admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
9be8315fdca24a6cfedff979f163ea4e690d7521
splunk-security_content/detections/endpoint
T
History
github-actions[bot] a9338fea28 Branch was auto-updated.
2021-03-09 00:24:22 +00:00
..
access_lsass_memory_for_dump_creation.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
any_powershell_downloadfile.yml
updating docs and package bits [ci skip]
2021-03-04 20:11:07 +00:00
any_powershell_downloadstring.yml
updating docs and package bits [ci skip]
2021-03-04 20:11:07 +00:00
attempt_to_add_certificate_to_untrusted_store.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
HAFNIUM and more updates
2021-03-03 14:10:11 -07:00
attempt_to_stop_security_service.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
attempted_credential_dump_from_registry_via_reg_exe.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
batch_file_write_to_system32.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
bcdedit_failure_recovery_modification.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
certutil_exe_certificate_extraction.yml
updating docs and package bits [ci skip]
2021-02-18 18:22:48 +00:00
cobalt_strike_named_pipes.yml
updating docs and package bits [ci skip]
2021-03-04 20:11:07 +00:00
common_ransomware_extensions.yml
Fixed misspelling in ransomware
2021-03-02 13:31:55 -05:00
common_ransomware_notes.yml
fixing merge conflicts
2021-02-12 12:27:00 -05:00
create_local_admin_accounts_using_net_exe.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
create_or_delete_windows_shares_using_net_exe.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
create_remote_thread_into_lsass.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
creation_of_lsass_dump_with_taskmgr.yml
updating docs and package bits [ci skip]
2021-02-18 18:22:48 +00:00
creation_of_shadow_copy_with_wmic_and_powershell.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
creation_of_shadow_copy.yml
updating docs and package bits [ci skip]
2021-02-18 18:22:48 +00:00
credential_dumping_via_copy_command_from_shadow_copy.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
credential_dumping_via_symlink_to_shadow_copy.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
deleting_shadow_copies.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
detect_activity_related_to_pass_the_hash_attacks.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
detect_computer_changed_with_anonymous_account.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
detect_credential_dumping_through_lsass_access.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
detect_excessive_account_lockouts_from_endpoint.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
detect_excessive_user_account_lockouts.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
detect_html_help_renamed.yml
updating docs and package bits [ci skip]
2021-02-18 18:22:48 +00:00
detect_html_help_spawn_child_process.yml
updating docs and package bits [ci skip]
2021-02-18 18:22:48 +00:00
detect_html_help_url_in_command_line.yml
updating docs and package bits [ci skip]
2021-02-18 18:22:48 +00:00
detect_html_help_using_infotech_storage_handlers.yml
updating docs and package bits [ci skip]
2021-02-18 18:22:48 +00:00
detect_mimikatz_using_loaded_images.yml
Added detection testing service results inDetect Mimikatz Using Loaded Images
2021-03-05 20:31:06 +00:00
detect_mshta_inline_hta_execution.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
detect_mshta_renamed.yml
Added detection testing service results inDetect mshta Rename
2021-03-08 23:47:23 +00:00
detect_mshta_url_in_command_line.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
detect_new_local_admin_account.yml
HAFNIUM and more updates
2021-03-03 14:10:11 -07:00
detect_path_interception_by_creation_of_program_exe.yml
Added detection testing service results inDetect Path Interception By Creation Of program exe
2021-02-17 19:12:43 +00:00
detect_processes_used_for_system_network_configuration_discovery.yml
fixing merge conflicts
2021-02-12 12:27:00 -05:00
