mhaag-spl eaf1e8eb07 Merge branch '02rel1' of https://github.com/splunk/security_content into 02rel1

2021-01-28 14:43:42 -07:00

..

access_lsass_memory_for_dump_creation.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

attempt_to_add_certificate_to_untrusted_store.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml

Added detection testing service results inAttempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass

2020-12-09 09:18:47 +00:00

attempt_to_stop_security_service.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

attempted_credential_dump_from_registry_via_reg_exe.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

batch_file_write_to_system32.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

bcdedit_failure_recovery_modification.yml

Update bcdedit_failure_recovery_modification.yml

2021-01-11 16:12:59 -07:00

common_ransomware_extensions.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

common_ransomware_notes.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

create_local_admin_accounts_using_net_exe.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

create_or_delete_windows_shares_using_net_exe.yml

Added detection testing service results inCreate or delete windows shares using net exe

2020-12-09 11:19:43 +00:00

create_remote_thread_into_lsass.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

creation_of_shadow_copy_with_wmic_and_powershell.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

creation_of_shadow_copy.yml

ntdsutil export NTDS.dit

2021-01-28 14:36:52 -07:00

credential_dumping_via_copy_command_from_shadow_copy.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

credential_dumping_via_symlink_to_shadow_copy.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

deleting_shadow_copies.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

detect_activity_related_to_pass_the_hash_attacks.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

detect_computer_changed_with_anonymous_account.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

detect_credential_dumping_through_lsass_access.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

detect_excessive_account_lockouts_from_endpoint.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

detect_excessive_user_account_lockouts.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

detect_mshta_inline_hta_execution.yml

ID changes

2021-01-20 14:45:27 -07:00

detect_mshta_renamed.yml

renamed testing

2021-01-20 14:46:45 -07:00

detect_mshta_url_in_command_line.yml

ID changes

2021-01-20 14:45:27 -07:00

detect_new_local_admin_account.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

detect_path_interception_by_creation_of_program_exe.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

detect_processes_used_for_system_network_configuration_discovery.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

detect_prohibited_applications_spawning_cmd_exe.yml

adding sunburst as tags for relavant detections

2020-12-14 20:29:04 -08:00

detect_psexec_with_accepteula_flag.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

detect_rare_executables.yml

Changed the language in some of the descriptions

2021-01-21 23:53:47 -06:00

detect_rundll32_inline_hta_execution.yml

Update detect_rundll32_inline_hta_execution.yml

2021-01-20 11:43:42 -07:00

detect_use_of_cmd_exe_to_launch_script_interpreters.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

disabling_remote_user_account_control.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

dump_lsass_via_comsvcs_dll.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

execution_of_file_with_multiple_extensions.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

file_with_samsam_extension.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

first_time_seen_child_process_of_zoom.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

first_time_seen_running_windows_service.yml

adding sunburst as tags for relavant detections

2020-12-14 20:29:04 -08:00

hiding_files_and_directories_with_attrib_exe.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

kerberoasting_spn_request_with_rc4_encryption.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

malicious_powershell_process___connect_to_internet_with_hidden_window.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

malicious_powershell_process___encoded_command.yml

adding sunburst as tags for relavant detections

2020-12-14 20:29:04 -08:00

malicious_powershell_process___execution_policy_bypass.yml

Added detection testing service results inMalicious PowerShell Process - Execution Policy Bypass

2021-01-19 14:02:32 +00:00

malicious_powershell_process_with_obfuscation_techniques.yml

fix a description

2021-01-25 18:28:25 +01:00

monitor_registry_keys_for_print_monitors.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

nltest_domain_trust_discovery.yml

Added detection testing service results inNLTest Domain Trust Discovery

2021-01-26 17:13:39 +00:00

ntdsutil_export_ntds.yml

Update ntdsutil_export_ntds.yml

2021-01-28 14:43:33 -07:00

overwriting_accessibility_binaries.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

process_creating_lnk_file_in_suspicious_location.yml

rename detection and updated description

2021-01-28 11:56:01 -05:00

process_execution_via_wmi.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

processes_launching_netsh.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

reg_exe_manipulating_windows_services_registry_keys.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

registry_keys_for_creating_shim_databases.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

registry_keys_used_for_persistence.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

registry_keys_used_for_privilege_escalation.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

remote_process_instantiation_via_wmi.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

