admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
v3.34.4
splunk-security_content/detections/deprecated
T
History
mhaag-spl e8dd9051bc pkexec 
Deprecating two detections that identified all rundll32 executions.
Added linux pkexec pwnkit detection.
2022-02-01 09:52:52 -07:00
..
.gitkeep
detection tests
2020-11-03 17:04:53 +01:00
abnormally_high_aws_instances_launched_by_user___mltk.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
abnormally_high_aws_instances_launched_by_user.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
abnormally_high_aws_instances_terminated_by_user___mltk.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
abnormally_high_aws_instances_terminated_by_user.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
add_prohibited_processes_to_enterprise_security.yml
updating docs and package bits [ci skip]
2021-08-18 16:56:31 +00:00
aws_cloud_provisioning_from_previously_unseen_city.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
aws_cloud_provisioning_from_previously_unseen_country.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
aws_cloud_provisioning_from_previously_unseen_ip_address.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
aws_cloud_provisioning_from_previously_unseen_region.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
baseline_of_api_calls_per_user_arn.yml
deprecate
2021-09-15 13:13:38 -07:00
baseline_of_excessive_aws_instances_launched_by_user___mltk.yml
deprecate
2021-09-15 13:13:38 -07:00
baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml
deprecate
2021-09-15 13:13:38 -07:00
clients_connecting_to_multiple_dns_servers.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
cloud_network_access_control_list_deleted.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
detect_api_activity_from_users_without_mfa.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
detect_aws_api_activities_from_unapproved_accounts.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
detect_long_dns_txt_record_response.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
detect_mimikatz_via_powershell_and_eventcode_4703.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
detect_new_api_calls_from_user_roles.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
detect_new_user_aws_console_login.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
detect_spike_in_aws_api_activity.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
detect_spike_in_network_acl_activity.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
detect_spike_in_security_group_activity.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
detect_usb_device_insertion.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
detect_web_traffic_to_dynamic_domain_providers.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
detection_of_dns_tunnels.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
dns_query_requests_resolved_by_unauthorized_dns_servers.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
dns_record_changed.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
dump_lsass_via_procdump_rename.yml
fixes
2021-09-16 12:14:26 -06:00
ec2_instance_modified_with_previously_unseen_user.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
ec2_instance_started_in_previously_unseen_region.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
ec2_instance_started_with_previously_unseen_ami.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
ec2_instance_started_with_previously_unseen_instance_type.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
ec2_instance_started_with_previously_unseen_user.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
execution_of_file_with_spaces_before_extension.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
extended_period_without_successful_netbackup_backups.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
first_time_seen_command_line_argument.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
gcp_detect_accounts_with_high_risk_roles_by_project.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
gcp_detect_high_risk_permissions_by_resource_and_account.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
gcp_detect_oauth_token_abuse.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
gcp_gcr_container_uploaded.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
gcp_kubernetes_cluster_scan_detection.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
identify_new_user_accounts.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
kubernetes_aws_detect_most_active_service_accounts_by_pod.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
kubernetes_aws_detect_rbac_authorizations_by_account.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
kubernetes_aws_detect_sensitive_object_access.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
kubernetes_aws_detect_sensitive_role_access.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
kubernetes_azure_detect_rbac_authorization_by_account.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
kubernetes_azure_detect_sensitive_object_access.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
kubernetes_azure_detect_sensitive_role_access.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
kubernetes_azure_detect_suspicious_kubectl_calls.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
kubernetes_azure_pod_scan_fingerprint.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
kubernetes_azure_scan_fingerprint.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
kubernetes_gcp_detect_RBAC_authorizations_by_account.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
kubernetes_gcp_detect_sensitive_object_access.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
kubernetes_gcp_detect_sensitive_role_access.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
