splunk-security_content

cisco_ai_defense_security_alerts_by_application_name.yml

add back manual_test

2025-03-27 14:01:20 -07:00

cisco_secure_application_alerts.yml

manual test

2025-02-20 08:52:07 -08:00

crushftp_server_side_template_injection.yml

updating version

2025-01-21 14:34:51 -08:00

detect_distributed_password_spray_attempts.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

detect_new_login_attempts_to_routers.yml

updating version

2025-01-21 14:34:51 -08:00

detect_password_spray_attempts.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

email_attachments_with_lots_of_spaces.yml

notable to finding 2

2025-01-24 17:03:47 -08:00

email_files_written_outside_of_the_outlook_directory.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

email_servers_sending_high_volume_traffic_to_hosts.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

ivanti_vtm_new_account_creation.yml

updating version

2025-01-21 14:34:51 -08:00

monitor_email_for_brand_abuse.yml

updating version

2025-01-21 14:34:51 -08:00

no_windows_updates_in_a_time_frame.yml

updating version

2025-01-21 14:34:51 -08:00

okta_authentication_failed_during_mfa_challenge.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

okta_idp_lifecycle_modifications.yml

updating version

2025-01-21 14:34:51 -08:00

okta_mfa_exhaustion_hunt.yml

updating version

2025-01-21 14:34:51 -08:00

okta_mismatch_between_source_and_response_for_verify_push_request.yml

all but one fixes

2025-01-23 09:56:40 -08:00

okta_multi_factor_authentication_disabled.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

okta_multiple_accounts_locked_out.yml

updating version

2025-01-21 14:34:51 -08:00

okta_multiple_failed_mfa_requests_for_user.yml

updating version

2025-01-21 14:34:51 -08:00

okta_multiple_failed_requests_to_access_applications.yml

updating version

2025-01-21 14:34:51 -08:00

okta_multiple_users_failing_to_authenticate_from_ip.yml

updating version

2025-01-21 14:34:51 -08:00

okta_new_api_token_created.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

okta_new_device_enrolled_on_account.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

okta_phishing_detection_with_fastpass_origin_check.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

okta_risk_threshold_exceeded.yml

notable to finding 2

2025-01-24 17:03:47 -08:00

okta_successful_single_factor_authentication.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

okta_suspicious_activity_reported.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

okta_suspicious_use_of_a_session_cookie.yml

updating version

2025-01-21 14:34:51 -08:00

okta_threatinsight_threat_detected.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

okta_unauthorized_access_to_application.yml

updating version

2025-01-21 14:34:51 -08:00

okta_user_logins_from_multiple_cities.yml

updating version

2025-01-21 14:34:51 -08:00

pingid_mismatch_auth_source_and_verification_response.yml

updating versions

2025-02-05 10:49:03 -08:00

pingid_multiple_failed_mfa_requests_for_user.yml

updating version

2025-01-21 14:34:51 -08:00

pingid_new_mfa_method_after_credential_reset.yml

updating version

2025-01-21 14:34:51 -08:00

pingid_new_mfa_method_registered_for_user.yml

updating version

2025-01-21 14:34:51 -08:00

suspicious_email_attachment_extensions.yml

Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.

2025-02-10 12:28:22 -08:00

suspicious_java_classes.yml

updating version

2025-01-21 14:34:51 -08:00

web_servers_executing_suspicious_processes.yml

updating version

2025-01-21 14:34:51 -08:00

windows_ad_add_self_to_group.yml

medusa_ransomware

2025-03-14 11:29:56 +01:00

windows_ad_dangerous_deny_acl_modification.yml

Fix some typos in the data_source fields. Many detections were referencing data sources that ACTUALLY exist, but by the wrong name.

2025-02-17 12:11:35 -08:00

windows_ad_dangerous_group_acl_modification.yml

Fix some typos in the data_source fields. Many detections were referencing data sources that ACTUALLY exist, but by the wrong name.

2025-02-17 12:11:35 -08:00

windows_ad_dangerous_user_acl_modification.yml

Fix some typos in the data_source fields. Many detections were referencing data sources that ACTUALLY exist, but by the wrong name.

2025-02-17 12:11:35 -08:00

windows_ad_dcshadow_privileges_acl_addition.yml

bump versions and dates on modified detections

2025-02-17 15:46:23 -08:00

windows_ad_domain_root_acl_deletion.yml

Fix some typos in the data_source fields. Many detections were referencing data sources that ACTUALLY exist, but by the wrong name.

2025-02-17 12:11:35 -08:00

windows_ad_domain_root_acl_modification.yml

Fix some typos in the data_source fields. Many detections were referencing data sources that ACTUALLY exist, but by the wrong name.

2025-02-17 12:11:35 -08:00

windows_ad_gpo_deleted.yml

bump versions and dates on modified detections

2025-02-17 15:46:23 -08:00

windows_ad_gpo_disabled.yml

bump versions and dates on modified detections

2025-02-17 15:46:23 -08:00

windows_ad_gpo_new_cse_addition.yml

Fix some typos in the data_source fields. Many detections were referencing data sources that ACTUALLY exist, but by the wrong name.

2025-02-17 12:11:35 -08:00

windows_ad_hidden_ou_creation.yml

Fix some typos in the data_source fields. Many detections were referencing data sources that ACTUALLY exist, but by the wrong name.

2025-02-17 12:11:35 -08:00

windows_ad_object_owner_updated.yml

Fix some typos in the data_source fields. Many detections were referencing data sources that ACTUALLY exist, but by the wrong name.

2025-02-17 12:11:35 -08:00

windows_ad_privileged_group_modification.yml

updating version

2025-01-21 14:34:51 -08:00

windows_ad_self_dacl_assignment.yml

bump versions and dates on modified detections

2025-02-17 15:46:23 -08:00

windows_ad_suspicious_attribute_modification.yml

Fix some typos in the data_source fields. Many detections were referencing data sources that ACTUALLY exist, but by the wrong name.

2025-02-17 12:11:35 -08:00

windows_ad_suspicious_gpo_modification.yml

Fix some typos in the data_source fields. Many detections were referencing data sources that ACTUALLY exist, but by the wrong name.

2025-02-17 12:11:35 -08:00

windows_increase_in_group_or_object_modification_activity.yml

updating version

2025-01-21 14:34:51 -08:00

windows_increase_in_user_modification_activity.yml

updating version

2025-01-21 14:34:51 -08:00