admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
731df609cf14c774b58dc473fc5dd3ab06c4d634
splunk-security_content/detections/network
T
History
Emil 064cbaef0d Internal horizontal port scan nmap iteration (#3802) 
* Running splunk auto format to structure SPL

* Simplifying query by doing more in initial tstats, adding additional information

Moving more logic to tstats in order to simplify and speed up query. Adding lastTime and  fields, which should help with triage and tuning

* Adding in All_Traffic.rule in order to please validation

* rba to src_ip, remove threat_objects

* Update version and date in YAML configuration

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
2025-12-02 14:51:03 -08:00
..
3cx_supply_chain_attack_network_indicators.yml
add drilldowns to production analytics
2025-06-10 16:26:40 +02:00
cisco_configuration_archive_logging_analysis.yml
Update attack_data links
2025-09-09 08:35:57 -04:00
cisco_ios_suspicious_privileged_account_creation.yml
Update attack_data links
2025-09-09 08:35:57 -04:00
cisco_network_interface_modifications.yml
Update attack_data links
2025-09-09 08:35:57 -04:00
cisco_secure_firewall___binary_file_type_download.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
cisco_secure_firewall___bits_network_activity.yml
small tweaks
2025-07-10 16:43:54 +02:00
cisco_secure_firewall___blacklisted_ssl_certificate_fingerprint.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
cisco_secure_firewall___blocked_connection.yml
small tweaks
2025-07-10 16:43:54 +02:00
cisco_secure_firewall___citrix_netscaler_memory_overread_attempt.yml
Update cisco_secure_firewall___citrix_netscaler_memory_overread_attempt.yml
2025-07-18 01:08:25 +02:00
cisco_secure_firewall___communication_over_suspicious_ports.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
cisco_secure_firewall___connection_to_file_sharing_domain.yml
Scattered Lapsus$ Hunters (#3724)
2025-10-21 11:27:25 -07:00
cisco_secure_firewall___file_download_over_uncommon_port.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
cisco_secure_firewall___high_eve_threat_confidence.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
cisco_secure_firewall___high_priority_intrusion_classification.yml
updating risk and drilldowns
2025-05-19 12:11:35 -07:00
cisco_secure_firewall___high_volume_of_intrusion_events_per_host.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
cisco_secure_firewall___intrusion_events_by_threat_activity.yml
updating story
2025-09-25 09:07:12 -07:00
cisco_secure_firewall___lumma_stealer_activity.yml
updating risk and drilldowns
2025-05-19 12:11:35 -07:00
cisco_secure_firewall___lumma_stealer_download_attempt.yml
updating risk and drilldowns
2025-05-19 12:11:35 -07:00
cisco_secure_firewall___lumma_stealer_outbound_connection_attempt.yml
updating risk and drilldowns
2025-05-19 12:11:35 -07:00
cisco_secure_firewall___malware_file_downloaded.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
cisco_secure_firewall___oracle_e_business_suite_correlation.yml
Add Oracle Exploitation Snort Coverage (#3742)
2025-10-23 14:49:04 -07:00
cisco_secure_firewall___oracle_e_business_suite_exploitation.yml
Add Oracle Exploitation Snort Coverage (#3742)
2025-10-23 14:49:04 -07:00
cisco_secure_firewall___possibly_compromised_host.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
cisco_secure_firewall___potential_data_exfiltration.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
cisco_secure_firewall___rare_snort_rule_triggered.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
cisco_secure_firewall___remote_access_software_usage_traffic.yml
Scattered Lapsus$ Hunters (#3724)
2025-10-21 11:27:25 -07:00
cisco_secure_firewall___repeated_blocked_connections.yml
small tweaks
2025-07-10 16:43:54 +02:00
cisco_secure_firewall___repeated_malware_downloads.yml
Hellcat United (#3723)
2025-10-16 16:53:02 -07:00
cisco_secure_firewall___snort_rule_triggered_across_multiple_hosts.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
cisco_secure_firewall___static_tundra_smart_install_abuse.yml
adding a new detections for snort with static tundra sigs
2025-08-21 10:17:54 -07:00
cisco_secure_firewall___veeam_cve_2023_27532_exploitation_activity.yml
updating risk and drilldowns
2025-05-19 12:11:35 -07:00
cisco_secure_firewall___wget_or_curl_download.yml
small tweaks
2025-07-10 16:43:54 +02:00
cisco_smart_install_oversized_packet_detection.yml
Bumped versions
2025-09-09 08:49:59 -04:00
cisco_smart_install_port_discovery_and_status.yml
Scattered Lapsus$ Hunters (#3724)
2025-10-21 11:27:25 -07:00
cisco_snmp_community_string_configuration_changes.yml
Update attack_data links
2025-09-09 08:35:57 -04:00
cisco_tftp_server_configuration_for_data_exfiltration.yml
Update attack_data links
2025-09-09 08:35:57 -04:00