detect_prohibited_applications_spawning_cmd_exe.yml
Sunburst malware renamed NOBELIUM Group
2021-03-05 10:30:34 -07:00
detect_psexec_with_accepteula_flag.yml
HAFNIUM and more updates
2021-03-03 14:10:11 -07:00
detect_rare_executables.yml
Merge branch 'develop' into TR-377_add_datamodel_field
2021-02-12 12:04:21 -05:00
detect_regasm_spawning_a_process.yml
updating docs and package bits [ci skip]
2021-02-18 18:22:48 +00:00
detect_regasm_with_network_connection.yml
updating docs and package bits [ci skip]
2021-02-18 18:22:48 +00:00
detect_regasm_with_no_command_line_arguments.yml
updating docs and package bits [ci skip]
2021-02-18 18:22:48 +00:00
detect_regsvcs_spawning_a_process.yml
updating docs and package bits [ci skip]
2021-02-18 18:22:48 +00:00
detect_regsvcs_with_network_connection.yml
updating docs and package bits [ci skip]
2021-02-18 18:22:48 +00:00
detect_regsvcs_with_no_command_line_arguments.yml
updating docs and package bits [ci skip]
2021-02-18 18:22:48 +00:00
detect_regsvr32_application_control_bypass.yml
Cobalt Strike Profile adds and updates
2021-02-22 16:09:19 -07:00
detect_rundll32_application_control_bypass___advpack.yml
updating docs and package bits [ci skip]
2021-02-18 18:22:48 +00:00
detect_rundll32_application_control_bypass___setupapi.yml
updating docs and package bits [ci skip]
2021-02-18 18:22:48 +00:00
detect_rundll32_application_control_bypass___syssetup.yml
updating docs and package bits [ci skip]
2021-02-18 18:22:48 +00:00
detect_rundll32_inline_hta_execution.yml
Detect Mimikatz Using Loaded Images
2021-03-05 13:10:59 -07:00
detect_use_of_cmd_exe_to_launch_script_interpreters.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
disabling_remote_user_account_control.yml
fixing merge conflicts
2021-02-12 12:27:00 -05:00
dump_lsass_via_comsvcs_dll.yml
HAFNIUM and more updates
2021-03-03 14:10:11 -07:00
dump_lsass_via_procdump_rename.yml
HAFNIUM and more updates
2021-03-03 14:10:11 -07:00
dump_lsass_via_procdump.yml
updating docs and package bits [ci skip]
2021-03-04 20:11:07 +00:00
eventvwr_uac_bypass.yml
updating docs and package bits [ci skip]
2021-03-04 20:11:07 +00:00
execution_of_file_with_multiple_extensions.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
file_with_samsam_extension.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
first_time_seen_child_process_of_zoom.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
fodhelper_uac_bypass.yml
updating docs and package bits [ci skip]
2021-03-04 20:11:07 +00:00
hiding_files_and_directories_with_attrib_exe.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
kerberoasting_spn_request_with_rc4_encryption.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
malicious_powershell_process___connect_to_internet_with_hidden_window.yml
HAFNIUM and more updates
2021-03-03 14:10:11 -07:00
malicious_powershell_process___encoded_command.yml
Sunburst malware renamed NOBELIUM Group
2021-03-05 10:30:34 -07:00
malicious_powershell_process___execution_policy_bypass.yml
HAFNIUM and more updates
2021-03-03 14:10:11 -07:00
malicious_powershell_process_with_obfuscation_techniques.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
monitor_registry_keys_for_print_monitors.yml
fixing merge conflicts
2021-02-12 12:27:00 -05:00
nishang_powershelltcponeline.yml
updating docs and package bits [ci skip]
2021-03-04 20:11:07 +00:00
nltest_domain_trust_discovery.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
ntdsutil_export_ntds.yml
HAFNIUM and more updates
2021-03-03 14:10:11 -07:00
overwriting_accessibility_binaries.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
process_creating_lnk_file_in_suspicious_location.yml
updating docs and package bits [ci skip]
2021-02-18 18:22:48 +00:00
process_execution_via_wmi.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
processes_launching_netsh.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
reg_exe_manipulating_windows_services_registry_keys.yml
fixing merge conflicts
2021-02-12 12:27:00 -05:00
registry_keys_for_creating_shim_databases.yml
fixing merge conflicts
2021-02-12 12:27:00 -05:00
