admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
v1.0.41
splunk-security_content/detections
T
History
Bhavin Patel 2e4418bbfe Merge pull request #173 from splunk/endpoint_bugfix 
fixes for 2 broken searches - CRL-1586 & 1587
2019-07-26 13:06:12 -07:00
..
abnormally_high_instance_termination.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
abnormally_high_instances_launched.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
account_harvesting.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
acl_with_open_ports.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
activity_related_to_pass_the_hash.json
lame - adding spaces
2019-05-14 19:07:57 -07:00
add_to_untrust_cert_store.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
anomalous_webclick.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
api_acitivity_from_previously_unseen_user_role.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
attackers_scanning_for_vulnerable_jboss_servers.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
attrib_to_hide_files.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
aws_activity_from_non_approved_accounts.json
updates to text and search
2019-05-29 11:37:25 -07:00
aws_activity_in_new_region.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
aws_cloud_provisioning_from_previously_unseen_city.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
aws_cloud_provisioning_from_previously_unseen_country.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
aws_cloud_provisioning_from_previously_unseen_ip.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
aws_cloud_provisioning_from_previously_unseen_region.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
aws_cross_account_activity_from_new_account.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
aws_spike_acl_activity.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
badrabbit_schtasks.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
batch_file_write_system32.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
brand_abuse_dns.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
brand_abuse_email.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
brand_abuse_web.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
change_file_association.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
children_of_spoolsv.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
clients_connecting_to_multiple_dns_servers.json
fixing stories that are using product_type
2019-07-18 12:35:45 -04:00
common_ransomware_extensions.json
update to how to implement
2019-05-24 14:44:47 -07:00
common_ransomware_notes.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
create_hidden_shares.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
create_local_admin_via_net.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
cred_dump_via_reg.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
cscript_via_cmd.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
delete_shadow_copies.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
deletion_network_acl.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
disable_remote_uac.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
dns_amplification_any_query.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
dns_evilginx_subdomains.json
Merge pull request #161 from splunk/CRL-1577
2019-07-26 12:30:05 -07:00
dns_query_length_mltk.json
needed a break in there - formatting
2019-05-23 10:36:58 -06:00
dns_query_length_with_high_standard_deviation.json
changed detection searches to use start_time and end_time vs firstTime and lastTime, included links to docs on algorithm, and included mention of re-running support search in the how_to_implement for detections. Also fixed release #, and fixed incorrect risk object (was dest, should be src) on query length dns searches
2019-05-17 11:17:49 -06:00
dns_record_changed.json
fixing stories that are using product_type
2019-07-18 12:35:45 -04:00
dns_tunnelling.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
dragonfly_schtasks.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
dyn_dns_queries.json
fixing stories that are using product_type
2019-07-18 12:35:45 -04:00
dyn_dns_web_traffic.json
updates to how to implement
2019-05-29 10:53:54 -07:00
ec2_instance_created_by_previously_unseen_user.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
ec2_instance_modified_by_previously_unseen_user.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
ec2_instance_started_with_previously_unseen_ami.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
ec2_instance_started_with_previously_unseen_instance_type.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
email_attachments_with_spaces.json
fixing stories that are using product_type
2019-07-18 12:35:45 -04:00
email_files_not_in_outlook_directory.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
emailserver_high_volume_outbound_traffic_to_hosts.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
excessive_dns_failures.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
excessive_lockouts_from_endpoint.json
fixing stories that are using product_type
2019-07-18 12:35:45 -04:00
excessive_user_account_lockouts.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
execution_of_nirsoft_tools.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
file_write_spikes.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
first_time_seen_cmd_line.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
first_time_seen_running_windows_service.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
fsutil_deleting_journals.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
hosts_file_modification.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
hosts_receiving_high_volume_network_traffic_from_email_servers.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
large_icmp_outbound.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
lnk_executing_a_process.json
fixing stories that are using product_type
2019-07-18 12:35:45 -04:00
local_admin_account_creation.json
update to how to implement
2019-05-24 14:44:47 -07:00
long_dns_text_response.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
malicious_application_shimming_via_registry.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
malicious_powershell_process_connect_to_internet_with_hidden_window.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
malicious_powershell_process_encoded_command.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
malicious_powershell_process_execpolicy.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
malicious_powershell_process_multiple_suspicious_arguments.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
malicious_powershell_process_obfuscation_techniques.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
malicious_requests_to_exploit_jboss_servers.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
mshta_launching_scripts.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
netbackup_failed_backup.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
netbackup_no_backups_in_time_period.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
netsh_launching_process.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
new_aws_console_login_by_user.json
fixing stories that are using product_type
