admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
7c7eb484dec88f3c6daa1bfbb7fdfe1daa7de4eb
splunk-security_content/stories
T
History
Michael Haag 93d7a12e33 Citrix Bleed
2023-10-26 18:06:47 +00:00
..
deprecated
Added story back to deprecated
2023-02-21 11:11:03 -06:00
3cx_supply_chain_attack.yml
3CX - CVE-2023-29059
2023-03-31 12:07:36 -06:00
acidrain.yml
Update acidrain.yml
2022-04-12 12:22:58 +02:00
active_directory_discovery.yml
Refactored security content
2022-03-09 14:43:09 +01:00
active_directory_kerberos_attacks.yml
Refactored security content
2022-03-09 14:43:09 +01:00
active_directory_lateral_movement.yml
Refactored security content
2022-03-09 14:43:09 +01:00
active_directory_password_spraying.yml
update description
2022-09-26 11:03:27 -04:00
active_directory_privilege_escalation.yml
Added missing category to story. This is
2023-06-06 13:31:21 -07:00
adobe_coldfusion_arbitrary_code_execution_cve_2023_29298_cve_2023_26360.yml
yaml fix
2023-08-30 09:51:24 -07:00
agenttesla.yml
agent-with-tesla-1
2022-09-19 11:28:07 +02:00
amadey.yml
encode fix
2023-06-22 16:54:50 -07:00
apache_struts_vulnerability.yml
updated stories
2021-07-21 12:26:15 +02:00
asset_tracking.yml
updated stories
2021-07-21 12:26:15 +02:00
asyncrat.yml
asyncrat-onenote-chain
2023-01-24 11:00:35 +01:00
atlassian_confluence_server_and_data_center_cve_2022_26134.yml
Fluent in Confluence
2022-06-03 21:29:00 -06:00
awfulshred.yml
awfulshred
2023-02-08 15:28:32 +01:00
aws_cross_account_activity.yml
updated stories
2021-07-21 12:26:15 +02:00
aws_defense_evasion.yml
Updates
2022-07-28 12:07:05 -06:00
aws_iam_privilege_escalation.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_identity_and_access_management_account_takeover.yml
format updates
2022-09-26 17:05:51 -05:00
aws_network_acl_activity.yml
updated stories
2021-07-21 12:26:15 +02:00
aws_security_hub_alerts.yml
updated stories
2021-07-21 12:26:15 +02:00
aws_user_monitoring.yml
updated stories
2021-07-21 12:26:15 +02:00
azorult.yml
converted ssa detections to ocsf
2023-02-28 12:00:16 +01:00
azure_active_directory_account_takeover.yml
formatting
2022-11-02 10:39:05 -07:00
azure_active_directory_persistence.yml
adding new detection. fixing types. adding line to lookup
2022-09-02 18:03:14 -04:00
azure_active_directory_privilege_escalation.yml
Update azure_active_directory_privilege_escalation.yml
2023-05-15 14:38:58 -04:00
baron_samedit_cve_2021_3156.yml
updated stories
2021-07-21 12:26:15 +02:00
bishopfox_sliver_adversary_emulation_framework.yml
fixes
2023-02-24 12:24:55 -07:00
bits_jobs.yml
Refactored security content
2022-03-09 14:43:09 +01:00
blackbyte_ransomware.yml
Rename ransomware_blackbyte.yml to blackbyte_ransomware.yml
2023-07-11 14:56:00 -05:00
blacklotus_campaign.yml
HVCI Disable and story
2023-04-14 10:32:12 -06:00
brand_monitoring.yml
updated stories
2021-07-21 12:26:15 +02:00
brute_ratel_c4.yml
name changes
2022-09-14 11:31:40 -05:00
caddywiper.yml
fixeddescription
2022-03-25 18:33:41 -07:00
cisa_aa22_257a.yml
CISA AA22-257A tag
2022-09-15 10:07:38 -06:00
cisa_aa22_264a.yml
Update cisa_aa22_264a.yml
2022-09-26 14:30:26 -06:00
cisa_aa22_277a.yml
Updates + new
2022-10-05 10:20:07 -06:00
cisa_aa22_320a.yml
CISA AA22-320A
2022-11-16 12:10:42 -07:00
cisco_ios_xe_software_web_management_user_interface_vulnerability.yml
Update cisco_ios_xe_software_web_management_user_interface_vulnerability.yml
2023-10-17 11:17:03 -06:00
citrix_netscaler_adc_and_netscaler_gateway_cve_2023_4966.yml
Citrix Bleed
2023-10-26 18:06:47 +00:00
citrix_netscaler_adc_cve_2023_3519.yml
Add ref link to story and detection.
