admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
bbf79475337b14dab05ab0098061e2278aefde12
splunk-security_content/detections
T
History
carroyod 1ac3cc680b Update aws_cloud_provisioning_from_previously_unseen_ip.yml 
Removed iplocation and Country filter, we are lokking IPs here
2020-04-28 13:59:52 +02:00
..
abnormally_high_ec2_instances_launched.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
abnormally_high_instance_termination.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
access_lsass_memory_for_dump_creation.yml
Update access_lsass_memory_for_dump_creation.yml
2020-02-28 11:40:27 -07:00
account_harvesting.yml
Removed data sources from fraud searches that were not Splunk
2019-11-21 21:10:56 -06:00
acl_with_open_ports.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
activity_related_to_pass_the_hash.yml
WIP: testing lateral movement analytics story
2020-01-10 12:47:12 +01:00
add_to_untrust_cert_store.yml
fixing the files that didnt update the macros correctly
2019-12-11 15:39:14 -08:00
anomalous_webclick.yml
Removed data sources from fraud searches that were not Splunk
2019-11-21 21:10:56 -06:00
api_acitivity_from_previously_unseen_user_role.yml
introduced security_content_ctime as a macro, renamed all our searches to use this new macro, removing ES dependecy
2019-12-11 14:59:03 -05:00
attackers_scanning_for_vulnerable_jboss_servers.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
introduced mitre technique id to detection spec
2020-01-06 13:31:43 -05:00
attempted_credential_dump_from_registry_via_reg.yml
introduced mitre technique id to detection spec
2020-01-06 13:31:43 -05:00
attrib_to_hide_files.yml
version and date update
2020-03-16 12:56:56 -07:00
aws_activity_from_non_approved_accounts.yml
introduced security_content_ctime as a macro, renamed all our searches to use this new macro, removing ES dependecy
2019-12-11 14:59:03 -05:00
aws_activity_in_new_region.yml
fixing issue #343
2020-02-03 17:10:15 -05:00
aws_cloud_provisioning_from_previously_unseen_city.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
aws_cloud_provisioning_from_previously_unseen_country.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
aws_cloud_provisioning_from_previously_unseen_ip.yml
Update aws_cloud_provisioning_from_previously_unseen_ip.yml
2020-04-28 13:59:52 +02:00
aws_cloud_provisioning_from_previously_unseen_region.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
aws_cross_account_activity_from_new_account.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
aws_spike_acl_activity.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
badrabbit_schtasks.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
batch_file_write_system32.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
brand_abuse_dns.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
brand_abuse_email.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
brand_abuse_web.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
change_file_association.yml
version and date update
2020-03-16 12:56:56 -07:00
children_of_spoolsv.yml
version and date update
2020-03-16 12:56:56 -07:00
clients_connecting_to_multiple_dns_servers.yml
adding definitions
2020-01-23 13:31:43 -08:00
cloud_compute_activity_in_new_region.yml
fixing the files that didnt update the macros correctly
2019-12-11 15:39:14 -08:00
cloud_compute_instance_created_by_previously_unseen_user.yml
fixing the files that didnt update the macros correctly
2019-12-11 15:39:14 -08:00
cloud_compute_instance_created_with_previously_unseen_image_id.yml
fixing the files that didnt update the macros correctly
2019-12-11 15:39:14 -08:00
cloud_compute_instance_created_with_previously_unseen_instance_type.yml
fixing the files that didnt update the macros correctly
2019-12-11 15:39:14 -08:00
common_ransomware_extensions.yml
version and date update
2020-03-16 12:56:56 -07:00
common_ransomware_notes.yml
version and date update
2020-03-16 12:56:56 -07:00
container_implant_aws_detection.yml
removing KC
2020-03-03 15:09:57 -08:00
container_implant_gcp_detection.yml
removing KC
2020-03-03 15:09:57 -08:00
create_local_admin_via_net.yml
version and date update
2020-03-16 12:56:56 -07:00
create_or_delete_network_shares.yml
Create or delete windows shares using net.exe
2020-03-03 14:28:01 +05:30
create_remote_thread_into_lsass.yml
introduced mitre technique id to detection spec
2020-01-06 13:31:43 -05:00
creation_of_shadow_copy_with_wmic_and_powershell.yml
