admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
17aa4ebabffdfe1ef97c2b33ce628b7122043965
splunk-security_content/macros
T
History
dluxtron b17c2d1e17 fixing SPL
2024-10-17 15:41:19 +10:00
..
admon.yml
renaming and adding new detection
2023-03-29 16:12:53 -04:00
amazon_security_lake.yml
Release Branch - ESCU v4.32.0
2024-05-22 16:47:39 +00:00
applocker.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
aws_cloudwatchlogs_eks.yml
new generate script
2020-05-06 17:42:38 +02:00
aws_config.yml
converted response_task to investigations
2021-07-26 13:39:17 +02:00
aws_description.yml
converted response_task to investigations
2021-07-26 13:39:17 +02:00
aws_ecr_users_asl.yml
Release Branch - ESCU v4.32.0
2024-05-22 16:47:39 +00:00
aws_ecr_users.yml
container upload aws ecr
2021-08-19 15:51:17 +02:00
aws_s3_accesslogs.yml
new generate script
2020-05-06 17:42:38 +02:00
aws_securityhub_finding.yml
rename
2021-01-26 19:28:03 -08:00
aws_securityhub_firehose.yml
converted response_task to investigations
2021-07-26 13:39:17 +02:00
azure_audit.yml
fixing detection. adding azure_audit macro
2022-08-22 15:36:25 -04:00
azure_monitor_aad.yml
Release branch v4.16.0
2023-11-16 20:33:10 +00:00
azuread.yml
fixing macro
2022-07-12 10:26:48 -04:00
base64decode.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
bootloader_inventory.yml
inventory
2023-04-14 12:02:42 -06:00
brand_abuse_dns.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
brand_abuse_email.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
brand_abuse_web.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
capi2_operational.yml
fixes
2023-02-09 14:32:34 -07:00
certificateservices_lifecycle.yml
Cert services and MOAR
2023-02-03 06:58:50 -07:00
circleci.yml
circle ci detecction
2021-09-01 17:54:38 +02:00
cisco_networks.yml
Adding macros
2020-08-12 09:17:32 +02:00
cloud_api_calls_from_previously_unseen_user_roles_activity_window.yml
single and double quote order issue
2020-09-23 17:32:52 -05:00
cloudtrail.yml
new generate script
2020-05-06 17:42:38 +02:00
cloudwatch_eks.yml
validate script
2020-04-30 16:52:38 +02:00
cloudwatch_vpc.yml
validate script
2020-04-30 16:52:38 +02:00
cloudwatchlogs_vpcflow.yml
new generate script
2020-05-06 17:42:38 +02:00
crowdstrike_identities.yml
crowdstrike_analytics
2024-07-31 11:10:41 +02:00
crowdstrike_stream.yml
crowdstrike_analytics
2024-07-31 11:10:41 +02:00
crushftp.yml
Release Branch v4.33.0
2024-06-05 21:05:06 +00:00
driverinventory.yml
Driver Inventory
2023-02-03 14:51:28 -07:00
dynamic_dns_providers.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
dynamic_dns_web_traffic.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
ec2_modification_api_calls.yml
Removed a few API calls that are not really modifications
2020-08-18 13:47:04 -05:00
evilginx_phishlets_0365.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_amazon.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_aws.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_facebook.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_github.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_google.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_outlook.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
exchange.yml
fixes
2021-09-01 16:58:23 -06:00
f5_bigip_rogue.yml
ymls and updates
2020-08-04 14:04:38 -07:00
fillnull_config.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
filter_rare_process_allow_list.yml
Changed the language in some of the descriptions