registry_keys_used_for_persistence.yml
fixing merge conflicts
2021-02-12 12:27:00 -05:00
registry_keys_used_for_privilege_escalation.yml
fixing merge conflicts
2021-02-12 12:27:00 -05:00
remote_process_instantiation_via_wmi.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
rundll_loading_dll_by_ordinal.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
ryuk_test_files_detected.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
ryuk_wake_on_lan_command.yml
Added detection testing service results inRyuk Wake on LAN Command
2021-03-04 21:29:56 +00:00
samsam_test_file_write.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
sc_exe_manipulating_windows_services.yml
Sunburst malware renamed NOBELIUM Group
2021-03-05 10:30:34 -07:00
scheduled_task_deleted_or_created_via_cmd.yml
Sunburst malware renamed NOBELIUM Group
2021-03-05 10:30:34 -07:00
schtasks_scheduling_job_on_remote_system.yml
Sunburst malware renamed NOBELIUM Group
2021-03-05 10:30:34 -07:00
schtasks_used_for_forcing_a_reboot.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
script_execution_via_wmi.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
shim_database_file_creation.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
shim_database_installation_with_suspicious_parameters.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
short_lived_windows_accounts.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
single_letter_process_on_endpoint.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
ssa___applying_stolen_credentials_via_mimikatz_modules.yml
Merge branch 'develop' of github.com:splunk/security_content into TR-382
2021-03-04 21:17:42 -05:00
ssa___applying_stolen_credentials_via_powersploit_modules.yml
Merge branch 'develop' of github.com:splunk/security_content into TR-382
2021-03-04 21:17:42 -05:00
ssa___assess_credential_strength_via_dsinternals_modules.yml
First pass of tagging
2021-03-04 21:17:38 -05:00
ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
removed - SSA from the end of the detection names
2021-02-22 12:32:30 -05:00
ssa___credential_extraction_dsinternals_conversion_modules.yml
Merge branch 'develop' of github.com:splunk/security_content into TR-382
2021-03-04 21:17:42 -05:00
ssa___credential_extraction_dsinternals_modules.yml
Merge branch 'develop' of github.com:splunk/security_content into TR-382
2021-03-04 21:17:42 -05:00
ssa___credential_extraction_fgdump_cachedump_s_option.yml
Merge branch 'develop' of github.com:splunk/security_content into TR-382
2021-03-04 21:17:42 -05:00
ssa___credential_extraction_fgdump_cachedump_v_option.yml
Merge branch 'develop' of github.com:splunk/security_content into TR-382
2021-03-04 21:17:42 -05:00
ssa___credential_extraction_getaddbaccount_from_dump.yml
Merge branch 'develop' of github.com:splunk/security_content into TR-382
2021-03-04 21:17:42 -05:00
ssa___credential_extraction_lazagne_command_options.yml
Merge branch 'develop' of github.com:splunk/security_content into TR-382
2021-03-04 21:17:42 -05:00
ssa___credential_extraction_mimikatz_modules.yml
Merge branch 'develop' of github.com:splunk/security_content into TR-382
2021-03-04 21:17:42 -05:00
ssa___credential_extraction_ms_debuggers_kernel_peek.yml
Merge branch 'develop' of github.com:splunk/security_content into TR-382
2021-03-04 21:17:42 -05:00
ssa___credential_extraction_ms_debuggers_z_option.yml
Merge branch 'develop' of github.com:splunk/security_content into TR-382
2021-03-04 21:17:42 -05:00
ssa___credential_extraction_powersploit_modules.yml
Merge branch 'develop' of github.com:splunk/security_content into TR-382
2021-03-04 21:17:42 -05:00
ssa___detect_dump_lsass_memory_using_comsvcs.yml
removed - SSA from the end of the detection names
2021-02-22 12:32:30 -05:00
ssa___detect_kerberoasting.yml
First pass of tagging
2021-03-04 21:17:38 -05:00
ssa___detect_pass_hash.yml
First pass of tagging
2021-03-04 21:17:38 -05:00
ssa___first_time_seen_cmd_line.yml
First pass of tagging
2021-03-04 21:17:38 -05:00
ssa___illegal_access_user_content_via_powersploit_modules.yml
Merge branch 'develop' of github.com:splunk/security_content into TR-382
