admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
08c19369ff1f2ad2dc20718b90afc257e077a9ee
splunk-security_content/detections/application
T
History
Bhavin Patel d8a69dd33e tesing docker setup
2024-07-02 11:42:02 -07:00
..
crushftp_server_side_template_injection.yml
v4.33.0 - BUg fixes
2024-06-06 16:34:39 +00:00
detect_distributed_password_spray_attempts.yml
tesing docker setup
2024-07-02 11:42:02 -07:00
detect_new_login_attempts_to_routers.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
detect_password_spray_attempts.yml
Adding new detections
2024-07-02 12:03:46 +10:00
detect_risky_spl_using_pretrained_ml_model.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
email_attachments_with_lots_of_spaces.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
email_files_written_outside_of_the_outlook_directory.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
email_servers_sending_high_volume_traffic_to_hosts.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
monitor_email_for_brand_abuse.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
no_windows_updates_in_a_time_frame.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
okta_authentication_failed_during_mfa_challenge.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
okta_idp_lifecycle_modifications.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
okta_mfa_exhaustion_hunt.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
okta_mismatch_between_source_and_response_for_verify_push_request.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
okta_multi_factor_authentication_disabled.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
okta_multiple_accounts_locked_out.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
okta_multiple_failed_mfa_requests_for_user.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
okta_multiple_failed_requests_to_access_applications.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
okta_multiple_users_failing_to_authenticate_from_ip.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
okta_new_api_token_created.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
okta_new_device_enrolled_on_account.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
okta_phishing_detection_with_fastpass_origin_check.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
okta_risk_threshold_exceeded.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
okta_successful_single_factor_authentication.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
okta_suspicious_activity_reported.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
okta_suspicious_use_of_a_session_cookie.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
okta_threatinsight_threat_detected.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
okta_unauthorized_access_to_application.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
okta_user_logins_from_multiple_cities.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
path_traversal_spl_injection.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
persistent_xss_in_rapiddiag_through_user_interface_views.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
pingid_mismatch_auth_source_and_verification_response.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
pingid_multiple_failed_mfa_requests_for_user.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
pingid_new_mfa_method_after_credential_reset.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
pingid_new_mfa_method_registered_for_user.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
splunk_absolute_path_traversal_using_runshellscript.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
splunk_account_discovery_drilldown_dashboard_disclosure.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_app_for_lookup_file_editing_rce_via_user_xslt.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
splunk_authentication_token_exposure_in_debug_log.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_code_injection_via_custom_dashboard_leading_to_rce.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_command_and_scripting_interpreter_delete_usage.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_command_and_scripting_interpreter_risky_commands.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_command_and_scripting_interpreter_risky_spl_mltk.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_csrf_in_the_ssg_kvstore_client_endpoint.yml
Release v4.35.0
2024-07-01 17:26:50 +00:00
splunk_data_exfiltration_from_analytics_workspace_using_sid_query.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_digital_certificates_infrastructure_version.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_digital_certificates_lack_of_encryption.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_dos_using_malformed_saml_request.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_dos_via_dump_spl_command.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
splunk_dos_via_malformed_s2s_request.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_dos_via_post_request_datamodel_endpoint.yml
Release v4.35.0
2024-07-01 17:26:50 +00:00
splunk_dos_via_printf_search_function.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_edit_user_privilege_escalation.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
splunk_endpoint_denial_of_service_dos_zip_bomb.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_enterprise_kv_store_incorrect_authorization.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_enterprise_windows_deserialization_file_partition.yml
Release v4.35.0
2024-07-01 17:26:50 +00:00
splunk_es_dos_investigations_manager_via_investigation_creation.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_es_dos_through_investigation_attachments.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_http_response_splitting_via_rest_spl_command.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_improperly_formatted_parameter_crashes_splunkd.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
splunk_information_disclosure_in_splunk_add_on_builder.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
splunk_information_disclosure_on_account_login.yml
Release v4.35.0
2024-07-01 17:26:50 +00:00
splunk_list_all_nonstandard_admin_accounts.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_low_privilege_user_can_view_hashed_splunk_password.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_path_traversal_in_splunk_app_for_lookup_file_edit.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_persistent_xss_via_url_validation_bypass_w_dashboard.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_process_injection_forwarder_bundle_downloads.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_protocol_impersonation_weak_encryption_configuration.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_protocol_impersonation_weak_encryption_selfsigned.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
splunk_protocol_impersonation_weak_encryption_simplerequest.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
splunk_rbac_bypass_on_indexing_preview_rest_endpoint.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
splunk_rce_pdfgen_render.yml
Release v4.35.0
2024-07-01 17:26:50 +00:00
splunk_rce_via_external_lookup_copybuckets.yml
Release v4.35.0
2024-07-01 17:26:50 +00:00
splunk_rce_via_serialized_session_payload.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_rce_via_splunk_secure_gateway__splunk_mobile_alerts_feature.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_rce_via_user_xslt.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_reflected_xss_in_the_templates_lists_radio.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
splunk_reflected_xss_on_app_search_table_endpoint.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_risky_command_abuse_disclosed_february_2023.yml
Release v4.35.0
2024-07-01 17:26:50 +00:00
splunk_stored_xss_conf_web_settings_on_premises.yml
Release v4.35.0
2024-07-01 17:26:50 +00:00
splunk_stored_xss_via_data_model_objectname_field.yml
Release v4.35.0
2024-07-01 17:26:50 +00:00
splunk_stored_xss_via_specially_crafted_bulletin_message.yml
Release v4.35.0
2024-07-01 17:26:50 +00:00
splunk_unauthenticated_dos_via_null_pointer_references.yml
Release v4.35.0
2024-07-01 17:26:50 +00:00
splunk_unauthenticated_log_injection_web_service_log.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_unauthenticated_path_traversal_modules_messaging.yml
Release v4.35.0
2024-07-01 17:26:50 +00:00
splunk_unauthorized_experimental_items_creation.yml
Release v4.35.0
2024-07-01 17:26:50 +00:00
splunk_unauthorized_notification_input_by_user.yml
Release v4.35.0
2024-07-01 17:26:50 +00:00
splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_user_enumeration_attempt.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_xss_in_highlighted_json_events.yml
Release v4.35.0
2024-07-01 17:26:50 +00:00
splunk_xss_in_monitoring_console.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
splunk_xss_in_save_table_dialog_header_in_search_page.yml
Release v4.35.0
2024-07-01 17:26:50 +00:00
splunk_xss_privilege_escalation_via_custom_urls_in_dashboard.yml
Release v4.35.0
2024-07-01 17:26:50 +00:00
splunk_xss_via_external_urls_in_dashboards_ssrf.yml
Release v4.35.0
2024-07-01 17:26:50 +00:00
splunk_xss_via_view.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
suspicious_email_attachment_extensions.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
suspicious_java_classes.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
web_servers_executing_suspicious_processes.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
windows_ad_add_self_to_group.yml
Adding new detections
2024-07-02 10:43:29 +10:00
windows_increase_in_group_or_object_modification_activity.yml
Adding new detections
2024-07-02 10:43:29 +10:00
windows_increase_in_user_modification_activity.yml
Adding new detections
2024-07-02 10:43:29 +10:00