admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
04e72ce0f2e30e7724c4585643973b534ff73b8a
splunk-security_content/detections/endpoint
T
History
P4T12ICK 04e72ce0f2 Merge branch 'detection_testing_part_two' of github.com:splunk/security-content into detection_testing_part_two
2020-12-09 12:01:00 +01:00
..
access_lsass_memory_for_dump_creation.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
attempt_to_add_certificate_to_untrusted_store.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
Added detection testing service results inAttempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass
2020-12-09 09:18:47 +00:00
attempt_to_stop_security_service.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
attempted_credential_dump_from_registry_via_reg_exe___ssa.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
attempted_credential_dump_from_registry_via_reg_exe.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
batch_file_write_to_system32.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
common_ransomware_extensions.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
common_ransomware_notes.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
create_local_admin_accounts_using_net_exe.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
create_or_delete_windows_shares_using_net_exe.yml
new test file
2020-12-09 12:00:49 +01:00
create_remote_thread_into_lsass.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
creation_of_shadow_copy_with_wmic_and_powershell.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
creation_of_shadow_copy.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
credential_dumping_via_copy_command_from_shadow_copy.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
credential_dumping_via_symlink_to_shadow_copy.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
deleting_shadow_copies.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
detect_activity_related_to_pass_the_hash_attacks.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
detect_computer_changed_with_anonymous_account.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
detect_credential_dumping_through_lsass_access.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
detect_dump_lsass_memory_using_comsvcs___ssa.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
detect_excessive_account_lockouts_from_endpoint.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
detect_excessive_user_account_lockouts.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
detect_mshta_exe_running_scripts_in_command_line_arguments.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
detect_new_local_admin_account.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
detect_path_interception_by_creation_of_program_exe.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
detect_processes_used_for_system_network_configuration_discovery.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
detect_prohibited_applications_spawning_cmd_exe.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
detect_psexec_with_accepteula_flag.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
detect_rare_executables.yml
new test file
2020-11-19 14:11:18 +01:00
detect_use_of_cmd_exe_to_launch_script_interpreters.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
disabling_remote_user_account_control.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
dump_lsass_via_comsvcs_dll.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
execution_of_file_with_multiple_extensions.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
file_with_samsam_extension.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
first_time_seen_child_process_of_zoom.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
first_time_seen_cmd_line___ssa.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
first_time_seen_command_line_argument.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
first_time_seen_running_windows_service.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
hiding_files_and_directories_with_attrib_exe.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
kerberoasting_spn_request_with_rc4_encryption.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
malicious_powershell_process___connect_to_internet_with_hidden_window.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
malicious_powershell_process___encoded_command.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
malicious_powershell_process___execution_policy_bypass.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
monitor_registry_keys_for_print_monitors.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
overwriting_accessibility_binaries.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
process_execution_via_wmi.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
processes_launching_netsh.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
processes_tapping_keyboard_events.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
prohibited_apps_spawning_cmdprompt___ssa.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
rare_parent_process_relationship_lolbas___ssa.yaml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
reg_exe_manipulating_windows_services_registry_keys.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
registry_keys_for_creating_shim_databases.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
registry_keys_used_for_persistence.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
registry_keys_used_for_privilege_escalation.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
remote_desktop_process_running_on_system.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
remote_process_instantiation_via_wmi.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
rundll_loading_dll_by_ordinal.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
ryuk_test_files_detected.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
samsam_test_file_write.yml
Added detection testing service results inSamsam Test File Write
2020-12-07 12:34:31 +00:00
sc_exe_manipulating_windows_services.yml
Added detection testing service results inSc exe Manipulating Windows Services
2020-12-07 12:38:36 +00:00
scheduled_task_name_used_by_dragonfly_threat_actors.yml
Added detection testing service results inScheduled Task Name Used by Dragonfly Threat Actors
2020-12-07 12:59:27 +00:00
schtasks_scheduling_job_on_remote_system.yml
Added detection testing service results inSchtasks scheduling job on remote system
2020-12-07 14:54:00 +00:00
schtasks_used_for_forcing_a_reboot.yml
Added detection testing service results inSchtasks used for forcing a reboot
2020-12-08 09:09:37 +00:00
script_execution_via_wmi.yml
Added detection testing service results inScript Execution via WMI
2020-12-07 18:00:12 +00:00
shim_database_file_creation.yml
