Br3akp0int 697a77cd08 Add Tagging and Analytic Story for Void Manticore (#3959) ...

---------

Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

2026-03-23 17:19:07 +01:00

..

3cx_supply_chain_attack_network_indicators.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

cisco_configuration_archive_logging_analysis.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_ios_suspicious_privileged_account_creation.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_network_interface_modifications.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_privileged_account_creation_with_http_command_execution.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_privileged_account_creation_with_suspicious_ssh_activity.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_sd_wan___arbitrary_file_overwrite_exploitation_activity.yml

More SD-WAN Content (#3944)

2026-03-12 18:16:41 +05:30

cisco_sd_wan___low_frequency_rogue_peer.yml

Fix Broken Link, Versions and Pre-Commit (#3956)

2026-03-13 19:17:15 +05:30

cisco_sd_wan___peering_activity.yml

Fix Broken Link, Versions and Pre-Commit (#3956)

2026-03-13 19:17:15 +05:30

cisco_sd_wan___uncommon_user_agent_multi_uri_activity.yml

More SD-WAN Content (#3944)

2026-03-12 18:16:41 +05:30

cisco_secure_firewall___binary_file_type_download.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_secure_firewall___bits_network_activity.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

cisco_secure_firewall___blocked_connection.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_secure_firewall___citrix_netscaler_memory_overread_attempt.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

cisco_secure_firewall___communication_over_suspicious_ports.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_secure_firewall___connection_to_file_sharing_domain.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_secure_firewall___file_download_over_uncommon_port.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_secure_firewall___high_eve_threat_confidence.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_secure_firewall___high_priority_intrusion_classification.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

cisco_secure_firewall___high_volume_of_intrusion_events_per_host.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_secure_firewall___intrusion_events_by_threat_activity.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_secure_firewall___lumma_stealer_activity.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

cisco_secure_firewall___lumma_stealer_download_attempt.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_secure_firewall___lumma_stealer_outbound_connection_attempt.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_secure_firewall___malware_file_downloaded.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_secure_firewall___oracle_e_business_suite_correlation.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

cisco_secure_firewall___oracle_e_business_suite_exploitation.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

cisco_secure_firewall___possibly_compromised_host.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_secure_firewall___potential_data_exfiltration.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_secure_firewall___privileged_command_execution_via_http.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_secure_firewall___rare_snort_rule_triggered.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

cisco_secure_firewall___react_server_components_rce_attempt.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

cisco_secure_firewall___remote_access_software_usage_traffic.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_secure_firewall___repeated_blocked_connections.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_secure_firewall___repeated_malware_downloads.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_secure_firewall___snort_rule_triggered_across_multiple_hosts.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_secure_firewall___ssh_connection_to_non_standard_port.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_secure_firewall___ssh_connection_to_sshd_operns.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_secure_firewall___static_tundra_smart_install_abuse.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

cisco_secure_firewall___veeam_cve_2023_27532_exploitation_activity.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

cisco_secure_firewall___wget_or_curl_download.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_smart_install_oversized_packet_detection.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

cisco_smart_install_port_discovery_and_status.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

cisco_snmp_community_string_configuration_changes.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

cisco_tftp_server_configuration_for_data_exfiltration.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

detect_arp_poisoning.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

detect_dns_query_to_decommissioned_s3_bucket.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

detect_hosts_connecting_to_dynamic_domain_providers.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

detect_ipv6_network_infrastructure_threats.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

detect_large_icmp_traffic.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

detect_outbound_ldap_traffic.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

detect_outbound_smb_traffic.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

detect_port_security_violation.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

detect_remote_access_software_usage_dns.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

detect_remote_access_software_usage_traffic.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

detect_rogue_dhcp_server.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

detect_snicat_sni_exfiltration.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

detect_software_download_to_network_device.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

detect_traffic_mirroring.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

detect_unauthorized_assets_by_mac_address.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

detect_windows_dns_sigred_via_splunk_stream.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

detect_windows_dns_sigred_via_zeek.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

detect_zerologon_via_zeek.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

dns_kerberos_coercion.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

dns_query_length_with_high_standard_deviation.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

excessive_dns_failures.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

hosts_receiving_high_volume_of_network_traffic_from_email_server.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

http_c2_framework_user_agent.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

http_malware_user_agent.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

http_pua_user_agent.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

http_rmm_user_agent.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

internal_horizontal_port_scan_nmap_top_20.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

internal_horizontal_port_scan.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

internal_vertical_port_scan.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

internal_vulnerability_scan.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

large_volume_of_dns_any_queries.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

ngrok_reverse_proxy_on_network.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

prohibited_network_traffic_allowed.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

protocol_or_port_mismatch.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

protocols_passing_authentication_in_cleartext.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

remote_desktop_network_traffic.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

rundll32_dnsquery.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

smb_traffic_spike.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

ssl_certificates_with_punycode.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30

suspicious_process_dns_query_known_abuse_web_services.yml

Add BlankGrabber Stealer Related Analytics and Tagging (#3943)

2026-03-16 18:09:57 +01:00

suspicious_process_with_discord_dns_query.yml

Add BlankGrabber Stealer Related Analytics and Tagging (#3943)

2026-03-16 18:09:57 +01:00

tor_traffic.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

wermgr_process_connecting_to_ip_check_web_services.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

windows_abused_web_services.yml

Add BlankGrabber Stealer Related Analytics and Tagging (#3943)

2026-03-16 18:09:57 +01:00

windows_ad_replication_service_traffic.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

windows_ad_rogue_domain_controller_network_activity.yml

ttp_standard_init_score (#3945)

2026-03-10 14:10:37 +05:30

windows_dns_query_request_by_telegram_bot_api.yml

Add BlankGrabber Stealer Related Analytics and Tagging (#3943)

2026-03-16 18:09:57 +01:00

windows_gather_victim_network_info_through_ip_check_web_services.yml

Add Tagging and Analytic Story for Void Manticore (#3959)

2026-03-23 17:19:07 +01:00

windows_multi_hop_proxy_tor_website_query.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

windows_remote_desktop_network_bruteforce_attempt.yml

anomaly_standard_init_score (#3946)

2026-03-10 14:19:08 +05:30

windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml

Add Analytic Story Tagging for Muddy Water (#3947)

2026-03-12 16:30:09 +00:00

zeek_x509_certificate_with_punycode.yml

Add YAML Formatting Job (#3889)

2026-02-26 00:00:35 +05:30