2023-07-21 15:13:31 -07:00
citrix_sharefile_rce_cve_2023_24489.yml
Update citrix_sharefile_rce_cve_2023_24489.yml
2023-07-26 12:49:55 -06:00
cloud_cryptomining.yml
updated stories
2021-07-21 12:26:15 +02:00
cloud_federated_credential_abuse.yml
Refactored security content
2022-03-09 14:43:09 +01:00
cobalt_strike.yml
Refactored security content
2022-03-09 14:43:09 +01:00
coldroot_macos_rat.yml
updated stories
2021-07-21 12:26:15 +02:00
collection_and_staging.yml
updated stories
2021-07-21 12:26:15 +02:00
command_and_control.yml
converted ssa detections to ocsf
2023-02-28 12:00:16 +01:00
compromised_user_account.yml
Update compromised_user_account.yml
2023-02-06 15:48:16 -08:00
credential_dumping.yml
updated stories
2021-07-21 12:26:15 +02:00
cve_2022_40684_fortinet_appliance_auth_bypass.yml
reference
2022-10-17 07:51:14 -06:00
cve_2023_21716_word_rtf_heap_corruption.yml
Haag is Back 🎆
2023-03-10 06:21:30 -07:00
cve_2023_22515_privilege_escalation_vulnerability_confluence_data_center_and_server.yml
fix back slack
2023-10-18 12:58:55 -07:00
cve_2023_23397_outlook_elevation_of_privilege.yml
rename story
2023-03-21 15:52:17 -05:00
cve_2023_36884_office_and_windows_html_rce_vulnerability.yml
remove hyphen
2023-07-11 13:51:42 -06:00
cyclops_blink.yml
converted ssa detections to ocsf
2023-02-28 12:00:16 +01:00
darkcrystal_rat.yml
dcrat-analytics
2022-07-26 12:02:35 +02:00
data_destruction.yml
Update data_destruction.yml
2023-04-17 16:23:21 -07:00
data_exfiltration.yml
Update data_exfiltration.yml
2023-05-25 16:17:47 -07:00
data_protection.yml
updated stories
2021-07-21 12:26:15 +02:00
deobfuscate_decode_files_or_information.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_zerologon_attack.yml
updated stories
2021-07-21 12:26:15 +02:00
dev_sec_ops.yml
Refactored security content
2022-03-09 14:43:09 +01:00
dhs_report_ta18_074a.yml
updated stories
2021-07-21 12:26:15 +02:00
disabling_security_tools.yml
Updating expired References in Stories
2022-07-18 16:53:04 -07:00
dns_amplification_attacks.yml
Refactored security content
2022-03-09 14:43:09 +01:00
dns_hijacking.yml
updated stories
2021-07-21 12:26:15 +02:00
domain_controller_impersonation_&_samaccountname_spoofing.yml
Refactored security content
2022-03-09 14:43:09 +01:00
domain_trust_discovery.yml
Refactored security content
2022-03-09 14:43:09 +01:00
doublezerodestructor.yml
fixeddz
2022-03-25 19:38:51 -07:00
dynamic_dns.yml
updated stories
2021-07-21 12:26:15 +02:00
emotet_malware__dhs_report_ta18_201a_.yml
updated stories
2021-07-21 12:26:15 +02:00
f5_big_ip_vulnerability_cve_2022_1388.yml
F5 BIG-IP
2022-05-10 07:20:46 -06:00
f5_tmui_rce_cve_2020_5902.yml
updated stories
2021-07-21 12:26:15 +02:00
fin7.yml
Refactored security content
2022-03-09 14:43:09 +01:00
flax_typhoon.yml
Flax Typhoon
2023-08-25 09:30:30 -06:00
forest_blizzard.yml
The Haagless Horseman
2023-09-11 11:20:03 -06:00
fortinet_fortinac_cve_2022_39952.yml
Update fortinet_fortinac_cve_2022_39952.yml
2023-02-22 12:27:53 -07:00
gcp_account_takeover.yml
references
2022-11-02 10:40:40 -07:00
gcp_cross_account_activity.yml
updated stories
2021-07-21 12:26:15 +02:00
graceful_wipe_out_attack.yml
Update graceful_wipe_out_attack.yml
2023-06-13 16:36:53 +02:00
hafnium_group.yml
Refactored security content
2022-03-09 14:43:09 +01:00
hermeticwiper.yml
fixeddatadestructiontagnewstories
2022-03-25 13:35:13 -07:00
hidden_cobra_malware.yml
Updating expired References in Stories
2022-07-18 16:53:04 -07:00
Icedid.yml
Refactored security content
2022-03-09 14:43:09 +01:00
iis_components.yml
minor
2023-01-10 14:20:46 -08:00
industroyer2.yml
industroyer2
2022-04-25 09:36:55 +02:00
information_sabotage.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ingress_tool_transfer.yml
converted ssa detections to ocsf
2023-02-28 12:00:16 +01:00
insider_threat.yml
Removing nicer formatting
2022-05-20 16:24:56 -05:00
ivanti_epmm_remote_unauthenticated_access.yml
Ivanti CVE-2023-35082
2023-08-08 10:23:50 -06:00
ivanti_sentry_authentication_bypass_cve_2023_38035.yml
Ivanti Sentry
2023-08-24 09:08:24 -06:00
jboss_vulnerability.yml