Added detection testing service results inShim Database File Creation
2020-12-08 09:18:06 +00:00
shim_database_installation_with_suspicious_parameters.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
short_lived_windows_accounts.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
single_letter_process_on_endpoint.yml
Added detection testing service results inSingle Letter Process On Endpoint
2020-12-08 09:28:45 +00:00
ssa___applying_stolen_credentials_via_mimikatz_modules.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
ssa___applying_stolen_credentials_via_powersploit_modules.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
ssa___assess_credential_strength_via_dsinternals_modules.yml
Update ssa___assess_credential_strength_via_dsinternals_modules.yml
2020-11-18 10:07:53 -08:00
ssa___credential_extraction_dsinternals_conversion_modules.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
ssa___credential_extraction_dsinternals_modules.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
ssa___credential_extraction_fgdump_cachedump_s_option.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
ssa___credential_extraction_fgdump_cachedump_v_option.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
ssa___credential_extraction_getaddbaccount_from_dump.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
ssa___credential_extraction_lazagne_command_options.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
ssa___credential_extraction_mimikatz_modules.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
ssa___credential_extraction_ms_debuggers_kernel_peek.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
ssa___credential_extraction_ms_debuggers_z_option.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
ssa___credential_extraction_powersploit_modules.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
ssa___detect_kerberoasting.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
ssa___detect_pass_hash.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
ssa___illegal_access_user_content_via_powersploit_modules.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
ssa___illegal_account_creation_via_powersploit_modules.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
ssa___illegal_log_deletion_via_mimikatz_modules.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
ssa___illegal_service_and_process_control_via_powersploit_modules.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
Update ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
2020-11-18 10:08:45 -08:00
ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
Update ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
2020-11-18 10:10:57 -08:00
ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
Update ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
2020-11-18 10:11:40 -08:00
ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
Update ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
2020-11-18 10:12:17 -08:00
ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
Update ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
2020-11-18 10:17:35 -08:00
ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
Update ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
2020-11-18 10:18:26 -08:00
ssa___recon_and_use_computers_via_mimikatz_modules.yml
Update ssa___recon_and_use_computers_via_mimikatz_modules.yml
2020-11-18 10:19:17 -08:00
ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
Update ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
2020-11-18 10:19:56 -08:00
ssa___recon_and_use_shares_via_mimikatz_modules.yml
Update ssa___recon_and_use_shares_via_mimikatz_modules.yml
2020-11-18 10:20:56 -08:00
ssa___recon_and_use_shares_via_powersploit_modules.yml
Update ssa___recon_and_use_shares_via_powersploit_modules.yml
2020-11-18 10:21:45 -08:00
ssa___recon_connectivity_via_powersploit_modules.yml
Update ssa___recon_connectivity_via_powersploit_modules.yml
2020-11-18 10:22:24 -08:00
ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
Update ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
2020-11-18 10:09:35 -08:00
ssa___recon_defensive_tools_via_powersploit_modules.yml
Update ssa___recon_defensive_tools_via_powersploit_modules.yml
2020-11-18 10:23:05 -08:00
ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
Update ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
2020-11-18 10:24:01 -08:00
ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
Update ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
2020-11-18 10:24:37 -08:00
ssa___recon_processes_and_services_via_mimikatz_modules.yml
Update ssa___recon_processes_and_services_via_mimikatz_modules.yml
2020-11-18 10:25:24 -08:00
ssa___setting_credentials_via_dsinternals_modules.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
ssa___setting_credentials_via_mimikatz_modules.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
ssa___setting_credentials_via_powersploit_modules.yml
Added required fields for all SSA detections
2020-11-13 10:27:29 -08:00
suspicious_lnk_file_launching_a_process.yml
Added detection testing service results inSuspicious LNK file launching a process
2020-12-08 15:11:32 +00:00
suspicious_reg_exe_process.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
suspicious_wevtutil_usage.yml
Added detection testing service results inSuspicious File Write
2020-12-08 10:37:22 +00:00
suspicious_writes_to_windows_recycle_bin.yml
Added detection testing service results inSuspicious writes to windows Recycle Bin
2020-12-08 11:06:38 +00:00
system_information_discovery_detection.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
system_process_running_unexpected_location___ssa.yml
More refactoring
2020-11-16 14:10:35 -08:00
system_processes_run_from_unexpected_locations.yml
Added detection testing service results inSystem Processes Run From Unexpected Locations
2020-12-08 12:46:06 +00:00
unload_sysmon_filter_driver.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
unusual_lolbas_in_short_period_of_time___ssa.yml
start time to be window start time
2020-11-17 10:12:36 -08:00
unusually_long_command_line___mltk.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
unusually_long_command_line___ssa.yml
Merge branch 'develop' into TR-279
2020-11-16 13:43:32 -08:00
unusually_long_command_line.yml
new test file
2020-12-08 14:18:59 +01:00
usn_journal_deletion.yml
Added detection testing service results inUSN Journal Deletion
2020-12-08 13:34:34 +00:00
windows_event_log_cleared.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
windows_security_account_manager_stopped.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
wmi_permanent_event_subscription___sysmon.yml
Added detection testing service results inWMI Permanent Event Subscription - Sysmon
2020-12-08 14:58:22 +00:00