admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
dca80fcc85650cdfcfd893831270888330f2fdc0
splunk-security_content/detections/endpoint
T
History
Ignacio Bermudez Corrales 9d139764bf fixed tests
2020-10-22 14:30:14 -07:00
..
access_lsass_memory_for_dump_creation.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
attempt_to_add_certificate_to_untrusted_store.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
attempt_to_stop_security_service.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
attempted_credential_dump_from_registry_via_reg_exe___ssa.yml
Fix:
2020-10-18 22:46:39 -07:00
attempted_credential_dump_from_registry_via_reg_exe.yml
updated with develop
2020-10-14 09:26:19 +02:00
batch_file_write_to_system32.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
child_processes_of_spoolsv_exe.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
common_ransomware_extensions.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
common_ransomware_notes.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
create_local_admin_accounts_using_net_exe.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
create_or_delete_windows_shares_using_net_exe.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
create_remote_thread_into_lsass.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
creation_of_shadow_copy_with_wmic_and_powershell.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
creation_of_shadow_copy.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
credential_dumping_via_copy_command_from_shadow_copy.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
credential_dumping_via_symlink_to_shadow_copy.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
credential_extraction_fgdump_cachedump_s_option_ssa.yml
Fixing detection categories and polishing some descriptions in Credential Extraction detections.
2020-10-20 13:20:25 -07:00
credential_extraction_fgdump_cachedump_v_option_ssa.yml
Fixing detection categories and polishing some descriptions in Credential Extraction detections.
2020-10-20 13:20:25 -07:00
credential_extraction_getaddbaccount_from_dump_ssa.yml
Fixing detection categories and polishing some descriptions in Credential Extraction detections.
2020-10-20 13:20:25 -07:00
credential_extraction_lazagne_command_options_ssa.yml
Fixing detection categories and polishing some descriptions in Credential Extraction detections.
2020-10-20 13:20:25 -07:00
credential_extraction_ms_debuggers_kernel_peek.yml
Fixing detection categories and polishing some descriptions in Credential Extraction detections.
2020-10-20 13:20:25 -07:00
credential_extraction_ms_debuggers_z_option.yml
Fixing detection categories and polishing some descriptions in Credential Extraction detections.
2020-10-20 13:20:25 -07:00
deleting_shadow_copies.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
detect_activity_related_to_pass_the_hash_attacks.yml
Added detection testing service results inDetect Activity Related to Pass the Hash Attacks
2020-10-16 08:43:40 +00:00
detect_computer_changed_with_anonymous_account.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
detect_credential_dumping_through_lsass_access.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
detect_dump_lsass_memory_using_comsvcs___ssa.yml
fixed tests
2020-10-22 14:30:14 -07:00
detect_excessive_account_lockouts_from_endpoint.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
detect_excessive_user_account_lockouts.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
detect_mimikatz_using_loaded_images.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
detect_mimikatz_via_powershell_and_eventcode_4703.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
detect_mshta_exe_running_scripts_in_command_line_arguments.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
detect_new_local_admin_account.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
detect_oulook_exe_writing_a__zip_file.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
detect_path_interception_by_creation_of_program_exe.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
detect_processes_used_for_system_network_configuration_discovery.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
detect_prohibited_applications_spawning_cmd_exe.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
detect_psexec_with_accepteula_flag.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
detect_rare_executables.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
detect_usb_device_insertion.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
detect_use_of_cmd_exe_to_launch_script_interpreters.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
detect_windows_dns_sigred_via_splunk_stream.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
detect_windows_dns_sigred_via_zeek.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
detection_of_tools_built_by_nirsoft.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
disabling_remote_user_account_control.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
dump_lsass_via_comsvcs_dll.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
execution_of_file_with_multiple_extensions.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
execution_of_file_with_spaces_before_extension.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
extended_period_without_successful_netbackup_backups.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
file_with_samsam_extension.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
first_time_seen_child_process_of_zoom.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
first_time_seen_cmd_line___ssa.yml
updating a mistake in sysmon
2020-10-15 16:04:01 -04:00
first_time_seen_command_line_argument.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
first_time_seen_running_windows_service.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
hiding_files_and_directories_with_attrib_exe.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
kerberoasting_spn_request_with_rc4_encryption.yml