2019-07-18 12:35:45 -04:00
new_aws_console_login_city_by_user.json
fixing stories that are using product_type
2019-07-18 12:35:45 -04:00
new_aws_console_login_country_by_user.json
fixing stories that are using product_type
2019-07-18 12:35:45 -04:00
new_aws_console_login_region_by_user.json
fixing stories that are using product_type
2019-07-18 12:35:45 -04:00
new_connections_to_routers.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
new_open_s3_buckets.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
new_user_accounts.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
no_win_updates_in_timeframe.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
open_redirect_in_splunk_web.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
osx_coldroot_pack.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
osx_keyboard_taps.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
outbound_smb_connections.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
outlook_writing_zip.json
fixing stories that are using product_type
2019-07-18 12:35:45 -04:00
overwrite_accessibility_binaries.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
password_sharing.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
path_interception_program.exe.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
port_monitor_via_registry.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
powershell_get_sedebug.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
powershell_read_from_lsass.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
powershell_reg_key_mod.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
process_launching_netsh.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
process_with_double_extension.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
process_with_spaces_before_extension.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
prohibited_allowed_through_fw.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
prohibited_apps_spawning_cmdprompt.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
prohibited_software_on_endpoint.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
protocol_mismatch.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
protocols_authenticating_in_cleartext.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
psexec_accepteula.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
rare_executables_on_endpoint.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
reg_manipulating_services.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
reg_used_to_hide_files.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
registry_persistence.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
registry_privilege_escalation.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
remote_desktop_bruteforce.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
remote_desktop_network_traffic.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
remote_desktop_process_running_on_system.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
remote_registry_modifications.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
remote_wmi_command_attempt.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
remote_wmi_process_instantiation.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
rundll_loading_dll_by_ordinal.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
s3_access_from_new_ip.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
samsam_payload_extensions.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
samsam_test_file_write.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
sc_manipulating_services.json
fixes for 2 broken searches - CRL-1586 & 1587
2019-07-26 14:01:27 -06:00
schtasks_forced_reboot.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
schtasks_scheduling_job_on_remote_system.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
shim_database_file_creation.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
shim_database_installation.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
short_lived_accounts.json
search and datamodel update
2019-05-07 11:18:24 -07:00
single_letter_executables.json
Merge branch 'develop' into spec_update
2019-04-19 10:58:47 -04:00
smb_traffic_spike_mltk.json
fix italics and fixed URL not showing as code
2019-05-23 10:16:50 -06:00
smb_traffic_spike.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
sncd_processes.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
spectre_meltdown_vulnerabilities.json
updates to text and search
2019-05-29 11:37:25 -07:00
spike_aws_api_call_per_account.json
updates to how to implement
2019-05-29 11:14:20 -07:00
spike_aws_security_group_activity.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
spike_s3_deletion.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
spike_vpc_blocked_traffic.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
splunk_information_disclosure.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
sql_injection_with_long_urls.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
stop_security_services.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
suspicious_email_attachments.json
fixing stories that are using product_type
2019-07-18 12:35:45 -04:00
suspicious_file_writes.json
fixing broken detection search - suspicious_file_writes
2019-04-29 14:35:27 -06:00
suspicious_java_classes.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
suspicious_reg_process.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
suspicious_wevtutil_usage.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
suspicious_write_to_recycler.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
suspicious_write_to_sysvol.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
system_processes_run_from_unexpected_locations.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
tor_traffic.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
uba_email_anomaly.json
fixing a key in manifest
2019-07-26 12:41:44 -07:00
unauthorized_assets_via_mac_address.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
unauthorized_dns_servers.json
fixing stories that are using product_type
2019-07-18 12:35:45 -04:00
uncommon_processes.json
Merge branch 'develop' into spec_update
2019-04-19 10:58:47 -04:00
unusually_long_commandlines_mltk.json
text updates and removed isOutlier from search output
2019-05-22 18:37:44 -06:00
unusually_long_commandlines.json
pushing Brianna edits
2019-05-10 09:10:48 -06:00
unusually_long_content-type_length.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
usb_insertion.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
users_without_mfa.json
updates to how to implement
2019-05-29 11:14:20 -07:00
web_servers_executing_suspicious_processes.json
Merge branch 'spec_update' into develop
2019-04-19 11:00:21 -04:00
windows_event_log_cleared.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
wmi_perm_event_subscription_sysmon.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
wmi_perm_event_subscription.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
wmi_process_launch.json
fixes for 2 broken searches - CRL-1586 & 1587
2019-07-26 14:01:27 -06:00
wmi_script_execution.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00
wmi_temp_event_subscription.json
removed unecessary prefixes
2019-03-27 11:13:11 -04:00