admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
v3.34.3
splunk-security_content/lookups
T
History
Bhavin Patel 14c145c133 Merge pull request #1953 from splunk/potentially_malicious_code_on_commandline 
Potentially malicious code on commandline
2022-01-28 13:27:59 -08:00
..
__mlspl_unusual_commandline_detection.mlmodel
Updating mlmodel to 5.3.x specification as well as the test apparatus
2022-01-25 21:42:16 -05:00
__mlspl_unusual_commandline_detection.yml
Update __mlspl_unusual_commandline_detection.yml
2022-01-26 11:26:25 -07:00
api_call_by_user_baseline.yml
Update api_call_by_user_baseline.yml
2020-08-18 15:28:54 -07:00
attacker_tools.csv
DefaultAccount
2021-11-15 14:30:14 -07:00
attacker_tools.yml
lookup definitions
2021-07-12 19:02:32 -05:00
aws_service_accounts.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
aws_service_accounts.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
baseline_blocked_outbound_connections.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
baseline_blocked_outbound_connections.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
brand_monitoring.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
brandMonitoring_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
cloud_instances_enough_data.yml
Updated search for abnormally high cloud instances. Including
2020-08-25 22:28:59 -05:00
csc_lookup.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
csc_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
discovered_dns_records.csv
app inspect failures fixes
2020-12-08 14:56:39 -08:00
discovered_dns_records.yml
updated fields and added macros and lookup entries
2020-01-19 21:37:45 -05:00
domains.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
domains.yml
More language clean up
2021-01-22 09:34:33 -06:00
dynamic_dns_providers_default.csv
add additional dynamic domains
2020-10-13 12:44:52 -04:00
dynamic_dns_providers_default.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
dynamic_dns_providers_local.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
dynamic_dns_providers_local.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
escu_search_id_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
escu_search_id.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
images_to_repository.csv
updated detections
2021-09-06 10:59:00 +02:00
images_to_repository.yml
updated detections
2021-09-06 10:59:00 +02:00
is_net_windows_file.csv
InstallUtil and DotNet Assemblies
2022-01-20 14:34:04 -07:00
is_net_windows_file.yml
InstallUtil and DotNet Assemblies
2022-01-20 14:34:04 -07:00
is_nirsoft_software.csv
Nirsoft Software
2022-01-24 15:07:20 -07:00
is_nirsoft_software.yml
Nirsoft Software
2022-01-24 15:07:20 -07:00
is_suspicious_file_extension_lookup.csv
add additional suspicious file extensions
2020-11-18 16:19:11 -05:00
is_suspicious_file_extension_lookup.yml
changed the file name of the .csv file and updated the associated yml file
2020-02-05 16:27:57 -07:00
is_windows_system_file.csv
Masquerading - detections + analytic story
2021-04-26 13:38:52 -06:00
is_windows_system_file.yml
InstallUtil and DotNet Assemblies
2022-01-20 14:34:04 -07:00
legit_domains.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
legit_domains.yml
More language clean up
2021-01-22 09:34:33 -06:00
local_file_inclusion_paths.csv
new detection
2021-08-23 13:07:23 +02:00
local_file_inclusion_paths.yml
new detection
2021-08-23 10:21:21 +02:00
lookup_rare_process_allow_list_default.yml
More language clean up
2021-01-22 09:34:33 -06:00
lookup_rare_process_allow_list_local.yml
More language clean up
2021-01-22 09:34:33 -06:00
lookup_uncommon_processes_default.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
lookup_uncommon_processes_local.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
mandatory_job_for_workflow.csv
circle ci detecction
2021-09-02 10:42:01 +02:00
mandatory_job_for_workflow.yml
circle ci detecction
2021-09-02 10:42:01 +02:00
mandatory_step_for_job.csv
circle ci detecction
2021-09-01 17:54:38 +02:00
mandatory_step_for_job.yml
circle ci detecction
2021-09-01 17:54:38 +02:00
mitre_enrichment.csv
bug fix generate script
2020-07-21 10:12:58 +02:00
network_acl_activity_baseline.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
network_acl_activity_baseline.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_api_calls_from_user_roles.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_api_calls_from_user_roles.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_aws_cross_account_activity.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_aws_cross_account_activity.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_aws_regions.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_aws_regions.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_cloud_api_calls_per_user_role.yml
Added needed macros and lookups
2020-09-04 09:26:10 -05:00
previously_seen_cloud_compute_creations_by_user.yml
convert to kvstore and spl updates
2020-10-12 12:14:50 -07:00
previously_seen_cloud_compute_images.yml
convert to kvstore and spl updates
2020-10-12 12:14:50 -07:00
previously_seen_cloud_compute_instance_types.yml
spl updates and kvstore file
2020-10-12 11:49:37 -07:00
previously_seen_cloud_instance_modifications_by_user.yml
updating macro fields
2020-11-16 17:22:29 -08:00
previously_seen_cloud_provisioning_activity_sources.yml
Added needed macros and lookups
2020-09-04 09:26:10 -05:00
previously_seen_cloud_regions.yml
lookup errors and consistency
2020-10-12 11:26:57 -07:00
previously_seen_cmd_line_arguments.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_cmd_line_arguments.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_ec2_modifications_by_user.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_ec2_modifications_by_user.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_gcp_storage_access_from_remote_ip.csv
adding lookup files
2022-01-26 15:34:10 -08:00
previously_seen_gcp_storage_access_from_remote_ip.yml
adding lookup files
2022-01-26 15:34:10 -08:00
previously_seen_running_windows_services.yml
Changed running windows service to use kvstore as cache
2020-06-26 08:27:39 -05:00
previously_seen_S3_access_from_remote_ip.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
previously_seen_S3_access_from_remote_ip.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
previously_seen_users_console_logins.yml
creating collections and search updates
2020-09-30 11:25:37 -07:00
prohibited_apps_launching_cmd.csv
converted to spec3 and other updates
2020-05-28 13:31:49 -07:00
prohibited_apps_launching_cmd.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
prohibited_processes.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
prohibited_processes.yml
fix_bugs
2020-12-11 10:51:02 +01:00
prohibited_softwares.csv
fix_bugs
2020-12-11 10:51:02 +01:00
prohibited_softwares.yml
adding the lost lookup file
2020-12-15 18:30:54 -08:00
ransomware_extensions_lookup.yml
JSWorm ransomware notes and extensions added.
2021-06-02 16:26:02 +05:30
ransomware_extensions.csv
duplicate
2022-01-20 15:50:28 -08:00
ransomware_notes_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
ransomware_notes.csv
duplicate
2022-01-20 15:50:28 -08:00
rare_process_allow_list_default.csv
fixing error reported by user
2021-02-16 09:45:00 -05:00
rare_process_allow_list_local.csv
fixing error reported by user
2021-02-16 09:45:00 -05:00
s3_deletion_baseline.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
s3_deletion_baseline.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
security_group_activity_baseline.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
security_group_activity_baseline.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
security_services_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
security_services.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
suspicious_files.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
suspicious_writes_lookup.yml
Changed json to yml
2019-10-16 16:38:05 +02:00
uncommon_processes_default.csv
Updated macro definition in detections, investigations, and baselines to just be a list
2019-09-30 13:53:25 -07:00
uncommon_processes_local.csv
Added lookup files that weren't there
2019-09-30 16:07:44 -07:00
zoom_first_time_child_process.yml
converted to spec3 and other updates
2020-05-28 13:31:49 -07:00