2021-03-04 21:17:42 -05:00
ssa___illegal_account_creation_via_powersploit_modules.yml
Merge branch 'develop' of github.com:splunk/security_content into TR-382
2021-03-04 21:17:42 -05:00
ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
Tagging last story
2021-03-05 10:24:47 -05:00
ssa___illegal_log_deletion_via_mimikatz_modules.yml
Merge branch 'develop' of github.com:splunk/security_content into TR-382
2021-03-04 21:17:42 -05:00
ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
Merge branch 'develop' of github.com:splunk/security_content into TR-382
2021-03-04 21:17:42 -05:00
ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
Merge branch 'develop' of github.com:splunk/security_content into TR-382
2021-03-04 21:17:42 -05:00
ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
Merge branch 'develop' of github.com:splunk/security_content into TR-382
2021-03-04 21:17:42 -05:00
ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
Merge branch 'develop' of github.com:splunk/security_content into TR-382
2021-03-04 21:17:42 -05:00
ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
Merge branch 'develop' of github.com:splunk/security_content into TR-382
2021-03-04 21:17:42 -05:00
ssa___illegal_service_and_process_control_via_powersploit_modules.yml
Merge branch 'develop' of github.com:splunk/security_content into TR-382
2021-03-04 21:17:42 -05:00
ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
First pass of tagging
2021-03-04 21:17:38 -05:00
ssa___prohibited_apps_spawning_cmdprompt.yml
First pass of tagging
2021-03-04 21:17:38 -05:00
ssa___rare_parent_process_relationship_lolbas.yml
First pass of tagging
2021-03-04 21:17:38 -05:00
ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
Adding a new story (Windows Discovery Techniques) and tagging streaming detections with that story
2021-03-04 22:02:25 -05:00
ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
Adding a new story (Windows Discovery Techniques) and tagging streaming detections with that story
2021-03-04 22:02:25 -05:00
ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
Adding a new story (Windows Discovery Techniques) and tagging streaming detections with that story
2021-03-04 22:02:25 -05:00
ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
Adding a new story (Windows Discovery Techniques) and tagging streaming detections with that story
2021-03-04 22:02:25 -05:00
ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
Adding a new story (Windows Discovery Techniques) and tagging streaming detections with that story
2021-03-04 22:02:25 -05:00
ssa___recon_and_use_computers_via_mimikatz_modules.yml
Adding a new story (Windows Discovery Techniques) and tagging streaming detections with that story
2021-03-04 22:02:25 -05:00
ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
Adding a new story (Windows Discovery Techniques) and tagging streaming detections with that story
2021-03-04 22:02:25 -05:00
ssa___recon_and_use_shares_via_mimikatz_modules.yml
Adding a new story (Windows Discovery Techniques) and tagging streaming detections with that story
2021-03-04 22:02:25 -05:00
ssa___recon_and_use_shares_via_powersploit_modules.yml
Adding a new story (Windows Discovery Techniques) and tagging streaming detections with that story
2021-03-04 22:02:25 -05:00
ssa___recon_connectivity_via_powersploit_modules.yml
Adding a new story (Windows Discovery Techniques) and tagging streaming detections with that story
2021-03-04 22:02:25 -05:00
ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
Adding a new story (Windows Discovery Techniques) and tagging streaming detections with that story
2021-03-04 22:02:25 -05:00
ssa___recon_defensive_tools_via_powersploit_modules.yml
Adding a new story (Windows Discovery Techniques) and tagging streaming detections with that story
2021-03-04 22:02:25 -05:00
ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
Adding a new story (Windows Discovery Techniques) and tagging streaming detections with that story
2021-03-04 22:02:25 -05:00
ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
