admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
59729366359a76dd23d4b93fdda48916cc3558f0
splunk-security_content/detections
T
History
Brianna 5972936635 Update dyn_dns_queries.json
2019-08-23 12:09:04 -07:00
..
abnormally_high_instance_termination.json
Owner reviewed
2019-08-15 17:37:44 -07:00
abnormally_high_instances_launched.json
Owner reviewed
2019-08-15 17:37:44 -07:00
account_harvesting.json
Modified att&ck mappings for these files. Mostly just added the high level tactic, but also tweaked some incluidng smb spike searches and ones about creating accounts
2019-08-22 09:57:45 -06:00
acl_with_open_ports.json
Owner reviewed
2019-08-15 17:37:44 -07:00
activity_related_to_pass_the_hash.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
add_to_untrust_cert_store.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
anomalous_webclick.json
Modified att&ck mappings for these files. Mostly just added the high level tactic, but also tweaked some incluidng smb spike searches and ones about creating accounts
2019-08-22 09:57:45 -06:00
api_acitivity_from_previously_unseen_user_role.json
Owner reviewed
2019-08-15 17:37:44 -07:00
attackers_scanning_for_vulnerable_jboss_servers.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
attrib_to_hide_files.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
aws_activity_from_non_approved_accounts.json
Owner reviewed
2019-08-15 17:37:44 -07:00
aws_activity_in_new_region.json
Owner reviewed
2019-08-15 17:37:44 -07:00
aws_cloud_provisioning_from_previously_unseen_city.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
aws_cloud_provisioning_from_previously_unseen_country.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
aws_cloud_provisioning_from_previously_unseen_ip.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
aws_cloud_provisioning_from_previously_unseen_region.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
aws_cross_account_activity_from_new_account.json
more tweaks/fixes to manifests - also adjustments to validation script and spec files. Successfully validates with exception of usecase in stories
2019-07-25 14:56:40 -06:00
aws_spike_acl_activity.json
Owner reviewed
2019-08-15 17:37:44 -07:00
badrabbit_schtasks.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
batch_file_write_system32.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
brand_abuse_dns.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
brand_abuse_email.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
brand_abuse_web.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
change_file_association.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
children_of_spoolsv.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
clients_connecting_to_multiple_dns_servers.json
All manifests converted to spec v2
2019-07-25 09:48:06 -06:00
common_ransomware_extensions.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
common_ransomware_notes.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
create_hidden_shares.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
create_local_admin_via_net.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
cred_dump_via_reg.json
fixed channel in stories, minor tweaks to detections.
2019-08-06 14:58:39 -06:00
cscript_via_cmd.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
delete_shadow_copies.json
fixed channel in stories, minor tweaks to detections.
2019-08-06 14:58:39 -06:00
deletion_network_acl.json
Owner reviewed
2019-08-15 17:37:44 -07:00
disable_remote_uac.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
dns_amplification_any_query.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
dns_evilginx_subdomains.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
dns_query_length_mltk.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
dns_query_length_with_high_standard_deviation.json
updated to v2 spec
2019-08-14 12:03:19 -04:00
dns_record_changed.json
All manifests converted to spec v2
2019-07-25 09:48:06 -06:00
dns_tunnelling.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
dragonfly_schtasks.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
dyn_dns_queries.json
Update dyn_dns_queries.json
2019-08-23 12:09:04 -07:00
dyn_dns_web_traffic.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
ec2_instance_created_by_previously_unseen_user.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
ec2_instance_modified_by_previously_unseen_user.json
more tweaks/fixes to manifests - also adjustments to validation script and spec files. Successfully validates with exception of usecase in stories
2019-07-25 14:56:40 -06:00
ec2_instance_started_with_previously_unseen_ami.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
ec2_instance_started_with_previously_unseen_instance_type.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
email_attachments_with_spaces.json
All manifests converted to spec v2
2019-07-25 09:48:06 -06:00
email_files_not_in_outlook_directory.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
emailserver_high_volume_outbound_traffic_to_hosts.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
excessive_dns_failures.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
excessive_lockouts_from_endpoint.json
Modified att&ck mappings for these files. Mostly just added the high level tactic, but also tweaked some incluidng smb spike searches and ones about creating accounts
2019-08-22 09:57:45 -06:00
excessive_user_account_lockouts.json
Modified att&ck mappings for these files. Mostly just added the high level tactic, but also tweaked some incluidng smb spike searches and ones about creating accounts
2019-08-22 09:57:45 -06:00
execution_of_nirsoft_tools.json
Modified att&ck mappings for these files. Mostly just added the high level tactic, but also tweaked some incluidng smb spike searches and ones about creating accounts
2019-08-22 09:57:45 -06:00
file_write_spikes.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
first_time_seen_cmd_line.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
first_time_seen_running_windows_service.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
fsutil_deleting_journals.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
hosts_file_modification.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
hosts_receiving_high_volume_network_traffic_from_email_servers.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
large_icmp_outbound.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
lnk_executing_a_process.json
Modified att&ck mappings for these files. Mostly just added the high level tactic, but also tweaked some incluidng smb spike searches and ones about creating accounts
2019-08-22 09:57:45 -06:00
local_admin_account_creation.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
long_dns_text_response.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
malicious_application_shimming_via_registry.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
malicious_powershell_process_connect_to_internet_with_hidden_window.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
malicious_powershell_process_encoded_command.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
malicious_powershell_process_execpolicy.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
malicious_powershell_process_multiple_suspicious_arguments.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
malicious_powershell_process_obfuscation_techniques.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
malicious_requests_to_exploit_jboss_servers.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
mshta_launching_scripts.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
netbackup_failed_backup.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
netbackup_no_backups_in_time_period.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
netsh_launching_process.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
new_aws_console_login_by_user.json
All manifests converted to spec v2
2019-07-25 09:48:06 -06:00
new_aws_console_login_city_by_user.json
All manifests converted to spec v2
2019-07-25 09:48:06 -06:00
new_aws_console_login_country_by_user.json
All manifests converted to spec v2
2019-07-25 09:48:06 -06:00
new_aws_console_login_region_by_user.json
All manifests converted to spec v2
2019-07-25 09:48:06 -06:00
new_connections_to_routers.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
new_open_s3_buckets.json
Owner reviewed
2019-08-15 17:37:44 -07:00
new_user_accounts.json
Modified att&ck mappings for these files. Mostly just added the high level tactic, but also tweaked some incluidng smb spike searches and ones about creating accounts
2019-08-22 09:57:45 -06:00
no_win_updates_in_timeframe.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
open_redirect_in_splunk_web.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
osx_coldroot_pack.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
osx_keyboard_taps.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
outbound_smb_connections.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
outlook_writing_zip.json
Modified att&ck mappings for these files. Mostly just added the high level tactic, but also tweaked some incluidng smb spike searches and ones about creating accounts
2019-08-22 09:57:45 -06:00
overwrite_accessibility_binaries.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
password_sharing.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
path_interception_program.exe.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
port_monitor_via_registry.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
powershell_get_sedebug.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
powershell_read_from_lsass.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
powershell_reg_key_mod.json
fixed channel in stories, minor tweaks to detections.