introduced mitre technique id to detection spec
2020-01-06 13:31:43 -05:00
creation_of_shadow_copy.yml
introduced mitre technique id to detection spec
2020-01-06 13:31:43 -05:00
cred_dump_via_copy_from_shadowcopy.yml
introduced mitre technique id to detection spec
2020-01-06 13:31:43 -05:00
cred_dump_via_symlink_shadowcopy.yml
introduced mitre technique id to detection spec
2020-01-06 13:31:43 -05:00
cscript_via_cmd.yml
updating version and mod_date
2020-03-16 13:20:02 -06:00
delete_shadow_copies.yml
update version to 2.1 instead of 3.0, as no search changes - just metadata
2020-04-17 12:10:11 -06:00
deletion_network_acl.yml
introduced security_content_ctime as a macro, renamed all our searches to use this new macro, removing ES dependecy
2019-12-11 14:59:03 -05:00
detect_credential_dumping_through_LSASS_access.yml
introduced mitre technique id to detection spec
2020-01-06 13:31:43 -05:00
detect_mimikatz_using_loaded_images.yml
introduced mitre technique id to detection spec
2020-01-06 13:31:43 -05:00
disable_remote_uac.yml
Update modification date
2020-03-16 12:49:06 -06:00
dns_amplification_any_query.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
dns_evilginx_subdomains.yml
fixing the files that didnt update the macros correctly
2019-12-11 15:39:14 -08:00
dns_query_length_mltk.yml
removing incorrect mitre id
2020-02-07 10:27:21 -08:00
dns_query_length_with_high_standard_deviation.yml
removing incorrect mitre id
2020-02-07 10:27:21 -08:00
dns_record_changed.yml
fixing a mispelled macro
2020-03-11 20:30:39 -04:00
dns_tunnelling.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
dragonfly_schtasks.yml
version and date update
2020-03-16 12:56:56 -07:00
dump_lsass_via_comsvcs_dll.yml
new credentia dumping detection
2020-02-21 09:03:15 +01:00
dyn_dns_queries.yml
updated fields and added macros and lookup entries
2020-01-19 21:37:45 -05:00
dyn_dns_web_traffic.yml
fixing the files that didnt update the macros correctly
2019-12-11 15:39:14 -08:00
ec2_excessive_runinstances_mltk.yml
CRL-1646 - changing from user to src_user
2019-11-25 15:49:32 -08:00
ec2_excessive_terminateinstances_mltk.yml
CRL-1645 - New detection "Abnormally High AWS Instances Terminated by User - MLTK"
2019-11-25 18:06:33 -08:00
ec2_instance_created_by_previously_unseen_user.yml
introduced security_content_ctime as a macro, renamed all our searches to use this new macro, removing ES dependecy
2019-12-11 14:59:03 -05:00
ec2_instance_modified_by_previously_unseen_user.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
ec2_instance_started_with_previously_unseen_ami.yml
fixing the files that didnt update the macros correctly
2019-12-11 15:39:14 -08:00
ec2_instance_started_with_previously_unseen_instance_type.yml
fixes issue 343
2020-02-07 13:32:56 -05:00
email_attachments_with_spaces.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
email_files_not_in_outlook_directory.yml
updating version
2020-03-23 11:40:29 -07:00
emailserver_high_volume_outbound_traffic_to_hosts.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
excessive_dns_failures.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
excessive_lockouts_from_endpoint.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
excessive_user_account_lockouts.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
execution_of_nirsoft_tools.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
file_write_spikes.yml
version and date update
2020-03-16 12:56:56 -07:00
first_time_seen_cmd_line.yml
update version
2020-03-16 12:53:39 -06:00
first_time_seen_running_windows_service.yml
updated search/metadata, tested in attack_range
2020-01-13 12:42:35 -08:00
fsutil_deleting_journals.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
hosts_file_modification.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
hosts_receiving_high_volume_network_traffic_from_email_servers.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
kubernetes_aws_scan_fingerprint.yml
remove k8s from manifest objects
2020-04-16 16:16:58 -07:00
kubernetes_gcp_scan_fingerprint_attack.yml
remove k8s from manifest objects
2020-04-16 16:16:58 -07:00
kubernetes_pods_aws_scan_fingerprint.yml
remove k8s from manifest objects
2020-04-16 16:16:58 -07:00
large_icmp_outbound.yml
fixing the files that didnt update the macros correctly
2019-12-11 15:39:14 -08:00
lnk_executing_a_process.yml
version and date update
2020-03-16 12:56:56 -07:00
local_admin_account_creation.yml
added connected=false to 3 searches using the transaction command.