rundll_loading_dll_by_ordinal.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

ryuk_test_files_detected.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

samsam_test_file_write.yml

Added detection testing service results inSamsam Test File Write

2020-12-07 12:34:31 +00:00

sc_exe_manipulating_windows_services.yml

adding sunburst as tags for relavant detections

2020-12-14 20:29:04 -08:00

scheduled_task_deleted_or_created_via_cmd.yml

fixed validate mistakes

2020-12-17 18:13:25 -05:00

schtasks_scheduling_job_on_remote_system.yml

sc tasks for sunburst

2020-12-14 20:48:11 -08:00

schtasks_used_for_forcing_a_reboot.yml

Added detection testing service results inSchtasks used for forcing a reboot

2020-12-08 09:09:37 +00:00

script_execution_via_wmi.yml

Added detection testing service results inScript Execution via WMI

2020-12-07 18:00:12 +00:00

shim_database_file_creation.yml

Added detection testing service results inShim Database File Creation

2020-12-08 09:18:06 +00:00

shim_database_installation_with_suspicious_parameters.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

short_lived_windows_accounts.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

single_letter_process_on_endpoint.yml

Added detection testing service results inSingle Letter Process On Endpoint

2020-12-08 09:28:45 +00:00

ssa___applying_stolen_credentials_via_mimikatz_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___applying_stolen_credentials_via_powersploit_modules.yml

Update ssa___applying_stolen_credentials_via_powersploit_modules.yml

2020-12-07 19:44:47 -08:00

ssa___assess_credential_strength_via_dsinternals_modules.yml

Update ssa___assess_credential_strength_via_dsinternals_modules.yml

2020-11-18 10:07:53 -08:00

ssa___attempted_credential_dump_from_registry_via_reg_exe.yml

migrated other portions that pointed to the old repo

2021-01-26 15:07:14 -05:00

ssa___credential_extraction_dsinternals_conversion_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___credential_extraction_dsinternals_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___credential_extraction_fgdump_cachedump_s_option.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___credential_extraction_fgdump_cachedump_v_option.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___credential_extraction_getaddbaccount_from_dump.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___credential_extraction_lazagne_command_options.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___credential_extraction_mimikatz_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___credential_extraction_ms_debuggers_kernel_peek.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___credential_extraction_ms_debuggers_z_option.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___credential_extraction_powersploit_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___detect_dump_lsass_memory_using_comsvcs.yml

renamed ssa detections

2021-01-25 16:32:23 -08:00

ssa___detect_kerberoasting.yml

Syntax change in first_time_event

2021-01-08 11:10:12 -08:00

ssa___detect_pass_hash.yml

Syntax change in first_time_event

2021-01-08 11:10:12 -08:00

ssa___first_time_seen_cmd_line.yml

renamed ssa detections

2021-01-25 16:32:23 -08:00

ssa___illegal_access_user_content_via_powersploit_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___illegal_account_creation_via_powersploit_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___illegal_account_enable_disable_via_dsinternals_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___illegal_log_deletion_via_mimikatz_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___illegal_privilege_elevation_via_mimikatz_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___illegal_service_and_process_control_via_mimikatz_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___illegal_service_and_process_control_via_powersploit_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml

