admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
bfec79252f413bfff412acbac4e8f597927a72fd
splunk-security_content/stories
T
History
github-actions[bot] 3fbc3d2102 Branch was auto-updated.
2021-02-02 18:09:23 +00:00
..
apache_struts_vulnerability.yml
removed the converter since we do not use it anymore and updated reqs to avoid errors
2020-11-11 15:32:53 -05:00
asset_tracking.yml
WIP
2020-04-30 10:34:18 +02:00
aws_cross_account_activity.yml
WIP
2020-04-30 10:34:18 +02:00
aws_cryptomining.yml
removed the converter since we do not use it anymore and updated reqs to avoid errors
2020-11-11 15:32:53 -05:00
aws_network_acl_activity.yml
WIP
2020-04-30 10:34:18 +02:00
aws_security_hub_alerts.yml
new detections for security hub alerts
2020-08-06 14:44:50 -07:00
aws_suspicious_provisioning_activities.yml
Syntax issue when in conf file
2021-01-22 10:32:45 -06:00
aws_user_monitoring.yml
WIP
2020-04-30 10:34:18 +02:00
baron_samedit_cve_2021_3156.yml
duplicating files and experimental
2021-01-28 17:35:25 -08:00
brand_monitoring.yml
WIP
2020-04-30 10:34:18 +02:00
cloud_cryptomining.yml
WIP
2020-04-30 10:34:18 +02:00
coldroot_macos_rat.yml
WIP
2020-04-30 10:34:18 +02:00
collection_and_staging.yml
WIP
2020-04-30 10:34:18 +02:00
command_and_control.yml
WIP
2020-04-30 10:34:18 +02:00
common_phishing_frameworks.yml
WIP
2020-04-30 10:34:18 +02:00
container_implantation_monitoring_and_investigation.yml
new generate script
2020-05-06 17:42:38 +02:00
credential_dumping.yml
WIP
2020-04-30 10:34:18 +02:00
data_exfiltration.yml
mods
2020-11-06 10:57:35 +11:00
data_protection.yml
WIP
2020-04-30 10:34:18 +02:00
detect_zerologon_attack.yml
fixed some issues with panels that are empty failing generate
2020-09-18 19:16:28 -04:00
dhs_report_ta18_074a.yml
WIP
2020-04-30 10:34:18 +02:00
disabling_security_tools.yml
More language clean up
2021-01-22 09:34:33 -06:00
dns_amplification_attacks.yml
WIP
2020-04-30 10:34:18 +02:00
dns_hijacking.yml
WIP
2020-04-30 10:34:18 +02:00
dynamic_dns.yml
More language clean up
2021-01-22 09:34:33 -06:00
emotet_malware__dhs_report_ta18_201a_.yml
new generate script
2020-05-06 17:42:38 +02:00
f5_tmui_rce_cve_2020_5902.yml
ymls and updates
2020-08-04 14:04:38 -07:00
gcp_cross_account_activity.yml
formatting error
2020-09-14 13:23:55 -07:00
hidden_cobra_malware.yml
WIP
2020-04-30 10:34:18 +02:00
host_redirection.yml
WIP
2020-04-30 10:34:18 +02:00
jboss_vulnerability.yml
removed the converter since we do not use it anymore and updated reqs to avoid errors
2020-11-11 15:32:53 -05:00
kubernetes_scanning_activity.yml
k8sScan
2020-05-19 17:55:28 -04:00
kubernetes_sensitive_object_access_activity.yml
fixedazk8srolesto
2020-05-21 18:52:12 -04:00
kubernetes_sensitive_role_activity.yml
add story to a single response task
2020-06-03 13:28:25 -07:00
lateral_movement.yml
bug in generate
2020-05-14 10:11:16 +02:00
malicious_powershell.yml
WIP
2020-04-30 10:34:18 +02:00
monitor_backup_solution.yml
WIP
2020-04-30 10:34:18 +02:00
monitor_for_unauthorized_software.yml
WIP
2020-04-30 10:34:18 +02:00
monitor_for_updates.yml
WIP
2020-04-30 10:34:18 +02:00
netsh_abuse.yml
update broken technet url pointer to netsh.