updated stories
2021-07-21 12:26:15 +02:00
jetbrains_teamcity_unauthenticated_rce.yml
JetBrains TeamCity RCE
2023-10-01 10:59:09 -06:00
juniper_junos_remote_code_execution.yml
typo
2023-08-29 08:25:58 -06:00
kubernetes_scanning_activity.yml
updated stories
2021-07-21 12:26:15 +02:00
kubernetes_sensitive_object_access_activity.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_living_off_the_land.yml
Analytic Stories + Tagging
2022-07-27 10:29:47 -06:00
linux_persistence_techniques.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_post_exploitation.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_privilege_escalation.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_rootkit.yml
Analytic Stories + Tagging
2022-07-27 10:29:47 -06:00
living_off_the_land.yml
Capitalization is important
2022-03-28 09:55:37 -05:00
local_privilege_escalation_with_krbrelayup.yml
updating analytics story narrative
2022-04-28 18:46:05 -04:00
log4shell_cve_2021_44228.yml
Refactored security content
2022-03-09 14:43:09 +01:00
malicious_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
masquerading___rename_system_utilities.yml
Refactored security content
2022-03-09 14:43:09 +01:00
metasploit.yml
metasploit
2022-11-29 16:22:40 -06:00
meterpreter.yml
Refactored security content
2022-03-09 14:43:09 +01:00
microsoft_mshtml_remote_code_execution_cve_2021_40444.yml
Refactored security content
2022-03-09 14:43:09 +01:00
microsoft_sharepoint_server_elevation_of_privilege_cve_2023_29357.yml
new PR with correct yamls
2023-10-13 11:26:26 -07:00
microsoft_support_diagnostic_tool_vulnerability_cve_2022_30190.yml
Complete Follina
2022-05-31 07:16:05 -06:00
monitor_for_updates.yml
updated stories
2021-07-21 12:26:15 +02:00
moveit_transfer_critical_vulnerability.yml
Update moveit_transfer_critical_vulnerability.yml
2023-07-11 09:46:03 -06:00
netsh_abuse.yml
Added caching of the results of link-verification to the --cached_and_offline argument. This means that if a link returns successfully and you run the tool again, the link won't be checked again. However, this means that if that cache sticks around for a long time, the link may actually stop returning but we won't continue checking it. Still, this makes it significantly easier to quickly find broken links, fix the broken links, and then run the tool again in a short period of time, only re-checking the broken links that have been fixed. This makes repairing and checking broken links a must faster workflow.
2022-05-10 17:08:24 -07:00
network_discovery.yml
linux_lolbin_stage1
2022-02-14 10:17:46 +01:00
njrat.yml
updates
2023-10-04 15:22:26 -07:00
nobelium_group.yml
Refactored security content
2022-03-09 14:43:09 +01:00
office_365_detections.yml
updated stories
2021-07-21 12:26:15 +02:00
okta_mfa_exhaustion.yml
removing okta
2022-09-29 11:47:58 -06:00
openssl_cve_2022_3602.yml
updates
2022-11-11 14:24:58 -07:00
orangeworm_attack_group.yml
updated stories
2021-07-21 12:26:15 +02:00
papercut_mf_ng_vulnerability.yml
appinspect error
2023-05-16 12:25:20 -07:00
petitpotam_ntlm_relay_on_active_directory_certificate_services.yml
Refactored security content
2022-03-09 14:43:09 +01:00
possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.yml
updated stories
2021-07-21 12:26:15 +02:00
printnightmare_cve_2021_34527.yml
Refactored security content
2022-03-09 14:43:09 +01:00
prohibited_traffic_allowed_or_protocol_mismatch.yml
updated stories
2021-07-21 12:26:15 +02:00
proxynotshell.yml
Fantastic IIS Modules and Where to Find Them
2022-12-21 08:53:03 -07:00
proxyshell.yml
Fantastic IIS Modules and Where to Find Them
2022-12-21 08:53:03 -07:00
qakbot.yml
Update qakbot.yml
2022-11-14 09:39:31 -07:00
ransomware_blackmatter.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ransomware_chaos.yml
lockbit-chaos-ransomware
2023-01-16 10:10:28 +01:00
ransomware_clop.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ransomware_cloud.yml
updated stories
2021-07-21 12:26:15 +02:00
ransomware_darkside.yml
Updating link from Fireeye to Mandiant since links changed due to acquisition.