2021-01-21 23:53:47 -06:00
github_known_users.yml
github detection
2021-09-01 13:56:23 +02:00
github.yml
dev_git
2021-08-27 13:28:06 +02:00
google_gcp_pubnet_message.yml
validate script
2020-04-30 16:52:38 +02:00
google_gcp_pubsub_message.yml
new generate script
2020-05-06 17:42:38 +02:00
gsuite_calendar.yml
search update
2021-11-02 18:03:21 -07:00
gsuite_drive.yml
dev_ops_uc
2021-08-18 15:58:35 +02:00
gsuite_gmail.yml
dev_ops_uc
2021-08-18 15:58:35 +02:00
gws_login_mfa_methods.yml
adding 4 GCP account takeover detections
2022-10-14 15:03:54 -04:00
gws_reports_admin.yml
adding 4 GCP account takeover detections
2022-10-14 15:03:54 -04:00
gws_reports_login.yml
adding gcp configs
2022-10-12 18:09:41 -07:00
iis_get_webglobalmodule.yml
Fantastic IIS Modules and Where to Find Them
2022-12-21 08:53:03 -07:00
iis_operational_logs.yml
Fantastic IIS Modules and Where to Find Them
2022-12-21 08:53:03 -07:00
is_net_windows_file_macro.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
is_nirsoft_software_macro.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
is_windows_system_file_macro.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
ivanti_vtm_audit.yml
Guardians of the Haaglaxy
2024-08-20 10:53:01 -06:00
kube_allowed_images.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
kube_allowed_locations.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
kube_allowed_user_agents.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
kube_allowed_user_groups.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
kube_allowed_user_names.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
kube_audit.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
kube_container_falco.yml
Release Branch ESCU 4.23.0
2024-01-30 20:52:05 +00:00
kube_objects_events.yml
k8s scanner
2021-08-25 10:49:51 +02:00
kubernetes_azure.yml
updating files to make sure validate passes
2020-06-03 13:10:30 -07:00
kubernetes_container_controller.yml
new detection
2021-08-23 10:17:40 +02:00
kubernetes_metrics.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
linux_auditd_normalized_execve_process.yml
linux_auditd_detection
2024-08-09 10:46:52 +02:00
linux_auditd_normalized_proctitle_process.yml
linux_auditd_detection
2024-08-09 10:46:52 +02:00
linux_auditd.yml
linux_auditd_detection
2024-08-09 10:46:52 +02:00
linux_hosts.yml
Update linux_hosts.yml
2024-08-13 09:34:53 -06:00
linux_shells.yml
Fix incorrect quotes in linux_shells.yml
2022-11-08 08:51:20 +13:00
moveit_sftp_logs.yml
The Haag Returns
2024-07-24 12:16:25 -06:00
ms_defender.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
msexchange_management.yml
its a macro life
2022-11-21 15:20:47 -07:00
netbackup.yml
new generate script
2020-05-06 17:42:38 +02:00
network_acl_events.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
nginx_access_logs.yml
ESCU v4.26.0 Release branch
2024-03-06 19:30:20 +00:00
ntlm_audit.yml
Add files via upload
2024-03-16 11:33:20 -04:00
o365_graph.yml
4.17.0 release branch
2023-12-06 18:40:13 +00:00
o365_management_activity.yml
changes
2020-12-15 12:27:16 +01:00
okta.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
oldsummaries_config.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
osquery_macro.yml
Needed to change the name of the osquery macro due to a conflict with the newly introduced osquery data_source. Additionally, fixed a serious error in mapNamesToSecurityContentObjects wherein a Security Content Object of the wrong type could be returned.
