Michael Haag b3e8c729ec 3CX - CVE-2023-29059

2023-03-31 12:07:36 -06:00

..

.untested

detection/experimental folder for untested detections

2020-11-06 10:37:11 -08:00

3cx_supply_chain_attack_network_indicators.yml

3CX - CVE-2023-29059

2023-03-31 12:07:36 -06:00

detect_arp_poisoning.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_dga_domains_using_pretrained_model_in_dsdl.yml

Update detect_dga_domains_using_pretrained_model_in_dsdl.yml

2023-01-24 15:01:52 -05:00

detect_ipv6_network_infrastructure_threats.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_large_outbound_icmp_packets.yml

fix broken detections

2022-03-14 15:51:05 +01:00

detect_outbound_smb_traffic.yml

Added automaticc generation of finding report

2022-03-14 12:12:48 +01:00

detect_port_security_violation.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_rogue_dhcp_server.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_snicat_sni_exfiltration.yml

Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.

2022-05-02 17:12:50 -07:00

detect_software_download_to_network_device.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml

fixup

2023-02-07 13:52:09 -08:00

detect_traffic_mirroring.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_unauthorized_assets_by_mac_address.yml

Updated per #2235

2022-06-15 13:49:56 -05:00

detect_windows_dns_sigred_via_splunk_stream.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_windows_dns_sigred_via_zeek.yml

Refactored security content

2022-03-09 14:43:09 +01:00

detect_zerologon_via_zeek.yml

Updated a very large number of detections whose references were returning HTTP Status 301 - resource moved. For example, this includes a large number of fireeye reports, which are now under mandiant, cobaltstrike info, and microsoft links.

2022-05-02 17:12:50 -07:00

dns_query_length_outliers___mltk.yml

fix broken detections

2022-03-14 15:51:05 +01:00

excessive_dns_failures.yml

spl update per git issue

2022-12-21 13:14:38 -08:00

hosts_receiving_high_volume_of_network_traffic_from_email_server.yml

Refactored security content

2022-03-09 14:43:09 +01:00

large_volume_of_dns_any_queries.yml

Refactored security content

2022-03-09 14:43:09 +01:00

prohibited_network_traffic_allowed.yml

fix broken detections

2022-03-14 15:51:05 +01:00

protocol_or_port_mismatch.yml

fix broken detections

2022-03-14 15:51:05 +01:00

protocols_passing_authentication_in_cleartext.yml

Refactored security content

2022-03-09 14:43:09 +01:00

remote_desktop_network_bruteforce.yml

Refactored security content

2022-03-09 14:43:09 +01:00

remote_desktop_network_traffic.yml

#2402 fix

2022-10-03 13:01:57 -05:00

smb_traffic_spike___mltk.yml

Refactored security content

2022-03-09 14:43:09 +01:00

smb_traffic_spike.yml

Refactored security content

2022-03-09 14:43:09 +01:00

tor_traffic.yml

fix broken detections

2022-03-14 15:51:05 +01:00

unusually_long_content_type_length.yml

Refactored security content

2022-03-09 14:43:09 +01:00

windows_ad_replication_service_traffic.yml

renaming analytic story

2023-02-08 17:04:38 -05:00

windows_ad_rogue_domain_controller_network_activity.yml

updating names and moving to experimental

2023-02-13 16:10:56 -05:00

zeek_x509_certificate_with_punycode.yml

context

2022-11-11 18:06:04 -07:00