admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
v1.0.53
splunk-security_content/macros
T
History
Bhavin Patel dde27b94d0 Merge pull request #430 from splunk/first_okta_story 
new files for okta story
2020-04-02 15:20:54 -07:00
..
access_lsass_memory_for_dump_creation_filter.yml
Worked on the feedback
2019-12-18 10:23:55 +01:00
attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter.yml
Worked on the feedback
2019-12-18 10:23:55 +01:00
attempted_credential_dump_from_registry_via_reg_filter.yml
Worked on the feedback
2019-12-18 10:23:55 +01:00
attrib_to_hide_files_filter.yml
macro ymls and detection update
2020-03-09 17:46:47 -07:00
brand_abuse_dns.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
brand_abuse_email.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
brand_abuse_web.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
change_file_association_filter.yml
macro ymls and detection update
2020-03-09 17:46:47 -07:00
children_of_spoolsv_filter.yml
macro ymls and detection update
2020-03-09 17:46:47 -07:00
clients_connecting_to_multiple_dns_servers.yml
adding definitions
2020-01-23 13:31:43 -08:00
common_ransomware_extensions_filter.yml
macro ymls and detection update
2020-03-09 17:46:47 -07:00
common_ransomware_notes_filter.yml
macro ymls and detection update
2020-03-09 17:46:47 -07:00
container_implant_aws_detection_filter.yml
addedmacros
2020-02-27 17:09:50 -05:00
container_implant_gcp_detection_filter.yml
addedmacros
2020-02-27 17:09:50 -05:00
create_local_admin_via_net_filter.yml
macro ymls and detection update
2020-03-09 17:46:47 -07:00
create_or_delete_windows_shares.yml
testing commented search
2020-01-21 01:58:30 -08:00
create_remote_thread_into_lsass_filter.yml
Worked on the feedback
2019-12-18 10:23:55 +01:00
creation_of_shadow_copy_filter.yml
Worked on the feedback
2019-12-18 10:29:40 +01:00
creation_of_shadow_copy_with_wmic_and_powershell_filter.yml
Worked on the feedback
2019-12-18 20:03:19 +01:00
cred_dump_via_copy_from_shadowcopy_filter.yml
Worked on the feedback
2019-12-18 20:08:10 +01:00
cred_dump_via_symlink_shadowcopy_filter.yml
Worked on the feedback
2019-12-18 20:03:19 +01:00
detect_activity_related_to_pass_the_hash_attacks_filter.yml
WIP: testing lateral movement analytics story
2020-01-10 12:47:12 +01:00
detect_credential_dumping_through_LSASS_access_filter.yml
Worked on the feedback
2019-12-18 20:08:10 +01:00
detect_mimikatz_using_loaded_images_filter.yml
Worked on the feedback
2019-12-18 20:03:19 +01:00
dns_query_length_mltk_filter.yml
update version info and macros, attack range freezing on testing detection against attack ID T1071 so query is untested against atomic red team test for now
2020-01-27 01:44:53 -08:00
dns_query_length_with_high_standard_deviation_filter.yml
update version info and macros, attack range freezing on testing detection against attack ID T1071 so query is untested against atomic red team test for now
2020-01-27 01:44:53 -08:00
dns_record_changed_filter.yml
updating macro name too
2020-03-11 20:36:49 -04:00
dragonfly_schtasks_filter.yml
macro ymls and detection update
2020-03-09 17:46:47 -07:00
dump_lsass_via_comsvcs_dll_filter.yml
new credentia dumping detection
2020-02-21 09:03:15 +01:00
dynamic_dns_providers.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
dynamic_dns_web_traffic.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
ec2_excessive_runinstances_mltk_input_filter.yml
CRL-1717 - Added "search *" definitions to the macros without definitions.
2020-01-17 17:09:01 -08:00
ec2_excessive_terminateinstances_mltk_input_filter.yml
CRL-1717 - Added "search *" definitions to the macros without definitions.
2020-01-17 17:09:01 -08:00
ec2_modification_api_calls.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
email_files_not_in_outlook_directory_filter.yml
adding macro and updating spl
2020-03-23 11:39:40 -07:00
evilginx_phishlets_0365.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_amazon.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_aws.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_facebook.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_github.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_google.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
evilginx_phishlets_outlook.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
file_write_spikes_filter.yml
macro ymls and detection update
2020-03-09 17:46:47 -07:00
filter_rare_process_whitelist.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
first_time_seen_cmd_line_filter.yml
updating instructions for better clarification
2020-03-02 13:18:54 -08:00
is_windows_system_file.yml
updating files as per Dons feedback
2020-02-04 09:15:39 -08:00
lnk_executing_a_process_filter.yml
macro ymls and detection update
2020-03-09 17:46:47 -07:00
malicious_powershell_process_obfuscation_techniques_output_filter.yml
CRL-1716 - Updating per code review requests. Adding output macro file and reference within the detection search.