kubernetes_gcp_detect_suspicious_kubectl_calls.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
malicious_powershell_process___multiple_suspicious_command_line_arguments.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
monitor_dns_for_brand_abuse.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
open_redirect_in_splunk_web.yml
updating docs and package bits [ci skip]
2021-10-28 19:55:37 +00:00
osquery_pack___coldroot_detection.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
previously_seen_api_call_per_user_roles_in_cloudtrail.yml
deprecate
2021-09-15 13:13:38 -07:00
previously_seen_aws_provisioning_activity_sources.yml
deprecate
2021-09-15 13:13:38 -07:00
previously_seen_ec2_amis.yml
deprecate
2021-09-15 13:13:38 -07:00
previously_seen_ec2_instance_types.yml
deprecate
2021-09-15 13:13:38 -07:00
previously_seen_ec2_launches_by_user.yml
deprecate
2021-09-15 13:13:38 -07:00
previously_seen_users_in_cloudtrail.yml
deprecate
2021-09-15 13:13:38 -07:00
processes_created_by_netsh.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
prohibited_software_on_endpoint.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
reg_exe_used_to_hide_files_directories_via_registry_keys.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
remote_registry_key_modifications.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
rundll_loading_dll_by_ordinal.yml
pkexec
2022-02-01 09:52:52 -07:00
scheduled_tasks_used_in_badrabbit_ransomware.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
spectre_and_meltdown_vulnerable_systems.yml
updating docs and package bits [ci skip]
2021-10-28 19:55:37 +00:00
splunk_enterprise_information_disclosure.yml
updating docs and package bits [ci skip]
2021-10-28 19:55:37 +00:00
ssa___applying_stolen_credentials_via_mimikatz_modules.yml
updating docs and package bits [ci skip]
2021-12-15 02:58:27 +00:00
ssa___applying_stolen_credentials_via_powersploit_modules.yml
updating docs and package bits [ci skip]
2021-12-15 02:58:27 +00:00
ssa___assess_credential_strength_via_dsinternals_modules.yml
updating docs and package bits [ci skip]
2021-12-15 02:58:27 +00:00
ssa___credential_extraction_dsinternals_conversion_modules.yml
updating docs and package bits [ci skip]
2021-12-15 02:58:27 +00:00
ssa___credential_extraction_dsinternals_modules.yml
updating docs and package bits [ci skip]
2021-12-15 02:58:27 +00:00
ssa___credential_extraction_fgdump_cachedump_s_option.yml
updating docs and package bits [ci skip]
2021-12-15 02:58:27 +00:00
ssa___credential_extraction_fgdump_cachedump_v_option.yml
updating docs and package bits [ci skip]
2021-12-15 02:58:27 +00:00
ssa___credential_extraction_getaddbaccount_from_dump.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___credential_extraction_lazagne_command_options.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___credential_extraction_mimikatz_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___credential_extraction_ms_debuggers_kernel_peek.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___credential_extraction_ms_debuggers_z_option.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___credential_extraction_powersploit_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___detect_pass_hash.yml
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
ssa___illegal_access_user_content_via_powersploit_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___illegal_account_creation_via_powersploit_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___illegal_log_deletion_via_mimikatz_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___illegal_service_and_process_control_via_powersploit_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___recon_and_use_computers_via_mimikatz_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___recon_and_use_shares_via_mimikatz_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___recon_and_use_shares_via_powersploit_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___recon_connectivity_via_powersploit_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___recon_defensive_tools_via_powersploit_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___recon_processes_and_services_via_mimikatz_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___setting_credentials_via_dsinternals_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___setting_credentials_via_mimikatz_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___setting_credentials_via_powersploit_modules.yml
A Nightmare on Haag Street
2021-12-03 05:57:54 -07:00
ssa___unusually_long_command_line.yml
moved detections to deprecated
2022-01-10 18:11:10 -05:00
suspicious_changes_to_file_associations.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
suspicious_email___uba_anomaly.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
suspicious_file_write.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
suspicious_rundll32_rename.yml
pkexec
2022-02-01 09:52:52 -07:00
suspicious_writes_to_system_volume_information.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
uncommon_processes_on_endpoint.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
unsigned_image_loaded_by_lsass.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
unsuccessful_netbackup_backups.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
update_previously_seen_users_in_cloudtrail.yml
deprecate
2021-09-15 13:13:38 -07:00
web_fraud___account_harvesting.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
web_fraud___anomalous_user_clickspeed.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
web_fraud___password_sharing_across_accounts.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
windows_connhost_exe_force_flag.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00
windows_hosts_file_modification.yml
add analytic types to detections
2021-07-19 16:49:33 +02:00