2024-07-24 16:15:54 -07:00
osquery_process.yml
duplicating files and experimental
2021-01-28 17:35:25 -08:00
papercutng.yml
The Haag Mile: A Journey of Redemption
2023-05-15 13:22:04 -06:00
pingid.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
potential_password_in_username_false_positive_reduction.yml
map filter
2022-06-21 12:24:04 -07:00
potentially_malicious_code_on_cmdline_tokenize_score.yml
Editing the macro to put the apply statement into the search query so that it's clear that MLTK is being used
2022-01-26 22:38:13 -05:00
powershell.yml
PowerShell 4104 copy of Security HIVES
2021-07-21 13:57:10 -06:00
previously_seen_cloud_api_calls_per_user_role_forget_window.yml
macro fixes
2020-09-23 17:16:35 -05:00
previously_seen_cloud_compute_creations_by_user_search_window_begin_offset.yml
Macro fixes
2020-09-23 17:22:02 -05:00
previously_seen_cloud_compute_image_search_window_begin_offset.yml
Macro fixes
2020-09-23 17:22:02 -05:00
previously_seen_cloud_compute_images_forget_window.yml
macro fixes
2020-09-23 17:16:35 -05:00
previously_seen_cloud_compute_instance_type_forget_window.yml
macro fixes
2020-09-23 17:16:35 -05:00
previously_seen_cloud_compute_instance_types_search_window_begin_offset.yml
Macro fixes
2020-09-23 17:22:02 -05:00
previously_seen_cloud_instance_modifications_by_user_search_window_begin_offset.yml
Macro fixes
2020-09-23 17:22:02 -05:00
previously_seen_cloud_provisioning_activity_forget_window.yml
macro fixes
2020-09-23 17:16:35 -05:00
previously_seen_cloud_region_forget_window.yml
macro fixes
2020-09-23 17:16:35 -05:00
previously_seen_cloud_regions_search_window_begin_offset.yml
Macro fixes
2020-09-23 17:22:02 -05:00
previously_seen_windows_services_forget_window.yml
macro fixes
2020-09-23 17:16:35 -05:00
previously_seen_windows_services_window.yml
bug fix
2021-02-03 15:44:56 +01:00
previously_seen_zoom_child_processes_forget_window.yml
macro fixes
2020-09-23 17:16:35 -05:00
previously_seen_zoom_child_processes_window.yml
Macro fixes
2020-09-23 17:22:02 -05:00
previously_unseen_cloud_provisioning_activity_window.yml
Macro fixes
2020-09-23 17:22:02 -05:00
printservice.yml
fixing issue with printservice macro
2022-06-01 13:13:24 -04:00
process_bitsadmin.yml
macro'd bitsadmin
2021-08-17 15:20:40 -06:00
process_certutil.yml
macro'd certutil
2021-08-17 15:00:51 -06:00
process_cmd.yml
macro'd wmic
2021-08-17 11:44:30 -06:00
process_copy.yml
privilege_escalation_persistence
2021-10-05 11:56:48 +02:00
process_csc.yml
ioc_detections
2021-11-17 16:09:42 +01:00
process_curl.yml
fixes
2021-10-20 07:08:14 -06:00
process_diskshadow.yml
DiskShadow + Story Scaffolding
2022-02-17 10:12:50 -06:00
process_dllhost.yml
macros
2021-08-18 09:50:08 -06:00
process_dsquery.yml
macros
2021-08-18 09:50:08 -06:00
process_dxdiag.yml
more_ioc_detections
2021-11-19 12:01:45 +01:00
process_esentutl.yml
Update process_esentutl.yml
2021-08-18 11:14:13 -06:00
process_fodhelper.yml
macros
2021-08-18 09:50:08 -06:00
process_gpupdate.yml
macros
2021-08-18 09:50:08 -06:00
process_hh.yml
macro'd hh
2021-08-17 14:29:16 -06:00
process_installutil.yml
InstallUTIL 🍺
2021-11-12 13:05:19 -07:00
process_microsoftworkflowcompiler.yml
macros
2021-08-18 09:50:08 -06:00
process_msbuild.yml
msbuild and microsoftworkflowcompiler
2021-08-19 06:57:11 -06:00
process_mshta.yml
macro'd mshta
2021-08-17 13:38:11 -06:00
process_msiexec.yml
T1218.007 - MSIExec
2022-06-17 09:36:34 -06:00
process_net.yml
macro'd net
2021-08-17 13:56:57 -06:00
process_netsh.yml
macro'd netsh
2021-08-17 15:14:35 -06:00
process_nltest.yml
macros
2021-08-18 09:50:08 -06:00
process_ntdsutil.yml
macros
2021-08-18 09:50:08 -06:00
process_ping.yml
WhisperGateIsOpen
2022-01-20 15:11:12 +01:00
