admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
9be8315fdca24a6cfedff979f163ea4e690d7521
splunk-security_content/detections/deprecated
T
History
divious1 e666dd1998 moved back to endpoint
2021-03-05 11:49:49 -05:00
..
.gitkeep
detection tests
2020-11-03 17:04:53 +01:00
abnormally_high_aws_instances_launched_by_user___mltk.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
abnormally_high_aws_instances_launched_by_user.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
abnormally_high_aws_instances_terminated_by_user___mltk.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
abnormally_high_aws_instances_terminated_by_user.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
aws_cloud_provisioning_from_previously_unseen_city.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
aws_cloud_provisioning_from_previously_unseen_country.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
aws_cloud_provisioning_from_previously_unseen_ip_address.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
aws_cloud_provisioning_from_previously_unseen_region.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
clients_connecting_to_multiple_dns_servers.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
cloud_network_access_control_list_deleted.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
detect_api_activity_from_users_without_mfa.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
detect_aws_api_activities_from_unapproved_accounts.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
detect_long_dns_txt_record_response.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
detect_mimikatz_via_powershell_and_eventcode_4703.yml
updated analytics story tag
2021-02-12 12:32:25 -05:00
detect_new_api_calls_from_user_roles.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
detect_new_user_aws_console_login.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
detect_spike_in_aws_api_activity.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
detect_spike_in_network_acl_activity.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
detect_spike_in_security_group_activity.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
detect_usb_device_insertion.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
detect_web_traffic_to_dynamic_domain_providers.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
detection_of_dns_tunnels.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
dns_query_requests_resolved_by_unauthorized_dns_servers.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
ec2_instance_modified_with_previously_unseen_user.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
ec2_instance_started_in_previously_unseen_region.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
ec2_instance_started_with_previously_unseen_ami.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
ec2_instance_started_with_previously_unseen_instance_type.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
ec2_instance_started_with_previously_unseen_user.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
execution_of_file_with_spaces_before_extension.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
extended_period_without_successful_netbackup_backups.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
first_time_seen_command_line_argument.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
gcp_gcr_container_uploaded.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
identify_new_user_accounts.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
malicious_powershell_process___multiple_suspicious_command_line_arguments.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
monitor_dns_for_brand_abuse.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
open_redirect_in_splunk_web.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
osquery_pack___coldroot_detection.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
processes_created_by_netsh.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
prohibited_software_on_endpoint.yml
fixing merge conflicts
2021-02-12 12:27:00 -05:00
reg_exe_used_to_hide_files_directories_via_registry_keys.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
remote_registry_key_modifications.yml
fixing merge conflicts
2021-02-12 12:27:00 -05:00
remote_wmi_command_attempt.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
scheduled_tasks_used_in_badrabbit_ransomware.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
splunk_enterprise_information_disclosure.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
suspicious_changes_to_file_associations.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
suspicious_file_write.yml
fixing merge conflicts
2021-02-12 12:27:00 -05:00
suspicious_writes_to_system_volume_information.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
uncommon_processes_on_endpoint.yml
moved back to endpoint
2021-03-05 11:49:49 -05:00
unsigned_image_loaded_by_lsass.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
unsuccessful_netbackup_backups.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
windows_connhost_exe_force_flag.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
windows_hosts_file_modification.yml
fixing merge conflicts
2021-02-12 12:27:00 -05:00