admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
v1.0.48
splunk-security_content/macros
T
History
bpatel 652d7f3fd0 updating macros to use sourcetype
2019-12-18 17:49:09 -08:00
..
access_lsass_memory_for_dump_creation_filter.yml
Worked on the feedback
2019-12-18 10:23:55 +01:00
attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter.yml
Worked on the feedback
2019-12-18 10:23:55 +01:00
attempted_credential_dump_from_registry_via_reg_filter.yml
Worked on the feedback
2019-12-18 10:23:55 +01:00
brand_abuse_dns.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
brand_abuse_email.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
brand_abuse_web.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
create_remote_thread_into_lsass_filter.yml
Worked on the feedback
2019-12-18 10:23:55 +01:00
creation_of_shadow_copy_filter.yml
Worked on the feedback
2019-12-18 10:29:40 +01:00
creation_of_shadow_copy_with_wmic_and_powershell_filter.yml
Worked on the feedback
2019-12-18 20:03:19 +01:00
cred_dump_via_copy_from_shadowcopy_filter.yml
Worked on the feedback
2019-12-18 20:08:10 +01:00
cred_dump_via_symlink_shadowcopy_filter.yml
Worked on the feedback
2019-12-18 20:03:19 +01:00
detect_credential_dumping_through_LSASS_access_filter.yml
Worked on the feedback
2019-12-18 20:08:10 +01:00
detect_mimikatz_using_loaded_images_filter.yml
Worked on the feedback
2019-12-18 20:03:19 +01:00
dynamic_dns_providers.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
dynamic_dns_web_traffic.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
ec2_excessive_runinstances_mltk_input_filter.yml
CRL-1645 - Fixing macros for excessive runinstances and terminateinstances to use src_user in description.
2019-11-25 18:17:06 -08:00
ec2_excessive_terminateinstances_mltk_input_filter.yml
CRL-1645 - Fixing macros for excessive runinstances and terminateinstances to use src_user in description.
2019-11-25 18:17:06 -08:00
ec2_modification_api_calls.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
evilginx_phishlets_0365.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_amazon.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_aws.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_facebook.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_github.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_google.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_outlook.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
filter_rare_process_whitelist.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
investigate_cloud_compute_instance_activities_output_filter.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
investigate_user_activities_in_all_cloud_region_output_filter.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
investigate_user_activities_in_single_cloud_region_output_filter.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
is_windows_system_file.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
network_acl_events.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
previously_seen_cloud_compute_creations_by_user_input_filter.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_cloud_compute_creations_by_user_search_window_begin_offset.yml
Added search_window macros to searches
2019-10-17 09:28:41 -07:00
previously_seen_cloud_compute_image_input_filter.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_cloud_compute_image_search_window_begin_offset.yml
Added search_window macros to searches
2019-10-17 09:28:41 -07:00
previously_seen_cloud_compute_instance_types_input_filter.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_cloud_compute_instance_types_search_window_begin_offset.yml
Added search_window macros to searches
2019-10-17 09:28:41 -07:00
previously_seen_cloud_regions_input_filter.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_cloud_regions_search_window_begin_offset.yml
Updated generate to output for ASX
2019-10-16 20:54:13 -07:00
prohibited_apps_launching_cmd.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
prohibited_softwares.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
ransomware_extensions.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
ransomware_notes.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
remove_valid_domains.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
security_content_ctime.yml
fixed security_content_ctime macro
2019-12-17 09:33:35 +01:00
security_content_summariesonly.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
security_group_api_calls.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
suspicious_email_attachments.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
suspicious_writes.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
sysmon.yml
updating macros to use sourcetype
2019-12-18 17:49:09 -08:00
system_network_configuration_discovery_tools.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
uncommon_processes.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
unsigned_image_loaded_by_LSASS_filter.yml
Worked on the feedback
2019-12-18 20:03:19 +01:00
wineventlog_security.yml
updating macros to use sourcetype
2019-12-18 17:49:09 -08:00