Added detection testing service results inKerberoasting spn request with RC4 encryption
2020-10-16 09:57:44 +00:00
macos___re_opened_applications.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
malicious_powershell_process___connect_to_internet_with_hidden_window.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
malicious_powershell_process___encoded_command.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
malicious_powershell_process___execution_policy_bypass.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
malicious_powershell_process___multiple_suspicious_command_line_arguments.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
malicious_powershell_process_with_obfuscation_techniques.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
monitor_registry_keys_for_print_monitors.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
osquery_pack___coldroot_detection.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
overwriting_accessibility_binaries.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
process_execution_via_wmi.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
processes_created_by_netsh.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
processes_launching_netsh.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
processes_tapping_keyboard_events.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
prohibited_apps_spawning_cmdprompt___ssa.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
prohibited_software_on_endpoint.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
rare_parent_process_relationship_lolbas___ssa.yaml
Added notebook
2020-10-15 13:15:17 -07:00
reg_exe_manipulating_windows_services_registry_keys.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
reg_exe_used_to_hide_files_directories_via_registry_keys.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
registry_keys_for_creating_shim_databases.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
registry_keys_used_for_persistence.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
registry_keys_used_for_privilege_escalation.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
remote_desktop_process_running_on_system.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
remote_process_instantiation_via_wmi.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
remote_registry_key_modifications.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
remote_wmi_command_attempt.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
rundll_loading_dll_by_ordinal.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
samsam_test_file_write.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
sc_exe_manipulating_windows_services.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
scheduled_task_name_used_by_dragonfly_threat_actors.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
scheduled_tasks_used_in_badrabbit_ransomware.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
schtasks_scheduling_job_on_remote_system.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
schtasks_used_for_forcing_a_reboot.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
script_execution_via_wmi.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
shim_database_file_creation.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
shim_database_installation_with_suspicious_parameters.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
short_lived_windows_accounts.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
single_letter_process_on_endpoint.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
spike_in_file_writes.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
suspicious_changes_to_file_associations.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
suspicious_file_write.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
suspicious_java_classes.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
suspicious_lnk_file_launching_a_process.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
suspicious_reg_exe_process.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
suspicious_wevtutil_usage.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
suspicious_writes_to_system_volume_information.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
suspicious_writes_to_windows_recycle_bin.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
system_information_discovery_detection.yml
ready for PR
2020-10-14 16:13:55 +02:00
system_process_running_unexpected_location___ssa.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
system_processes_run_from_unexpected_locations.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
uncommon_processes_on_endpoint.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
unload_sysmon_filter_driver.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
unsigned_image_loaded_by_lsass.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
unsuccessful_netbackup_backups.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
unusual_lolbas_in_short_period_of_time___ssa.yml
unusual lolbas short time period
2020-10-15 14:53:59 -07:00
unusually_long_command_line___mltk.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
unusually_long_command_line___ssa.yml
Merge remote-tracking branch 'origin/develop' into TR-193
2020-10-16 11:33:17 -07:00
unusually_long_command_line.yml
updated with develop
2020-10-14 09:26:19 +02:00
unusually_long_content_type_length.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
usn_journal_deletion.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
web_servers_executing_suspicious_processes.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
windows_event_log_cleared.yml
updated with develop
2020-10-14 09:26:19 +02:00
windows_hosts_file_modification.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
wmi_permanent_event_subscription___sysmon.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
wmi_permanent_event_subscription.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00
wmi_temporary_event_subscription.yml
moved detections to their respective folders
2020-10-07 10:31:25 -04:00