2020-06-20 18:34:03 -07:00
office_365_detections.yml
new detections
2020-12-16 14:31:05 +01:00
orangeworm_attack_group.yml
More language clean up
2021-01-22 09:34:33 -06:00
phishing_payloads.yml
removed the converter since we do not use it anymore and updated reqs to avoid errors
2020-11-11 15:32:53 -05:00
possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.yml
WIP
2020-04-30 10:34:18 +02:00
prohibited_traffic_allowed_or_protocol_mismatch.yml
WIP
2020-04-30 10:34:18 +02:00
ransomware_cloud.yml
ransomware3story
2020-10-27 17:12:52 -04:00
ransomware_ryuk.yml
ryuk story and detections
2020-11-06 12:32:48 -05:00
ransomware_samsam.yml
ryuk story and detections
2020-11-06 12:32:48 -05:00
ransomware.yml
WIP
2020-04-30 10:34:18 +02:00
router_and_infrastructure_security.yml
new generate script
2020-05-06 17:42:38 +02:00
spectre_and_meltdown_vulnerabilities.yml
WIP
2020-04-30 10:34:18 +02:00
splunk_enterprise_vulnerability_cve_2018_11409.yml
WIP
2020-04-30 10:34:18 +02:00
splunk_enterprise_vulnerability.yml
WIP
2020-04-30 10:34:18 +02:00
sql_injection.yml
WIP
2020-04-30 10:34:18 +02:00
sunburst_malware.yml
bug fix
2020-12-14 16:37:49 +01:00
suspicious_aws_ec2_activities.yml
WIP
2020-04-30 10:34:18 +02:00
suspicious_aws_login_activities.yml
WIP
2020-04-30 10:34:18 +02:00
suspicious_aws_s3_activities.yml
WIP
2020-04-30 10:34:18 +02:00
suspicious_aws_traffic.yml
WIP
2020-04-30 10:34:18 +02:00
suspicious_cloud_authentication_activities.yml
small bug
2020-06-09 10:54:30 -07:00
suspicious_cloud_instance_activities.yml
Updated cloud instances destroyed to change data model
2020-09-15 20:15:23 -07:00
suspicious_cloud_provisioning_activities.yml
Fixed another syntax error
2021-01-22 11:13:56 -06:00
suspicious_cloud_user_activities.yml
New analytic story for suspicious cloud user activities.
2020-09-15 20:17:49 -07:00
suspicious_command_line_executions.yml
WIP
2020-04-30 10:34:18 +02:00
suspicious_dns_traffic.yml
WIP
2020-04-30 10:34:18 +02:00
suspicious_emails.yml
WIP
2020-04-30 10:34:18 +02:00
suspicious_gcp_storage_activities.yml
shannons PR bug fixes
2020-08-19 14:37:01 -07:00
suspicious_mshta_activity.yml
Update suspicious_mshta_activity.yml
2021-01-29 14:23:02 -07:00
suspicious_okta_activity.yml
WIP
2020-04-30 10:34:18 +02:00
suspicious_regsvr32_activity.yml
regsvr32
2021-01-29 11:15:35 -07:00
suspicious_windows_registry_activities.yml
WIP
2020-04-30 10:34:18 +02:00
suspicious_wmi_use.yml
WIP
2020-04-30 10:34:18 +02:00
suspicious_zoom_child_processes.yml
converted to spec3 and other updates
2020-05-28 13:31:49 -07:00
trusted_developer_utilities_proxy_execution_msbuild.yml
Regsvr32 rename fix
2021-01-29 14:57:05 -07:00
trusted_developer_utilities_proxy_execution.yml
Update trusted_developer_utilities_proxy_execution.yml
2021-01-19 14:48:31 -07:00
unusual_aws_ec2_modifications.yml
WIP
2020-04-30 10:34:18 +02:00
unusual_processes.yml
WIP
2020-04-30 10:34:18 +02:00
use_of_cleartext_protocols.yml
WIP
2020-04-30 10:34:18 +02:00
web_fraud_detection.yml
removed the converter since we do not use it anymore and updated reqs to avoid errors
2020-11-11 15:32:53 -05:00
windows_defense_evasion_tactics.yml
WIP
2020-04-30 10:34:18 +02:00
windows_dns_sigred_cve_2020_1350.yml
porting ymls into a newe PR
2020-08-04 12:55:12 -07:00
windows_file_extension_and_association_abuse.yml
WIP
2020-04-30 10:34:18 +02:00
windows_log_manipulation.yml
WIP
2020-04-30 10:34:18 +02:00
windows_persistence_techniques.yml
WIP
2020-04-30 10:34:18 +02:00
windows_privilege_escalation.yml
WIP
2020-04-30 10:34:18 +02:00
windows_service_abuse.yml
WIP
2020-04-30 10:34:18 +02:00