2020-01-22 08:26:16 -08:00
network_acl_events.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
okta_failed_sso_attempt_filter.yml
detection, spec and macroupdates
2020-04-02 13:39:29 -07:00
okta_multiple_users_with_auth_failures_from_ip_filter.yml
detection, spec and macroupdates
2020-04-02 13:39:29 -07:00
okta_user_lockouts_filter.yml
detection, spec and macroupdates
2020-04-02 13:39:29 -07:00
okta_user_logins_from_multiple_cities_filter.yml
detection, spec and macroupdates
2020-04-02 13:39:29 -07:00
outbound_smb_connections_filter.yml
update smb related content. The outbound_smb_connections detection works out of the box against attack ID T1110 when testing in the attack range.
2020-01-27 02:33:26 -08:00
outlook_writing_zip_filter.yml
macro ymls and detection update
2020-03-09 17:46:47 -07:00
previously_seen_cloud_compute_creations_by_user_input_filter.yml
CRL-1717 - Added "search *" definitions to the macros without definitions.
2020-01-17 17:09:01 -08:00
previously_seen_cloud_compute_creations_by_user_search_window_begin_offset.yml
Added search_window macros to searches
2019-10-17 09:28:41 -07:00
previously_seen_cloud_compute_image_input_filter.yml
CRL-1717 - Added "search *" definitions to the macros without definitions.
2020-01-17 17:09:01 -08:00
previously_seen_cloud_compute_image_search_window_begin_offset.yml
Added search_window macros to searches
2019-10-17 09:28:41 -07:00
previously_seen_cloud_compute_instance_types_input_filter.yml
CRL-1717 - Added "search *" definitions to the macros without definitions.
2020-01-17 17:09:01 -08:00
previously_seen_cloud_compute_instance_types_search_window_begin_offset.yml
Added search_window macros to searches
2019-10-17 09:28:41 -07:00
previously_seen_cloud_regions_input_filter.yml
CRL-1717 - Added "search *" definitions to the macros without definitions.
2020-01-17 17:09:01 -08:00
previously_seen_cloud_regions_search_window_begin_offset.yml
Updated generate to output for ASX
2019-10-16 20:54:13 -07:00
prohibited_apps_launching_cmd.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
prohibited_softwares.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
ransomware_extensions.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
ransomware_notes.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
rare_executables_on_endpoint_filter.yml
macro ymls and detection update
2020-03-09 17:46:47 -07:00
remote_desktop_network_traffic_filter.yml
WIP: testing lateral movement analytics story
2020-01-10 12:47:12 +01:00
remote_desktop_process_running_on_system_filter.yml
tested and updates searches for lateral movement story
2020-01-13 11:18:54 +01:00
remove_valid_domains.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
schtasks_scheduling_job_on_remote_system_filter.yml
WIP: testing lateral movement analytics story
2020-01-10 12:47:12 +01:00
security_content_ctime.yml
fixed security_content_ctime macro
2019-12-17 09:33:35 +01:00
security_content_summariesonly.yml
added summariesonly and fixed ctime
2019-12-11 15:14:49 -05:00
security_group_api_calls.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
smb_traffic_spike_filter.yml
update smb related content. The outbound_smb_connections detection works out of the box against attack ID T1110 when testing in the attack range.
2020-01-27 02:33:26 -08:00
smb_traffic_spike_mltk_filter.yml
fixes for a couple broken macros
2020-03-04 14:31:37 -07:00
suspicious_email_attachments_filter.yml
updating boiler plate, detection not working out of box against T1193 but this may be due to error loading lookup table for supicious file extensions.
2020-01-27 03:04:55 -08:00
suspicious_email_attachments.yml
naming updates, jinja macros updates
2019-12-16 13:05:17 -08:00
suspicious_reg_process_filter.yml
macro ymls and detection update
2020-03-09 17:46:47 -07:00
suspicious_writes.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
sysmon.yml
updating macros to use sourcetype
2019-12-18 17:49:09 -08:00
system_network_configuration_discovery_tools.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
unauthorized_dns_servers_filter.yml
fixes for a couple broken macros
2020-03-04 14:31:37 -07:00
uncommon_processes_filter.yml
macro ymls and detection update
2020-03-09 17:46:47 -07:00
uncommon_processes.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
unload_sysmon_filter_driver_filter.yml
macros file, still not liking this practice
2020-01-14 15:58:38 -08:00
unsigned_image_loaded_by_LSASS_filter.yml
Worked on the feedback
2019-12-18 20:03:19 +01:00
unusually_long_commandlines_filter.yml
macro ymls and detection update
2020-03-09 17:46:47 -07:00
wineventlog_security.yml
updating macros to use sourcetype
2019-12-18 17:49:09 -08:00
wmi_process_launch_filter.yml
macro ymls and detection update
2020-03-09 17:46:47 -07:00
wmi_script_execution_filter.yml
macro ymls and detection update
2020-03-09 17:46:47 -07:00