2019-10-30 13:32:31 -06:00
long_dns_text_response.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
macos_re-opened_applications.yml
corrected a few bugs with the spec
2020-02-07 13:51:31 -05:00
malicious_application_shimming_via_registry.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
malicious_powershell_process_connect_to_internet_with_hidden_window.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
malicious_powershell_process_encoded_command.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
malicious_powershell_process_execpolicy.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
malicious_powershell_process_multiple_suspicious_arguments.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
malicious_powershell_process_obfuscation_techniques.yml
CRL-1716 - Updating per code review requests. Adding output macro file and reference within the detection search.
2020-01-22 08:26:16 -08:00
malicious_requests_to_exploit_jboss_servers.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
mshta_launching_scripts.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
netbackup_failed_backup.yml
introduced security_content_ctime as a macro, renamed all our searches to use this new macro, removing ES dependecy
2019-12-11 14:59:03 -05:00
netbackup_no_backups_in_time_period.yml
introduced security_content_ctime as a macro, renamed all our searches to use this new macro, removing ES dependecy
2019-12-11 14:59:03 -05:00
netsh_launching_process.yml
formatting, and version/mod_date update
2020-03-16 13:09:27 -06:00
new_aws_console_login_by_user.yml
fixing the files that didnt update the macros correctly
2019-12-11 15:39:14 -08:00
new_aws_console_login_city_by_user.yml
fixing the files that didnt update the macros correctly
2019-12-11 15:39:14 -08:00
new_aws_console_login_country_by_user.yml
fixing the files that didnt update the macros correctly
2019-12-11 15:39:14 -08:00
new_aws_console_login_region_by_user.yml
fixing the files that didnt update the macros correctly
2019-12-11 15:39:14 -08:00
new_connections_to_routers.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
new_open_s3_buckets.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
new_user_accounts.yml
introduced security_content_ctime as a macro, renamed all our searches to use this new macro, removing ES dependecy
2019-12-11 14:59:03 -05:00
no_win_updates_in_timeframe.yml
fixing the files that didnt update the macros correctly
2019-12-11 15:39:14 -08:00
okta_failed_sso_attempt.yml
detection, spec and macroupdates
2020-04-02 13:39:29 -07:00
okta_multiple_users_with_auth_failures_from_ip.yml
detection, spec and macroupdates
2020-04-02 13:39:29 -07:00
okta_user_lockouts.yml
detection, spec and macroupdates
2020-04-02 13:39:29 -07:00
okta_user_logins_from_multiple_cities.yml
detection, spec and macroupdates
2020-04-02 13:39:29 -07:00
open_redirect_in_splunk_web.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
osx_coldroot_pack.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
osx_keyboard_taps.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
outbound_smb_connections.yml
update smb related content. The outbound_smb_connections detection works out of the box against attack ID T1110 when testing in the attack range.
2020-01-27 02:33:26 -08:00
outlook_writing_zip.yml
Merge branch 'develop' into CRL-1746
2020-03-16 13:23:43 -07:00
overwrite_accessibility_binaries.yml
updating spl
2020-03-16 12:18:24 -07:00
password_sharing.yml
Removed data sources from fraud searches that were not Splunk
2019-11-21 21:10:56 -06:00
path_interception_program.exe.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
port_monitor_via_registry.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
powershell_get_sedebug.yml
introduced security_content_ctime as a macro, renamed all our searches to use this new macro, removing ES dependecy
2019-12-11 14:59:03 -05:00
process_launching_netsh.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
process_with_double_extension.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
process_with_spaces_before_extension.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
prohibited_allowed_through_fw.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
prohibited_apps_spawning_cmdprompt.yml
CRL-1725 - Changed prohibited_apps_spawning_cmdprompt.yml to use parent_process_name as entity. Changed supress field to add user. Bumped detection version number and story version numbers on stories/suspicious_cmd_line_executions.yml and stories/suspicious_mshta_activities.yml.
