08:45 -08:00

ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml

Update ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml

2020-11-18 10:10:57 -08:00

ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml

Update ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml

2020-11-18 10:11:40 -08:00

ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml

Update ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml

2020-11-18 10:12:17 -08:00

ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml

Update ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml

2020-11-18 10:17:35 -08:00

ssa___recon_and_use_computers_domains_via_powersploit_modules.yml

Update ssa___recon_and_use_computers_domains_via_powersploit_modules.yml

2020-11-18 10:18:26 -08:00

ssa___recon_and_use_computers_via_mimikatz_modules.yml

Update ssa___recon_and_use_computers_via_mimikatz_modules.yml

2020-11-18 10:19:17 -08:00

ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml

Update ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml

2020-11-18 10:19:56 -08:00

ssa___recon_and_use_shares_via_mimikatz_modules.yml

Update ssa___recon_and_use_shares_via_mimikatz_modules.yml

2020-11-18 10:20:56 -08:00

ssa___recon_and_use_shares_via_powersploit_modules.yml

Update ssa___recon_and_use_shares_via_powersploit_modules.yml

2020-11-18 10:21:45 -08:00

ssa___recon_connectivity_via_powersploit_modules.yml

Update ssa___recon_connectivity_via_powersploit_modules.yml

2020-11-18 10:22:24 -08:00

ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml

Update ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml

2020-11-18 10:09:35 -08:00

ssa___recon_defensive_tools_via_powersploit_modules.yml

Update ssa___recon_defensive_tools_via_powersploit_modules.yml

2020-11-18 10:23:05 -08:00

ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml

Update ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml

2020-11-18 10:24:01 -08:00

ssa___recon_process_service_hijacking_via_mimikatz_modules.yml

Update ssa___recon_process_service_hijacking_via_mimikatz_modules.yml

2020-11-18 10:24:37 -08:00

ssa___recon_processes_and_services_via_mimikatz_modules.yml

Update ssa___recon_processes_and_services_via_mimikatz_modules.yml

2020-11-18 10:25:24 -08:00

ssa___setting_credentials_via_dsinternals_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___setting_credentials_via_mimikatz_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___setting_credentials_via_powersploit_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

suspicious_changes_to_file_associations.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

suspicious_file_write.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

suspicious_java_classes.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

suspicious_lnk_file_launching_a_process.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

suspicious_reg_exe_process.yml

Added detection testing service results inSuspicious Reg exe Process

2020-11-04 14:08:38 +00:00

suspicious_wevtutil_usage.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

suspicious_writes_to_system_volume_information.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

suspicious_writes_to_windows_recycle_bin.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

system_information_discovery_detection.yml

Added detection testing service results inSystem Information Discovery Detection

2020-11-04 14:38:34 +00:00

system_process_running_unexpected_location___ssa.yml

More refactoring

2020-11-16 14:10:35 -08:00

system_processes_run_from_unexpected_locations.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

uncommon_processes_on_endpoint.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

unload_sysmon_filter_driver.yml

Added detection testing service results inUnload Sysmon Filter Driver

2020-11-04 14:39:25 +00:00

unsuccessful_netbackup_backups.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

unusual_lolbas_in_short_period_of_time___ssa.yml

start time to be window start time

2020-11-17 10:12:36 -08:00

unusually_long_command_line___mltk.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

unusually_long_command_line___ssa.yml

Merge branch 'develop' into TR-279

2020-11-16 13:43:32 -08:00

unusually_long_command_line.yml

updated with develop

2020-10-14 09:26:19 +02:00

unusually_long_content_type_length.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

usn_journal_deletion.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

web_servers_executing_suspicious_processes.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

windows_event_log_cleared.yml

Added detection testing service results inWindows Event Log Cleared

2020-11-04 14:40:52 +00:00

windows_hosts_file_modification.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

windows_security_account_manager_stopped.yml

Added detection testing service results inWindows Security Account Manager Stopped

2020-11-16 13:59:31 +00:00

wmi_permanent_event_subscription___sysmon.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

wmi_permanent_event_subscription.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

wmi_temporary_event_subscription.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00