Adding a new story (Windows Discovery Techniques) and tagging streaming detections with that story
2021-03-04 22:02:25 -05:00
ssa___recon_processes_and_services_via_mimikatz_modules.yml
Adding a new story (Windows Discovery Techniques) and tagging streaming detections with that story
2021-03-04 22:02:25 -05:00
ssa___setting_credentials_via_dsinternals_modules.yml
Merge branch 'develop' of github.com:splunk/security_content into TR-382
2021-03-04 21:17:42 -05:00
ssa___setting_credentials_via_mimikatz_modules.yml
Merge branch 'develop' of github.com:splunk/security_content into TR-382
2021-03-04 21:17:42 -05:00
ssa___setting_credentials_via_powersploit_modules.yml
Merge branch 'develop' of github.com:splunk/security_content into TR-382
2021-03-04 21:17:42 -05:00
ssa___system_process_running_unexpected_location.yml
First pass of tagging
2021-03-04 21:17:38 -05:00
ssa___unusual_lolbas_in_short_period_of_time.yml
First pass of tagging
2021-03-04 21:17:38 -05:00
ssa___unusually_long_command_line.yml
First pass of tagging
2021-03-04 21:17:38 -05:00
suspicious_dllhost_no_command_line_arguments.yml
updating docs and package bits [ci skip]
2021-03-04 20:11:07 +00:00
suspicious_gpupdate_no_command_line_arguments.yml
updating docs and package bits [ci skip]
2021-03-04 20:11:07 +00:00
suspicious_microsoft_workflow_compiler_rename.yml
Cobalt Strike Profile adds and updates
2021-02-22 16:09:19 -07:00
suspicious_microsoft_workflow_compiler_usage.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
suspicious_msbuild_path.yml
Cobalt Strike Profile adds and updates
2021-02-22 16:09:19 -07:00
suspicious_msbuild_rename.yml
Cobalt Strike Profile adds and updates
2021-02-22 16:09:19 -07:00
suspicious_msbuild_spawn.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
suspicious_mshta_child_process.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
suspicious_mshta_spawn.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
suspicious_reg_exe_process.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
suspicious_regsvr32_register_suspicious_path.yml
updating docs and package bits [ci skip]
2021-02-18 18:22:48 +00:00
suspicious_rundll32_dllregisterserver.yml
updating docs and package bits [ci skip]
2021-02-18 18:22:48 +00:00
suspicious_rundll32_rename.yml
updating docs and package bits [ci skip]
2021-02-18 18:22:48 +00:00
suspicious_rundll32_startw.yml
updating docs and package bits [ci skip]
2021-02-18 18:22:48 +00:00
suspicious_rundll32_with_no_command_line_arguments.yml
gpupdate no cmdline arguments
2021-02-23 12:34:52 -07:00
suspicious_scheduled_task_from_public_directory.yml
updating docs and package bits [ci skip]
2021-03-04 20:11:07 +00:00
suspicious_searchprotocolhost_no_command_line_arguments.yml
updating docs and package bits [ci skip]
2021-03-04 20:11:07 +00:00
suspicious_wevtutil_usage.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
suspicious_writes_to_windows_recycle_bin.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
system_information_discovery_detection.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
system_processes_run_from_unexpected_locations.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
unload_sysmon_filter_driver.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
unusually_long_command_line___mltk.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
unusually_long_command_line.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
usn_journal_deletion.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
wbadmin_delete_system_backups.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
windows_adfind_exe.yml
Sunburst malware renamed NOBELIUM Group
2021-03-05 10:30:34 -07:00
windows_disableantispyware_reg.yml
updating docs and package bits [ci skip]
2021-03-04 20:11:07 +00:00
windows_event_log_cleared.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
windows_security_account_manager_stopped.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00
wmi_permanent_event_subscription___sysmon.yml
added datamodels as an array
2021-02-10 22:35:58 -05:00