admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
fe00a4bbb375b730cfe617232ed097f03a819b87
splunk-security_content/detections/network
T
History
pyth0n1c b9f5735bd3 Merge branch 'develop' into remove_type_and_subtype
2025-02-11 15:38:08 -08:00
..
detect_arp_poisoning.yml
Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.
2025-02-10 12:28:22 -08:00
detect_dga_domains_using_pretrained_model_in_dsdl.yml
remove update_timestamps, confidence, impact,
2025-01-03 15:25:52 -08:00
detect_dns_data_exfiltration_using_pretrained_model_in_dsdl.yml
remove update_timestamps, confidence, impact,
2025-01-03 15:25:52 -08:00
detect_hosts_connecting_to_dynamic_domain_providers.yml
notable to finding 2
2025-01-24 17:03:47 -08:00
detect_ipv6_network_infrastructure_threats.yml
Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.
2025-02-10 12:28:22 -08:00
detect_large_outbound_icmp_packets.yml
updating versions
2025-02-05 10:49:03 -08:00
detect_outbound_ldap_traffic.yml
remove update_timestamps, confidence, impact,
2025-01-03 15:25:52 -08:00
detect_outbound_smb_traffic.yml
Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.
2025-02-10 12:28:22 -08:00
detect_port_security_violation.yml
Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.
2025-02-10 12:28:22 -08:00
detect_remote_access_software_usage_dns.yml
Update detect_remote_access_software_usage_dns.yml
2025-02-06 08:07:31 -05:00
detect_remote_access_software_usage_traffic.yml
Update detect_remote_access_software_usage_traffic.yml
2025-02-06 08:06:29 -05:00
detect_rogue_dhcp_server.yml
remove update_timestamps, confidence, impact,
2025-01-03 15:25:52 -08:00
detect_snicat_sni_exfiltration.yml
remove update_timestamps, confidence, impact,
2025-01-03 15:25:52 -08:00
detect_software_download_to_network_device.yml
Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.
2025-02-10 12:28:22 -08:00
detect_suspicious_dns_txt_records_using_pretrained_model_in_dsdl.yml
remove update_timestamps, confidence, impact,
2025-01-03 15:25:52 -08:00
detect_traffic_mirroring.yml
Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.
2025-02-10 12:28:22 -08:00
detect_unauthorized_assets_by_mac_address.yml
remove update_timestamps, confidence, impact,
2025-01-03 15:25:52 -08:00
detect_windows_dns_sigred_via_splunk_stream.yml
remove update_timestamps, confidence, impact,
2025-01-03 15:25:52 -08:00
detect_windows_dns_sigred_via_zeek.yml
remove update_timestamps, confidence, impact,
2025-01-03 15:25:52 -08:00
detect_zerologon_via_zeek.yml
remove update_timestamps, confidence, impact,
2025-01-03 15:25:52 -08:00
dns_query_length_outliers___mltk.yml
Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.
2025-02-10 12:28:22 -08:00
dns_query_length_with_high_standard_deviation.yml
Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.
2025-02-10 12:28:22 -08:00
excessive_dns_failures.yml
Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.
2025-02-10 12:28:22 -08:00
f5_big_ip_icontrol_rest_vulnerability_cve_2022_1388.yml
remove update_timestamps, confidence, impact,
2025-01-03 15:25:52 -08:00
hosts_receiving_high_volume_of_network_traffic_from_email_server.yml
Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.
2025-02-10 12:28:22 -08:00
internal_horizontal_port_scan_nmap_top_20.yml
remove update_timestamps, confidence, impact,
2025-01-03 15:25:52 -08:00
internal_horizontal_port_scan.yml
remove update_timestamps, confidence, impact,
2025-01-03 15:25:52 -08:00
internal_vertical_port_scan.yml
remove update_timestamps, confidence, impact,
2025-01-03 15:25:52 -08:00
internal_vulnerability_scan.yml
remove update_timestamps, confidence, impact,
2025-01-03 15:25:52 -08:00
large_volume_of_dns_any_queries.yml
Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.
2025-02-10 12:28:22 -08:00
ngrok_reverse_proxy_on_network.yml
remove update_timestamps, confidence, impact,
2025-01-03 15:25:52 -08:00
prohibited_network_traffic_allowed.yml
remove update_timestamps, confidence, impact,
2025-01-03 15:25:52 -08:00
protocol_or_port_mismatch.yml
Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.
2025-02-10 12:28:22 -08:00
protocols_passing_authentication_in_cleartext.yml
remove update_timestamps, confidence, impact,
2025-01-03 15:25:52 -08:00
remote_desktop_network_traffic.yml
Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.
2025-02-10 12:28:22 -08:00
smb_traffic_spike___mltk.yml
Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.
2025-02-10 12:28:22 -08:00
smb_traffic_spike.yml
Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.
2025-02-10 12:28:22 -08:00
ssl_certificates_with_punycode.yml
remove update_timestamps, confidence, impact,
2025-01-03 15:25:52 -08:00
tor_traffic.yml
Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.
2025-02-10 12:28:22 -08:00
windows_ad_replication_service_traffic.yml
Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined.
2025-02-10 12:28:22 -08:00
windows_ad_rogue_domain_controller_network_activity.yml
remove update_timestamps, confidence, impact,
2025-01-03 15:25:52 -08:00
windows_remote_desktop_network_bruteforce_attempt.yml
Merge branch 'develop' into remove_type_and_subtype
2025-02-11 15:38:08 -08:00
zeek_x509_certificate_with_punycode.yml
remove update_timestamps, confidence, impact,
2025-01-03 15:25:52 -08:00