2022-07-19 10:06:50 -07:00
ransomware_lockbit.yml
lockbit-chaos-ransomware
2023-01-17 15:37:37 +01:00
ransomware_prestige.yml
prestige_ransomware
2022-11-30 11:07:20 +01:00
ransomware_revil.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ransomware_ryuk.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ransomware_samsam.yml
updated stories
2021-07-21 12:26:15 +02:00
ransomware.yml
Added caching of the results of link-verification to the --cached_and_offline argument. This means that if a link returns successfully and you run the tool again, the link won't be checked again. However, this means that if that cache sticks around for a long time, the link may actually stop returning but we won't continue checking it. Still, this makes it significantly easier to quickly find broken links, fix the broken links, and then run the tool again in a short period of time, only re-checking the broken links that have been fixed. This makes repairing and checking broken links a must faster workflow.
2022-05-10 17:08:24 -07:00
redline.yml
do_not_step_on_the_redline
2023-04-25 16:47:38 +02:00
remcos.yml
Refactored security content
2022-03-09 14:43:09 +01:00
reverse_network_proxy.yml
Reverse Network Proxy
2022-11-16 12:39:48 -07:00
router_and_infrastructure_security.yml
Added caching of the results of link-verification to the --cached_and_offline argument. This means that if a link returns successfully and you run the tool again, the link won't be checked again. However, this means that if that cache sticks around for a long time, the link may actually stop returning but we won't continue checking it. Still, this makes it significantly easier to quickly find broken links, fix the broken links, and then run the tool again in a short period of time, only re-checking the broken links that have been fixed. This makes repairing and checking broken links a must faster workflow.
2022-05-10 17:08:24 -07:00
sandworm_tools.yml
Update sandworm_tools.yml
2023-04-13 12:15:47 -06:00
scheduled_tasks.yml
new_line_backslash
2023-06-22 16:14:18 -07:00
signed_binary_proxy_execution_installutil.yml
Refactored security content
2022-03-09 14:43:09 +01:00
silver_sparrow.yml
Refactored security content
2022-03-09 14:43:09 +01:00
snake_malware.yml
Guardians of the Haag: A Cosmic Adventure
2023-05-11 13:34:18 -06:00
sneaky_active_directory_persistence_tricks.yml
update story description
2023-02-15 14:52:31 -05:00
spearphishing_attachments.yml
updated stories
2021-07-21 12:26:15 +02:00
splunk_vulnerabilities.yml
Updated story
2022-05-02 10:25:04 -05:00
spring4shell_cve_2022_22965.yml
function and CVE-2022-22965 fixes
2022-04-05 15:36:38 -06:00
sql_injection.yml
updated stories
2021-07-21 12:26:15 +02:00
subvert_trust_controls_sip_and_trust_provider_hijacking.yml
Sip Happens: Stirring Up the Crypto with a New Module
2023-10-10 14:13:09 -06:00
suspicious_aws_login_activities.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_aws_s3_activities.yml
updates and new searches
2023-04-28 15:16:46 -07:00
suspicious_aws_traffic.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_cloud_authentication_activities.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_cloud_instance_activities.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_cloud_provisioning_activities.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_cloud_user_activities.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_command_line_executions.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_compiled_html_activity.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_dns_traffic.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_emails.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_gcp_storage_activities.yml
Added caching of the results of link-verification to the --cached_and_offline argument. This means that if a link returns successfully and you run the tool again, the link won't be checked again. However, this means that if that cache sticks around for a long time, the link may actually stop returning but we won't continue checking it. Still, this makes it significantly easier to quickly find broken links, fix the broken links, and then run the tool again in a short period of time, only re-checking the broken links that have been fixed. This makes repairing and checking broken links a must faster workflow.