2020-02-03 15:24:49 -08:00
prohibited_software_on_endpoint.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
protocol_mismatch.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
protocols_authenticating_in_cleartext.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
psexec_accepteula.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
rare_executables_on_endpoint.yml
version and date update
2020-03-16 12:56:56 -07:00
reg_manipulating_services.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
reg_used_to_hide_files.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
registry_persistence.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
registry_privilege_escalation.yml
search updated:
2020-03-02 17:39:56 -08:00
remote_desktop_bruteforce.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
remote_desktop_network_traffic.yml
tested and updates searches for lateral movement story
2020-01-13 10:39:57 +01:00
remote_desktop_process_running_on_system.yml
tested and updates searches for lateral movement story
2020-01-13 11:18:54 +01:00
remote_registry_modifications.yml
removing status field from spl
2020-03-02 14:05:04 -08:00
remote_wmi_command_attempt.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
remote_wmi_process_instantiation.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
rundll_loading_dll_by_ordinal.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
s3_access_from_new_ip.yml
fixing the files that didnt update the macros correctly
2019-12-11 15:39:14 -08:00
samsam_payload_extensions.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
samsam_test_file_write.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
sc_manipulating_services.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
schtasks_forced_reboot.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
schtasks_scheduling_job_on_remote_system.yml
tested and updates searches for lateral movement story
2020-01-13 11:18:54 +01:00
shim_database_file_creation.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
shim_database_installation.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
short_lived_accounts.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
single_letter_executables.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
smb_traffic_spike_mltk.yml
macro key
2020-03-04 14:02:40 -08:00
smb_traffic_spike.yml
update smb related content. The outbound_smb_connections detection works out of the box against attack ID T1110 when testing in the attack range.
2020-01-27 02:33:26 -08:00
sncd_processes.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
spectre_meltdown_vulnerabilities.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
spike_aws_api_call_per_account.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
spike_aws_security_group_activity.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
spike_s3_deletion.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
spike_vpc_blocked_traffic.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
splunk_information_disclosure.yml
fixing the files that didnt update the macros correctly
2019-12-11 15:39:14 -08:00
sql_injection_with_long_urls.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
stop_security_services.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
suspicious_email_attachments.yml
macros node
2020-02-07 10:17:14 -08:00
suspicious_file_writes.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
suspicious_java_classes.yml
fixing the files that didnt update the macros correctly
2019-12-11 15:39:14 -08:00
suspicious_reg_process.yml
version and date update
2020-03-16 12:56:56 -07:00
suspicious_wevtutil_usage.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
suspicious_write_to_recycler.yml
CRL-1723 : corrected field name in SPL Filesystem.filepath [which does not exist] to Filesystem.file_path.
2020-02-03 21:00:55 -08:00
suspicious_write_to_sysvol.yml
introduced security_content_ctime as a macro, renamed all our searches to use this new macro, removing ES dependecy
2019-12-11 14:59:03 -05:00
system_processes_run_from_unexpected_locations.yml
updating files as per Dons feedback
2020-02-04 09:15:39 -08:00
tor_traffic.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
uba_email_anomaly.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
unauthorized_assets_via_mac_address.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
unauthorized_dns_servers.yml
updated fields and added macros and lookup entries
2020-01-19 21:37:45 -05:00
uncommon_processes.yml
version and date update
2020-03-16 12:56:56 -07:00
unload_sysmon_filter_driver.yml
bumping version
2020-01-21 11:28:26 -08:00
unsigned_image_loaded_by_LSASS.yml
introduced mitre technique id to detection spec
2020-01-06 13:31:43 -05:00
unusually_long_commandlines_mltk.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
unusually_long_commandlines.yml
version and date update
2020-03-16 12:56:56 -07:00
unusually_long_content-type_length.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
usb_insertion.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
users_without_mfa.yml
introduced security_content_ctime as a macro, renamed all our searches to use this new macro, removing ES dependecy
2019-12-11 14:59:03 -05:00
web_servers_executing_suspicious_processes.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
windows_event_log_cleared.yml
introduced security_content_ctime as a macro, renamed all our searches to use this new macro, removing ES dependecy
2019-12-11 14:59:03 -05:00
wmi_perm_event_subscription_sysmon.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
wmi_perm_event_subscription.yml
introduced security_content_ctime as a macro, renamed all our searches to use this new macro, removing ES dependecy
2019-12-11 14:59:03 -05:00
wmi_process_launch.yml
version and date update
2020-03-16 12:56:56 -07:00
wmi_script_execution.yml
version and date update
2020-03-16 12:56:56 -07:00
wmi_temp_event_subscription.yml
introduced security_content_ctime as a macro, renamed all our searches to use this new macro, removing ES dependecy
2019-12-11 14:59:03 -05:00