admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
3d34352b9ab83c8d2bc368ae5beb91c81ba477f8
splunk-security_content/detections/cloud
T
History
Michael Haag c9b348b06f Added rename
2022-07-19 08:50:07 -06:00
..
abnormally_high_number_of_cloud_infrastructure_api_calls.yml
Refactored security content
2022-03-09 14:43:09 +01:00
abnormally_high_number_of_cloud_security_group_api_calls.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_create_policy_version_to_allow_all_resources.yml
Branch was auto-updated.
2022-05-18 15:51:07 -04:00
aws_createaccesskey.yml
Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.
2022-05-02 17:12:50 -07:00
aws_createloginprofile.yml
Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.
2022-05-02 17:12:50 -07:00
aws_cross_account_activity_from_previously_unseen_account.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_detect_users_with_kms_keys_performing_encryption_s3.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_ecr_container_scanning_findings_high.yml
Removed the field "user" from the stats
2022-06-21 15:45:00 -07:00
aws_ecr_container_scanning_findings_low_informational_unknown.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_ecr_container_scanning_findings_medium.yml
Removed user from the stats call of this search
2022-06-21 16:25:20 -07:00
aws_ecr_container_upload_outside_business_hours.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_ecr_container_upload_unknown_user.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_excessive_security_scanning.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_iam_accessdenied_discovery_events.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_iam_assume_role_policy_brute_force.yml
Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.
2022-05-02 17:12:50 -07:00
aws_iam_delete_policy.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_iam_failure_group_deletion.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_iam_successful_group_deletion.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_lambda_updatefunctioncode.yml
updating docs and package bits [ci skip]
2022-03-03 18:22:29 +00:00
aws_network_access_control_list_created_with_all_open_ports.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_network_access_control_list_deleted.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_saml_access_by_provider_user_and_principal.yml
Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.
2022-05-02 17:12:50 -07:00
aws_saml_update_identity_provider.yml
Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.
2022-05-02 17:12:50 -07:00
aws_setdefaultpolicyversion.yml
Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.
2022-05-02 17:12:50 -07:00
aws_updateloginprofile.yml
Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.
2022-05-02 17:12:50 -07:00
azure_active_directory_high_risk_sign_in.yml
Added rename
2022-07-19 08:50:07 -06:00
azure_ad_authentication_failed_during_mfa_challenge.yml
Added rename
2022-07-19 08:50:07 -06:00
azure_ad_multiple_users_failing_to_authenticate_from_ip.yml
Added rename
2022-07-19 08:50:07 -06:00
azure_ad_successful_powershell_authentication.yml
Added rename
2022-07-19 08:50:07 -06:00
azure_ad_successful_single_factor_authentication.yml
Added rename
2022-07-19 08:50:07 -06:00
azure_ad_unusual_number_of_failed_authentications_from_ip.yml
Added rename
2022-07-19 08:50:07 -06:00
circle_ci_disable_security_job.yml
Refactored security content
2022-03-09 14:43:09 +01:00
circle_ci_disable_security_step.yml
Refactored security content
2022-03-09 14:43:09 +01:00
cloud_api_calls_from_previously_unseen_user_roles.yml
Refactored security content
2022-03-09 14:43:09 +01:00
cloud_compute_instance_created_by_previously_unseen_user.yml
Refactored security content
2022-03-09 14:43:09 +01:00
cloud_compute_instance_created_in_previously_unused_region.yml
Refactored security content
2022-03-09 14:43:09 +01:00
cloud_compute_instance_created_with_previously_unseen_image.yml
Refactored security content
2022-03-09 14:43:09 +01:00
cloud_compute_instance_created_with_previously_unseen_instance_type.yml
Refactored security content
2022-03-09 14:43:09 +01:00
cloud_instance_modified_with_previously_unseen_user.yml
Refactored security content
2022-03-09 14:43:09 +01:00
cloud_provisioning_from_previously_unseen_city.yml
Refactored security content
2022-03-09 14:43:09 +01:00
cloud_provisioning_from_previously_unseen_country.yml
Refactored security content
2022-03-09 14:43:09 +01:00
cloud_provisioning_from_previously_unseen_ip_address.yml
Refactored security content
2022-03-09 14:43:09 +01:00
cloud_provisioning_from_previously_unseen_region.yml
Refactored security content
2022-03-09 14:43:09 +01:00
correlation_by_repository_and_risk.yml
Refactored security content
2022-03-09 14:43:09 +01:00
correlation_by_user_and_risk.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_aws_console_login_by_new_user.yml
update detection yml
2022-05-10 15:25:55 -07:00
detect_aws_console_login_by_user_from_new_city.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_aws_console_login_by_user_from_new_country.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_aws_console_login_by_user_from_new_region.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_new_open_s3_buckets_over_aws_cli.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_new_open_s3_buckets.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_shared_ec2_snapshot.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml
Refactored security content
2022-03-09 14:43:09 +01:00
github_actions_disable_security_workflow.yml
github actions detection
2022-04-04 11:08:39 +02:00
github_commit_changes_in_master.yml
improved GitHub detection
2022-04-04 13:23:37 +02:00
github_commit_in_develop.yml
Refactored security content
2022-03-09 14:43:09 +01:00
github_dependabot_alert.yml
Refactored security content
2022-03-09 14:43:09 +01:00
github_pull_request_from_unknown_user.yml
Refactored security content
2022-03-09 14:43:09 +01:00
gsuite_drive_share_in_external_email.yml
adding insider threat, fixing minor display bug
2022-05-19 21:19:35 -04:00
gsuite_email_suspicious_attachment.yml
Refactored security content
2022-03-09 14:43:09 +01:00
gsuite_email_suspicious_subject_with_attachment.yml
Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.
2022-05-02 17:12:50 -07:00
gsuite_email_with_known_abuse_web_service_link.yml
Refactored security content
2022-03-09 14:43:09 +01:00
gsuite_outbound_email_with_attachment_to_external_domain.yml
adding insider threat, fixing minor display bug
2022-05-19 21:19:35 -04:00
gsuite_suspicious_shared_file_name.yml
Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.
2022-05-02 17:12:50 -07:00
kubernetes_nginx_ingress_lfi.yml
Refactored security content
2022-03-09 14:43:09 +01:00
kubernetes_nginx_ingress_rfi.yml
Updated a large number of the links in other detections. Also, adjusted the number of threads that run and tweaked the timeout time.
2022-05-03 10:34:10 -07:00
kubernetes_scanner_image_pulling.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_add_app_role_assignment_grant_user.yml
Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.
2022-05-02 17:12:50 -07:00
o365_added_service_principal.yml
Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.
2022-05-02 17:12:50 -07:00
o365_bypass_mfa_via_trusted_ip.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_disable_mfa.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_excessive_authentication_failures_alert.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_excessive_sso_logon_errors.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_new_federated_domain_added.yml
Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.
2022-05-02 17:12:50 -07:00
o365_pst_export_alert.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_suspicious_admin_email_forwarding.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_suspicious_rights_delegation.yml
Refactored security content
2022-03-09 14:43:09 +01:00
o365_suspicious_user_email_forwarding.yml
Refactored security content
2022-03-09 14:43:09 +01:00