2022-05-10 17:08:24 -07:00
suspicious_mshta_activity.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_okta_activity.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_regsvcs_regasm_activity.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_regsvr32_activity.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_rundll32_activity.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_windows_registry_activities.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_wmi_use.yml
Added caching of the results of link-verification to the --cached_and_offline argument. This means that if a link returns successfully and you run the tool again, the link won't be checked again. However, this means that if that cache sticks around for a long time, the link may actually stop returning but we won't continue checking it. Still, this makes it significantly easier to quickly find broken links, fix the broken links, and then run the tool again in a short period of time, only re-checking the broken links that have been fixed. This makes repairing and checking broken links a must faster workflow.
2022-05-10 17:08:24 -07:00
suspicious_zoom_child_processes.yml
updated stories
2021-07-21 12:26:15 +02:00
swiftslicer.yml
swiftslicer
2023-02-03 09:47:51 +01:00
text4shell_cve_2022_42889.yml
text4theshells
2022-10-26 14:43:37 -06:00
trickbot.yml
Refactored security content
2022-03-09 14:43:09 +01:00
trusted_developer_utilities_proxy_execution_msbuild.yml
Refactored security content
2022-03-09 14:43:09 +01:00
trusted_developer_utilities_proxy_execution.yml
updated stories
2021-07-21 12:26:15 +02:00
unusual_processes.yml
Added caching of the results of link-verification to the --cached_and_offline argument. This means that if a link returns successfully and you run the tool again, the link won't be checked again. However, this means that if that cache sticks around for a long time, the link may actually stop returning but we won't continue checking it. Still, this makes it significantly easier to quickly find broken links, fix the broken links, and then run the tool again in a short period of time, only re-checking the broken links that have been fixed. This makes repairing and checking broken links a must faster workflow.
2022-05-10 17:08:24 -07:00
use_of_cleartext_protocols.yml
updated stories
2021-07-21 12:26:15 +02:00
vmware_aria_operations_vrealize_cve_2023_20887.yml
Update vmware_aria_operations_vrealize_cve_2023_20887.yml
2023-06-21 13:34:39 -07:00
vmware_server_side_injection_and_privilege_escalation.yml
Updated one broken reference link.
2022-06-23 15:02:26 -07:00
volt_typhoon.yml
Update volt_typhoon.yml
2023-05-25 18:01:02 -07:00
warzone_rat.yml
minor_fix_warzone
2023-08-29 09:32:10 +02:00
whispergate.yml
fixeddatadestructiontagnewstories
2022-03-25 13:35:13 -07:00
windows_bootkits.yml
Guardians of the Haag: A Cosmic Adventure
2023-05-11 13:34:18 -06:00
windows_certificate_services.yml
Cert services and MOAR
2023-02-03 06:58:50 -07:00
windows_defense_evasion_tactics.yml
updated stories
2021-07-21 12:26:15 +02:00
windows_discovery_techniques.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_dns_sigred_cve_2020_1350.yml
updated stories
2021-07-21 12:26:15 +02:00
windows_drivers.yml
Update windows_drivers.yml
2022-05-31 07:43:57 -06:00
windows_error_reporting_service_elevation_of_privilege_vulnerability.yml
Update windows_error_reporting_service_elevation_of_privilege_vulnerability.yml
2023-08-28 13:01:22 -06:00
windows_file_extension_and_association_abuse.yml
updated stories
2021-07-21 12:26:15 +02:00
windows_log_manipulation.yml
updated stories
2021-07-21 12:26:15 +02:00
windows_persistence_techniques.yml
updated stories
2021-07-21 12:26:15 +02:00
windows_post_exploitation.yml
prestige_winpeas2
2022-12-06 09:49:29 +01:00
windows_privilege_escalation.yml
updated stories
2021-07-21 12:26:15 +02:00
windows_registry_abuse.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
windows_service_abuse.yml
updated stories
2021-07-21 12:26:15 +02:00
windows_system_binary_proxy_execution_msiexec.yml
T1218.007 - MSIExec
2022-06-17 09:36:34 -06:00
winrar_spoofing_attack_cve_2023_38831.yml
typoe
2023-08-29 13:45:19 -06:00
winter_vivern.yml
update
2023-04-13 11:10:02 -06:00
ws_ftp_server_critical_vulnerabilities.yml
fixes
2023-10-01 09:42:31 -06:00
xmrig.yml
converted ssa detections to ocsf
2023-02-28 12:00:16 +01:00