detect_arp_poisoning.yml
New Rules & Updates - Oct 25 (#3726)
2025-10-24 14:19:48 -07:00
detect_dga_domains_using_pretrained_model_in_dsdl.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
detect_dns_query_to_decommissioned_s3_bucket.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
detect_hosts_connecting_to_dynamic_domain_providers.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
detect_ipv6_network_infrastructure_threats.yml
New Rules & Updates - Oct 25 (#3726)
2025-10-24 14:19:48 -07:00
detect_large_icmp_traffic.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
detect_outbound_ldap_traffic.yml
update analytics after review suggestions
2025-06-02 10:30:36 +02:00
detect_outbound_smb_traffic.yml
more fixes
2025-06-17 02:20:37 +02:00
detect_port_security_violation.yml
New Rules & Updates - Oct 25 (#3726)
2025-10-24 14:19:48 -07:00
detect_remote_access_software_usage_dns.yml
Scattered Lapsus$ Hunters (#3724)
2025-10-21 11:27:25 -07:00
detect_remote_access_software_usage_traffic.yml
Scattered Lapsus$ Hunters (#3724)
2025-10-21 11:27:25 -07:00
detect_rogue_dhcp_server.yml
New Rules & Updates - Oct 25 (#3726)
2025-10-24 14:19:48 -07:00
detect_snicat_sni_exfiltration.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
detect_software_download_to_network_device.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
detect_traffic_mirroring.yml
New Rules & Updates - Oct 25 (#3726)
2025-10-24 14:19:48 -07:00
detect_unauthorized_assets_by_mac_address.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
detect_windows_dns_sigred_via_splunk_stream.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
detect_windows_dns_sigred_via_zeek.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
detect_zerologon_via_zeek.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
dns_kerberos_coercion.yml
NTLM Reflection via DNS Object SPN Spoofing (#3789)
2025-11-18 12:59:34 -08:00
dns_query_length_outliers___mltk.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
dns_query_length_with_high_standard_deviation.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
excessive_dns_failures.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
hosts_receiving_high_volume_of_network_traffic_from_email_server.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
internal_horizontal_port_scan_nmap_top_20.yml
Internal horizontal port scan nmap iteration (#3802)
2025-12-02 14:51:03 -08:00
internal_horizontal_port_scan.yml
Scattered Lapsus$ Hunters (#3724)
2025-10-21 11:27:25 -07:00
internal_vertical_port_scan.yml
Scattered Lapsus$ Hunters (#3724)
2025-10-21 11:27:25 -07:00
internal_vulnerability_scan.yml
Scattered Lapsus$ Hunters (#3724)
2025-10-21 11:27:25 -07:00
large_volume_of_dns_any_queries.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
ngrok_reverse_proxy_on_network.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
prohibited_network_traffic_allowed.yml
more fixes
2025-06-17 02:20:37 +02:00
protocol_or_port_mismatch.yml
update analytics after review suggestions
2025-06-02 10:30:36 +02:00
protocols_passing_authentication_in_cleartext.yml
Scattered Lapsus$ Hunters (#3724)
2025-10-21 11:27:25 -07:00
remote_desktop_network_traffic.yml
rdp_artifacts_and_evasion
2025-08-07 14:29:17 +02:00
rundll32_dnsquery.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
smb_traffic_spike___mltk.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
smb_traffic_spike.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
ssl_certificates_with_punycode.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
suspicious_process_dns_query_known_abuse_web_services.yml
quick fixes and updates
2025-06-17 20:32:55 +02:00
suspicious_process_with_discord_dns_query.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
tor_traffic.yml
interlock_ransomware
2025-07-28 11:58:45 +02:00
wermgr_process_connecting_to_ip_check_web_services.yml
quasar_and_loader
2025-07-17 14:51:43 +02:00
windows_abused_web_services.yml
quick fixes and updates
2025-06-17 20:32:55 +02:00
windows_ad_replication_service_traffic.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
windows_ad_rogue_domain_controller_network_activity.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
windows_dns_query_request_by_telegram_bot_api.yml
objectivity_stealer
2025-08-25 18:46:15 +02:00
windows_gather_victim_network_info_through_ip_check_web_services.yml
castlerat (#3750)
2025-11-07 11:08:44 -08:00
windows_multi_hop_proxy_tor_website_query.yml
interlock_ransomware
2025-07-28 11:58:45 +02:00
windows_remote_desktop_network_bruteforce_attempt.yml
rdp_artifacts_and_evasion
2025-08-01 10:13:08 +02:00
windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
zeek_x509_certificate_with_punycode.yml
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00