process_powershell.yml
Macro'd powershell
2021-08-17 11:15:36 -06:00
process_procdump.yml
no longer need sysmon procdump - updated superior procdump
2021-09-16 12:06:20 -06:00
process_psexec.yml
hh, mshta, and psexec
2021-09-16 11:13:15 -06:00
process_rclone.yml
rookie mistake
2021-11-30 05:34:29 -07:00
process_reg.yml
macro'd reg cmd
2021-08-17 12:09:31 -06:00
process_regasm.yml
macros
2021-08-18 09:50:08 -06:00
process_regsvcs.yml
macros
2021-08-18 09:50:08 -06:00
process_regsvr32.yml
macro'd regsvr32
2021-08-17 13:27:48 -06:00
process_route.yml
ioc_detections
2021-11-17 16:09:42 +01:00
process_runas.yml
ioc_detections
2021-11-17 16:09:42 +01:00
process_rundll32.yml
macrod rundll32
2021-08-17 13:21:24 -06:00
process_schtasks.yml
macros
2021-08-18 09:50:08 -06:00
process_sdelete.yml
privilege_escalation_persistence
2021-10-06 11:15:47 +02:00
process_setspn.yml
HaagRoast
2021-10-15 12:31:33 -06:00
process_verclsid.yml
privilege_escalation_persistence
2021-09-29 10:42:05 +02:00
process_vssadmin.yml
macros
2021-08-18 09:50:08 -06:00
process_wbadmin.yml
macros
2021-08-18 09:50:08 -06:00
process_wermgr.yml
qakbot_2
2022-10-27 16:07:23 +02:00
process_wmic.yml
Macro'd powershell
2021-08-17 11:15:36 -06:00
prohibited_apps_launching_cmd_macro.yml
ESCU Release v4.31.0
2024-05-08 16:05:40 +00:00
prohibited_softwares.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
ransomware_extensions.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
ransomware_notes.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
remote_access_software_usage_exceptions.yml
Modified macro name for clarity, updated how to implements with details
2024-07-26 14:11:24 -05:00
remoteconnectionmanager.yml
the fox and the hen
2023-04-18 13:17:55 -06:00
remove_valid_domains.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
risk_index.yml
add risk index macro
2022-12-21 14:12:18 -08:00
s3_accesslogs.yml
validate script
2020-04-30 16:52:38 +02:00
security_content_ctime.yml
Present times in ISO8601 instead of US style
2020-08-12 23:45:53 +02:00
security_content_summariesonly.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
security_group_api_calls.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
stream_dns.yml
porting ymls into a newe PR
2020-08-04 12:55:12 -07:00
stream_http.yml
new generate script
2020-05-06 17:42:38 +02:00
stream_tcp.yml
porting ymls into a newe PR
2020-08-04 12:55:12 -07:00
subjectinterfacepackage.yml
macro
2023-10-13 12:32:19 -06:00
summariesonly_config.yml
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
suricata.yml
ESCU v4.26.0 Release branch
2024-03-06 19:30:20 +00:00
suspicious_email_attachments.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
suspicious_writes.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
sysmon.yml
updating sysmon macro
2021-12-13 18:00:14 -05:00
system_network_configuration_discovery_tools.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
uacbypass_process_name.yml
Release 4.19.0
2024-01-10 17:21:34 +00:00
uncommon_processes.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
windows_shells.yml
Update windows_shells.yml
2023-01-26 15:21:15 -07:00
wineventlog_application.yml
Update wineventlog_application.yml
2022-09-12 08:53:24 -06:00
wineventlog_security.yml
update macro
2023-02-10 12:55:26 -05:00
wineventlog_system.yml
new generate script
2020-05-06 17:42:38 +02:00
wineventlog_task_scheduler.yml
fixing SPL
2024-10-17 15:41:19 +10:00
wmi.yml
new generate script
2020-05-06 17:42:38 +02:00
zeek_rpc.yml
adding macros
2020-09-18 17:36:46 -04:00
zeek_ssl.yml
mods
2020-11-06 11:08:38 +11:00
zeek_x509.yml
remove index
2022-11-11 13:16:59 -08:00
zscaler_proxy.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00