Update ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml

2020-11-18 10:08:45 -08:00

ssa___prohibited_apps_spawning_cmdprompt.yml

renamed ssa detections

2021-01-25 16:32:23 -08:00

ssa___rare_parent_process_relationship_lolbas.yml

removing special characters from rare parent-child process ssa detection

2021-01-26 08:37:21 -08:00

ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml

Update ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml

2020-11-18 10:10:57 -08:00

ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml

Update ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml

2020-11-18 10:11:40 -08:00

ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml

Update ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml

2020-11-18 10:12:17 -08:00

ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml

Update ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml

2020-11-18 10:17:35 -08:00

ssa___recon_and_use_computers_domains_via_powersploit_modules.yml

Update ssa___recon_and_use_computers_domains_via_powersploit_modules.yml

2020-11-18 10:18:26 -08:00

ssa___recon_and_use_computers_via_mimikatz_modules.yml

Update ssa___recon_and_use_computers_via_mimikatz_modules.yml

2020-11-18 10:19:17 -08:00

ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml

Update ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml

2020-11-18 10:19:56 -08:00

ssa___recon_and_use_shares_via_mimikatz_modules.yml

Update ssa___recon_and_use_shares_via_mimikatz_modules.yml

2020-11-18 10:20:56 -08:00

ssa___recon_and_use_shares_via_powersploit_modules.yml

Update ssa___recon_and_use_shares_via_powersploit_modules.yml

2020-11-18 10:21:45 -08:00

ssa___recon_connectivity_via_powersploit_modules.yml

Update ssa___recon_connectivity_via_powersploit_modules.yml

2020-11-18 10:22:24 -08:00

ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml

Update ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml

2020-11-18 10:09:35 -08:00

ssa___recon_defensive_tools_via_powersploit_modules.yml

Update ssa___recon_defensive_tools_via_powersploit_modules.yml

2020-11-18 10:23:05 -08:00

ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml

Update ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml

2020-11-18 10:24:01 -08:00

ssa___recon_process_service_hijacking_via_mimikatz_modules.yml

Update ssa___recon_process_service_hijacking_via_mimikatz_modules.yml

2020-11-18 10:24:37 -08:00

ssa___recon_processes_and_services_via_mimikatz_modules.yml

Update ssa___recon_processes_and_services_via_mimikatz_modules.yml

2020-11-18 10:25:24 -08:00

ssa___setting_credentials_via_dsinternals_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___setting_credentials_via_mimikatz_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___setting_credentials_via_powersploit_modules.yml

Added required fields for all SSA detections

2020-11-13 10:27:29 -08:00

ssa___system_process_running_unexpected_location.yml

migrated other portions that pointed to the old repo

2021-01-26 15:07:14 -05:00

ssa___unusual_lolbas_in_short_period_of_time.yml

renamed ssa detections

2021-01-25 16:32:23 -08:00

ssa___unusually_long_command_line.yml

renamed ssa detections

2021-01-25 16:32:23 -08:00

suspicious_microsoft_workflow_compiler_rename.yml

Added detection testing service results inDetect microsoft.workflow.compiler.exe rename

2021-01-19 22:11:46 +00:00

suspicious_microsoft_workflow_compiler_usage.yml

Added detection testing service results inDetect microsoft.workflow.compiler.exe usage

2021-01-19 22:12:26 +00:00

suspicious_msbuild_path.yml

Update suspicious_msbuild_path.yml

2021-01-27 11:58:14 -07:00

suspicious_msbuild_rename.yml

Resolved yml formatting

2021-01-27 06:35:41 -07:00

suspicious_msbuild_spawn.yml

MSBuild story update

2021-01-21 12:27:43 -07:00

suspicious_mshta_child_process.yml

Added detection testing service results inDetect mshta spawning a process

2021-01-26 18:16:25 +00:00

suspicious_mshta_spawn.yml

Added detection testing service results inDetect mshta spawn

2021-01-20 22:31:06 +00:00

suspicious_reg_exe_process.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

suspicious_wevtutil_usage.yml

Added detection testing service results inSuspicious File Write

2020-12-08 10:37:22 +00:00

suspicious_writes_to_windows_recycle_bin.yml

Added detection testing service results inSuspicious writes to windows Recycle Bin

2020-12-08 11:06:38 +00:00

system_information_discovery_detection.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

system_processes_run_from_unexpected_locations.yml

Added detection testing service results inSystem Processes Run From Unexpected Locations

2020-12-08 12:46:06 +00:00

unload_sysmon_filter_driver.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

unusually_long_command_line___mltk.yml

moved detections to their respective folders

2020-10-07 10:31:25 -04:00

unusually_long_command_line.yml

new test file

2020-12-08 14:18:59 +01:00

usn_journal_deletion.yml

Added detection testing service results inUSN Journal Deletion

2020-12-08 13:34:34 +00:00

wbadmin_delete_system_backups.yml

Added detection testing service results inWBAdmin Delete System Backups

2021-01-22 21:23:23 +00:00

windows_adfind_exe.yml

fixed validate mistakes

2020-12-17 18:13:25 -05:00

windows_event_log_cleared.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

windows_security_account_manager_stopped.yml

updated url links for dataset

2020-12-03 15:03:50 +01:00

wmi_permanent_event_subscription___sysmon.yml

Added detection testing service results inWMI Permanent Event Subscription - Sysmon

2020-12-08 14:58:22 +00:00