admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
ccb8986a40fef7ebb8a3b05b7ebfcd6d8747dfa6
splunk-security_content/dev_ssa/endpoint
T
History
Jose Hernandez ccb8986a40 adding 4 detections from validation to production mode
2024-04-29 18:07:10 -04:00
..
ssa___anomalous_usage_of_archive_tools.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___attacker_tools_on_endpoint.yml
ESCU Release branch : v4.29.0
2024-04-04 17:50:37 +00:00
ssa___attempt_to_delete_services.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___attempt_to_disable_services.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___bcdedit_failure_recovery_modification.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___clear_unallocated_sector_using_cipher_app.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___create_local_admin_accounts_using_net_exe.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___create_local_user_accounts_using_net_exe.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___delete_a_net_user.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___deleting_shadow_copies.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___deny_permission_using_cacls_utility.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___detect_powershell_applications_spawning_cmd_exe.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___detect_prohibited_applications_spawning_cmd_exe.yml
Release v4.18.0
2023-12-20 16:18:23 +00:00
ssa___detect_prohibited_browsers_spawning_cmd_exe.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___detect_prohibited_office_applications_spawning_cmd_exe.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___detect_rclone_command_line_usage.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___disable_net_user_account.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___dns_exfiltration_using_nslookup_app.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___fsutil_zeroing_file.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___grant_permission_using_cacls_utility.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___hiding_files_and_directories_with_attrib_exe.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___impacket_lateral_movement_smbexec_commandline_parameters.yml
adding 4 detections from validation to production mode
2024-04-29 18:07:10 -04:00
ssa___impacket_lateral_movement_wmiexec_commandline_parameters.yml
adding 4 detections from validation to production mode
2024-04-29 18:07:10 -04:00
ssa___modify_acls_permission_of_files_or_folders.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___office_product_spawning_windows_script_host.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___possible_lateral_movement_powershell_spawn.yml
ESCU Release branch : v4.29.0
2024-04-04 17:50:37 +00:00
ssa___resize_shadowstorage_volume.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___sdelete_application_execution.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___serviceprincipalnames_discovery_with_powershell.yml
adding 4 detections from validation to production mode
2024-04-29 18:07:10 -04:00
ssa___services_lolbas_execution_process_spawn.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___system_process_running_from_unexpected_location.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___wbadmin_delete_system_backups.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___wevtutil_usage_to_clear_logs.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___wevtutil_usage_to_disable_logs.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_bits_job_persistence.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_bitsadmin_download_file.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_certutil_decode_file.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_certutil_urlcache_download.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_certutil_verifyctl_download.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_com_hijacking_inprocserver32_modification.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_curl_upload_to_remote_destination.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_default_group_policy_object_modified_with_gpme.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_defender_tools_in_non_standard_path.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_diskshadow_proxy_execution.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_dotnet_binary_in_non_standard_path.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_exchange_powershell_module_usage.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_execute_arbitrary_commands_with_msdt.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_file_share_discovery_with_powerview.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_findstr_gpp_discovery.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_ingress_tool_transfer_using_explorer.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_lateral_tool_transfer_remcom.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_lolbin_binary_in_non_standard_path.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_mshta_child_process.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_mshta_command_line_url.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_mshta_inline_hta_execution.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_odbcconf_load_response_file.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_os_credential_dumping_with_ntdsutil_export_ntds.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_os_credential_dumping_with_procdump.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_get_aduser.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_powershell_disabled_kerberos_pre_authentication_discovery_with_powerview.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_powershell_downloadfile.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_powershell_downloadstring.yml
ESCU Release branch : v4.29.0
2024-04-04 17:50:37 +00:00
ssa___windows_powershell_execution_policy_bypass.yml
ESCU Release branch : v4.29.0
2024-04-04 17:50:37 +00:00
ssa___windows_powershell_export_certificate.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_powershell_export_pfxcertificate.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_powershell_start_bitstransfer.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_powersploit_gpp_discovery.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_rasautou_dll_execution.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_remote_create_service.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_rename_system_utilities_acccheckconsole_exe_lolbas_in_non_standard_path.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
ssa___windows_rename_system_utilities_adplus_exe_lolbas_in_non_standard_path.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
ssa___windows_rename_system_utilities_advpack_dll_lolbas_in_non_standard_path.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
ssa___windows_rename_system_utilities_agentexecutor_exe_lolbas_in_non_standard_path.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
ssa___windows_rename_system_utilities_appinstaller_exe_lolbas_in_non_standard_path.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
ssa___windows_rename_system_utilities_appvlp_exe_lolbas_in_non_standard_path.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
ssa___windows_rename_system_utilities_aspnet_compiler_exe_lolbas_in_non_standard_path.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
ssa___windows_rename_system_utilities_at_exe_lolbas_in_non_standard_path.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
ssa___windows_rename_system_utilities_atbroker_exe_lolbas_in_non_standard_path.yml
ESCU Release Branch - v4.30.0
2024-04-17 20:44:56 +00:00
ssa___windows_rundll32_comsvcs_memory_dump.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_rundll32_inline_hta_execution.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_screen_capture_via_powershell.yml
adding 4 detections from validation to production mode
2024-04-29 18:07:10 -04:00
ssa___windows_script_host_spawn_msbuild.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_service_create_with_tscon.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_system_binary_proxy_execution_compiled_html_file_using_infotech_storage_handlers.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_system_binary_proxy_execution_msiexec_dllregisterserver.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_system_binary_proxy_execution_msiexec_remote_download.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_system_binary_proxy_execution_msiexec_unregister_dll.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00
ssa___windows_wmiprvse_spawn_msbuild.yml
Release v4.24.0
2024-02-14 23:54:00 +00:00