admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
uba
splunk-security_content/lookups
T
History
research-bot 99d78af47e udpating ransomware detection
2024-12-12 16:57:42 -08:00
..
__mlspl_detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.mlmodel
Adding missing lookup files
2023-06-12 13:56:20 -07:00
__mlspl_detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml
Adding missing lookup files
2023-06-12 13:56:20 -07:00
__mlspl_detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.mlmodel
adding detect suspicious dns txt records using pretrained model in dsdl
2023-01-17 15:26:01 -08:00
__mlspl_detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml
adding detect suspicious dns txt records using pretrained model in dsdl
2023-01-17 15:26:01 -08:00
__mlspl_detect_suspicious_processnames_using_pretrained_model_in_dsdl.mlmodel
Detection name update
2023-02-07 15:31:48 +01:00
__mlspl_detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml
Detection name update
2023-02-07 15:31:48 +01:00
__mlspl_pretrained_dga_model_dsdl.mlmodel
changing files
2022-09-28 12:36:40 -07:00
__mlspl_pretrained_dga_model_dsdl.yml
changing file names
2022-09-28 13:16:22 -07:00
__mlspl_unusual_commandline_detection.mlmodel
Updating mlmodel to 5.3.x specification as well as the test apparatus
2022-01-25 21:42:16 -05:00
__mlspl_unusual_commandline_detection.yml
Update __mlspl_unusual_commandline_detection.yml
2022-01-26 11:26:25 -07:00
3cx_ioc_domains.csv
dns
2023-03-30 12:15:41 -06:00
3cx_ioc_domains.yml
dns
2023-03-30 12:15:41 -06:00
ace_access_rights_lookup.csv
adding AD ACL and GPO related detections
2024-07-02 11:52:21 +10:00
ace_access_rights_lookup.yml
adding AD ACL and GPO related detections
2024-07-02 11:52:21 +10:00
ace_flag_lookup.csv
adding AD ACL and GPO related detections
2024-07-02 11:52:21 +10:00
ace_flag_lookup.yml
adding AD ACL and GPO related detections
2024-07-02 11:56:06 +10:00
ace_type_lookup.csv
adding AD ACL and GPO related detections
2024-07-02 11:52:21 +10:00
ace_type_lookup.yml
adding AD ACL and GPO related detections
2024-07-02 11:52:21 +10:00
advanced_audit_policy_guids.csv
renaming advanced audit policy guids lookup
2023-02-13 12:03:49 -05:00
advanced_audit_policy_guids.yml
renaming advanced audit policy guids lookup
2023-02-13 12:03:49 -05:00
api_call_by_user_baseline.yml
Update api_call_by_user_baseline.yml
2020-08-18 15:28:54 -07:00
applockereventcodes.csv
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
applockereventcodes.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
asr_rules.csv
4.17.0 release branch
2023-12-06 18:40:13 +00:00
asr_rules.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
attacker_tools.csv
spl duplicate and fixes
2023-07-28 14:34:00 -05:00
attacker_tools.yml
lookup definitions
2021-07-12 19:02:32 -05:00
aws_service_accounts.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
aws_service_accounts.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
baseline_blocked_outbound_connections.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
baseline_blocked_outbound_connections.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
brand_monitoring.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
brandmonitoring_lookup.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
browser_app_list.csv
ESCU Release Branch v4.27.0
2024-03-20 20:01:18 +00:00
browser_app_list.yml
ESCU Release Branch v4.27.0
2024-03-20 20:01:18 +00:00
builtin_groups_lookup.csv
adding AD ACL and GPO related detections
2024-07-02 11:52:21 +10:00
builtin_groups_lookup.yml
adding AD ACL and GPO related detections
2024-07-02 11:52:21 +10:00
char_conversion_matrix.csv
Release 4.19.0
2024-01-10 17:21:34 +00:00
char_conversion_matrix.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
cloud_instances_enough_data.yml
Updated search for abnormally high cloud instances. Including
2020-08-25 22:28:59 -05:00
discovered_dns_records.csv