2019-08-06 14:58:39 -06:00
process_launching_netsh.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
process_with_double_extension.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
process_with_spaces_before_extension.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
prohibited_allowed_through_fw.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
prohibited_apps_spawning_cmdprompt.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
prohibited_software_on_endpoint.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
protocol_mismatch.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
protocols_authenticating_in_cleartext.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
psexec_accepteula.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
rare_executables_on_endpoint.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
reg_manipulating_services.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
reg_used_to_hide_files.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
registry_persistence.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
registry_privilege_escalation.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
remote_desktop_bruteforce.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
remote_desktop_network_traffic.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
remote_desktop_process_running_on_system.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
remote_registry_modifications.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
remote_wmi_command_attempt.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
remote_wmi_process_instantiation.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
rundll_loading_dll_by_ordinal.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
s3_access_from_new_ip.json
Owner reviewed
2019-08-15 17:37:44 -07:00
samsam_payload_extensions.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
samsam_test_file_write.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
sc_manipulating_services.json
fixing merge conflicts
2019-08-06 17:45:35 -04:00
schtasks_forced_reboot.json
fixed channel in stories, minor tweaks to detections.
2019-08-06 14:58:39 -06:00
schtasks_scheduling_job_on_remote_system.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
shim_database_file_creation.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
shim_database_installation.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
short_lived_accounts.json
Modified att&ck mappings for these files. Mostly just added the high level tactic, but also tweaked some incluidng smb spike searches and ones about creating accounts
2019-08-22 09:57:45 -06:00
single_letter_executables.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
smb_traffic_spike_mltk.json
Modified att&ck mappings for these files. Mostly just added the high level tactic, but also tweaked some incluidng smb spike searches and ones about creating accounts
2019-08-22 09:57:45 -06:00
smb_traffic_spike.json
Modified att&ck mappings for these files. Mostly just added the high level tactic, but also tweaked some incluidng smb spike searches and ones about creating accounts
2019-08-22 09:57:45 -06:00
sncd_processes.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
spectre_meltdown_vulnerabilities.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
spike_aws_api_call_per_account.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
spike_aws_security_group_activity.json
Owner reviewed
2019-08-15 17:37:44 -07:00
spike_s3_deletion.json
Owner reviewed
2019-08-15 17:37:44 -07:00
spike_vpc_blocked_traffic.json
Owner reviewed
2019-08-15 17:37:44 -07:00
splunk_information_disclosure.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
sql_injection_with_long_urls.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
stop_security_services.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
suspicious_email_attachments.json
All manifests converted to spec v2
2019-07-25 09:48:06 -06:00
suspicious_file_writes.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
suspicious_java_classes.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
suspicious_reg_process.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
suspicious_wevtutil_usage.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
suspicious_write_to_recycler.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
suspicious_write_to_sysvol.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
system_processes_run_from_unexpected_locations.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
tor_traffic.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
uba_email_anomaly.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
unauthorized_assets_via_mac_address.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
unauthorized_dns_servers.json
All manifests converted to spec v2
2019-07-25 09:48:06 -06:00
uncommon_processes.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
unusually_long_commandlines_mltk.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
unusually_long_commandlines.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
unusually_long_content-type_length.json
fixed channel in stories, minor tweaks to detections.
2019-08-06 14:58:39 -06:00
usb_insertion.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
users_without_mfa.json
Owner reviewed
2019-08-15 17:37:44 -07:00
web_servers_executing_suspicious_processes.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
windows_event_log_cleared.json
modifications to baselines, investigations as appropriate and added usecase field to stories
2019-08-06 13:38:09 -06:00
wmi_perm_event_subscription_sysmon.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
wmi_perm_event_subscription.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
wmi_process_launch.json
fixing merge conflicts
2019-08-06 17:45:35 -04:00
wmi_script_execution.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00
wmi_temp_event_subscription.json
fixed duplicate investigations and added new content for latest release
2019-07-29 11:53:01 -06:00