app inspect failures fixes
2020-12-08 14:56:39 -08:00
discovered_dns_records.yml
updated fields and added macros and lookup entries
2020-01-19 21:37:45 -05:00
domain_admins.csv
adding new detection - diamond ticket
2023-10-06 15:46:36 -04:00
domain_admins.yml
adding new detection - diamond ticket
2023-10-06 15:46:36 -04:00
domains.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
domains.yml
More language clean up
2021-01-22 09:34:33 -06:00
dynamic_dns_providers_default.csv
add additional dynamic domains
2020-10-13 12:44:52 -04:00
dynamic_dns_providers_default.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
dynamic_dns_providers_local.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
dynamic_dns_providers_local.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
hijacklibs_loaded.csv
ESCU Release Branch v4.27.0
2024-03-20 20:01:18 +00:00
hijacklibs_loaded.yml
ESCU Release Branch v4.27.0
2024-03-20 20:01:18 +00:00
hijacklibs.csv
T1003.001 Update
2022-08-25 08:04:20 -06:00
hijacklibs.yml
fix
2022-08-19 15:21:15 -06:00
images_to_repository.csv
updated detections
2021-09-06 10:59:00 +02:00
images_to_repository.yml
updated detections
2021-09-06 10:59:00 +02:00
is_net_windows_file20231221.csv
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
is_net_windows_file.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
is_nirsoft_software20231221.csv
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
is_nirsoft_software.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
is_suspicious_file_extension_lookup.csv
add additional suspicious file extensions
2020-11-18 16:19:11 -05:00
is_suspicious_file_extension_lookup.yml
changed the file name of the .csv file and updated the associated yml file
2020-02-05 16:27:57 -07:00
is_windows_system_file20231221.csv
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
is_windows_system_file.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
k8s_container_network_io_baseline.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
k8s_container_network_io_ratio_baseline.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
k8s_process_resource_baseline.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
k8s_process_resource_ratio_baseline.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
legit_domains.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
legit_domains.yml
More language clean up
2021-01-22 09:34:33 -06:00
linux_tool_discovery_process.csv
combined the rest 2
2022-02-17 16:28:19 -08:00
linux_tool_discovery_process.yml
rename typo
2022-02-24 14:14:13 -08:00
local_file_inclusion_paths.csv
new detection
2021-08-23 13:07:23 +02:00
local_file_inclusion_paths.yml
new detection
2021-08-23 10:21:21 +02:00
lolbas_file_path20240725.csv
Datestamped lookup
2024-07-25 09:23:35 -05:00
lolbas_file_path.yml
Datestamped lookup
2024-07-25 09:23:35 -05:00
loldrivers.csv
Bespoke Drivers
2022-12-31 14:14:11 -07:00
loldrivers.yml
Bespoke Drivers
2022-12-31 14:14:11 -07:00
lookup_rare_process_allow_list_default.yml
More language clean up
2021-01-22 09:34:33 -06:00
lookup_rare_process_allow_list_local.yml
More language clean up
2021-01-22 09:34:33 -06:00
lookup_uncommon_processes_default.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
lookup_uncommon_processes_local.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
mandatory_job_for_workflow.csv
circle ci detecction
2021-09-02 10:42:01 +02:00
mandatory_job_for_workflow.yml
circle ci detecction
2021-09-02 10:42:01 +02:00
mandatory_step_for_job.csv
circle ci detecction
2021-09-01 17:54:38 +02:00
mandatory_step_for_job.yml
circle ci detecction
2021-09-01 17:54:38 +02:00
msad_guid_lookup.csv
adding AD ACL and GPO related detections
2024-07-02 11:52:21 +10:00
msad_guid_lookup.yml
adding AD ACL and GPO related detections
2024-07-02 11:52:21 +10:00
network_acl_activity_baseline.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
network_acl_activity_baseline.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_api_calls_from_user_roles.yml
Update previously_seen_api_calls_from_user_roles.yml
2023-06-12 15:40:37 -07:00
previously_seen_aws_cross_account_activity.yml
only kvstore conversion
2023-05-22 17:35:13 -07:00
previously_seen_aws_regions.yml
only kvstore conversion
2023-05-22 17:35:13 -07:00
previously_seen_cloud_api_calls_per_user_role.yml
Added needed macros and lookups
2020-09-04 09:26:10 -05:00
previously_seen_cloud_compute_creations_by_user.yml
convert to kvstore and spl updates
2020-10-12 12:14:50 -07:00
previously_seen_cloud_compute_images.yml
convert to kvstore and spl updates
2020-10-12 12:14:50 -07:00
previously_seen_cloud_compute_instance_types.yml
spl updates and kvstore file
2020-10-12 11:49:37 -07:00
previously_seen_cloud_instance_modifications_by_user.yml
updating macro fields
2020-11-16 17:22:29 -08:00
previously_seen_cloud_provisioning_activity_sources.yml
Added needed macros and lookups
2020-09-04 09:26:10 -05:00
previously_seen_cloud_regions.yml
lookup errors and consistency
2020-10-12 11:26:57 -07:00
previously_seen_cmd_line_arguments.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_cmd_line_arguments.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_ec2_modifications_by_user.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_ec2_modifications_by_user.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_gcp_storage_access_from_remote_ip.yml
only kvstore conversion
2023-05-22 17:35:13 -07:00
previously_seen_running_windows_services.yml
Changed running windows service to use kvstore as cache
2020-06-26 08:27:39 -05:00
previously_seen_s3_access_from_remote_ip.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
previously_seen_users_console_logins.yml
creating collections and search updates
2020-09-30 11:25:37 -07:00
privileged_azure_ad_roles20240807.csv
Updating datestamp
2024-08-07 13:29:34 -05:00
privileged_azure_ad_roles.yml
Account for new name
2024-08-07 13:30:26 -05:00
prohibited_apps_launching_cmd20231221.csv
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
prohibited_apps_launching_cmd.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
prohibited_processes.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
prohibited_processes.yml
fix_bugs
2020-12-11 10:51:02 +01:00
ransomware_extensions_20241212.csv
udpating ransomware detection
2024-12-12 16:57:42 -08:00
ransomware_extensions_lookup.yml
udpating ransomware detection
2024-12-12 16:57:42 -08:00
ransomware_notes_20231219.csv
Release v4.18.0
2023-12-20 16:18:23 +00:00
ransomware_notes_lookup.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
rare_process_allow_list_default.csv
fixing error reported by user
2021-02-16 09:45:00 -05:00
rare_process_allow_list_local.csv
fixing error reported by user
2021-02-16 09:45:00 -05:00
remote_access_software20240726.csv
Datestamped lookup
2024-07-26 10:45:32 -05:00
remote_access_software_exceptions.yml
Converting to KVstore for exceptions
2024-07-26 11:57:09 -05:00
remote_access_software.yml
Datestamped lookup
2024-07-26 10:45:32 -05:00
s3_deletion_baseline.yml
only kvstore conversion
2023-05-22 17:35:13 -07:00
security_group_activity_baseline.yml
only kvstore conversion
2023-05-22 17:35:13 -07:00
security_services_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
security_services.csv
Update security_services.csv
2022-07-07 10:43:17 -04:00
suspicious_files.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
suspicious_writes_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
uncommon_processes_default.csv
adding lookups
2023-06-12 15:26:27 -07:00
uncommon_processes_local.csv
adding lookups
2023-06-12 15:26:27 -07:00
windows_protocol_handlers.csv
Windows Protocol Handler
2022-07-12 14:43:39 -06:00
windows_protocol_handlers.yml
proto fix
2022-07-14 09:50:41 -06:00
zoom_first_time_child_process.yml
converted to spec3 and other updates
2020-05-28 13:31:49 -07:00