admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
v3.37.0
splunk-security_content/stories
T
History
Lou Stella 41b3c74785 Migrated old detections to new story
2022-03-28 13:23:02 -05:00
..
deprecated
Migrated old detections to new story
2022-03-28 13:23:02 -05:00
active_directory_discovery.yml
Refactored security content
2022-03-09 14:43:09 +01:00
active_directory_kerberos_attacks.yml
Refactored security content
2022-03-09 14:43:09 +01:00
active_directory_lateral_movement.yml
Refactored security content
2022-03-09 14:43:09 +01:00
active_directory_password_spraying.yml
Refactored security content
2022-03-09 14:43:09 +01:00
apache_struts_vulnerability.yml
updated stories
2021-07-21 12:26:15 +02:00
asset_tracking.yml
updated stories
2021-07-21 12:26:15 +02:00
aws_cross_account_activity.yml
updated stories
2021-07-21 12:26:15 +02:00
aws_iam_privilege_escalation.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_network_acl_activity.yml
updated stories
2021-07-21 12:26:15 +02:00
aws_security_hub_alerts.yml
updated stories
2021-07-21 12:26:15 +02:00
aws_user_monitoring.yml
updated stories
2021-07-21 12:26:15 +02:00
baron_samedit_cve_2021_3156.yml
updated stories
2021-07-21 12:26:15 +02:00
bits_jobs.yml
Refactored security content
2022-03-09 14:43:09 +01:00
brand_monitoring.yml
updated stories
2021-07-21 12:26:15 +02:00
caddywiper.yml
fixeddescription
2022-03-25 18:33:41 -07:00
cloud_cryptomining.yml
updated stories
2021-07-21 12:26:15 +02:00
cloud_federated_credential_abuse.yml
Refactored security content
2022-03-09 14:43:09 +01:00
cobalt_strike.yml
Refactored security content
2022-03-09 14:43:09 +01:00
coldroot_macos_rat.yml
updated stories
2021-07-21 12:26:15 +02:00
collection_and_staging.yml
updated stories
2021-07-21 12:26:15 +02:00
command_and_control.yml
updated stories
2021-07-21 12:26:15 +02:00
container_implantation_monitoring_and_investigation.yml
updated stories
2021-07-21 12:26:15 +02:00
credential_dumping.yml
updated stories
2021-07-21 12:26:15 +02:00
data_destruction.yml
Update data_destruction.yml
2022-02-15 11:04:28 +01:00
data_exfiltration.yml
updated stories
2021-07-21 12:26:15 +02:00
data_protection.yml
updated stories
2021-07-21 12:26:15 +02:00
deobfuscate_decode_files_or_information.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_zerologon_attack.yml
updated stories
2021-07-21 12:26:15 +02:00
dev_sec_ops.yml
Refactored security content
2022-03-09 14:43:09 +01:00
dhs_report_ta18_074a.yml
updated stories
2021-07-21 12:26:15 +02:00
disabling_security_tools.yml
updated stories
2021-07-21 12:26:15 +02:00
dns_amplification_attacks.yml
Refactored security content
2022-03-09 14:43:09 +01:00
dns_hijacking.yml
updated stories
2021-07-21 12:26:15 +02:00
domain_controller_impersonation_&_samaccountname_spoofing.yml
Refactored security content
2022-03-09 14:43:09 +01:00
domain_trust_discovery.yml
Refactored security content
2022-03-09 14:43:09 +01:00
doublezerodestructor.yml
fixeddz
2022-03-25 19:38:51 -07:00
dynamic_dns.yml
updated stories
2021-07-21 12:26:15 +02:00
emotet_malware__dhs_report_ta18_201a_.yml
updated stories
2021-07-21 12:26:15 +02:00
f5_tmui_rce_cve_2020_5902.yml
updated stories
2021-07-21 12:26:15 +02:00
fin7.yml
Refactored security content
2022-03-09 14:43:09 +01:00
gcp_cross_account_activity.yml
updated stories
2021-07-21 12:26:15 +02:00
hafnium_group.yml
Refactored security content
2022-03-09 14:43:09 +01:00
hermeticwiper.yml
fixeddatadestructiontagnewstories
2022-03-25 13:35:13 -07:00
hidden_cobra_malware.yml
updated stories
2021-07-21 12:26:15 +02:00
Icedid.yml
Refactored security content
2022-03-09 14:43:09 +01:00
information_sabotage.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ingress_tool_transfer.yml
Refactored security content
2022-03-09 14:43:09 +01:00
jboss_vulnerability.yml
updated stories
2021-07-21 12:26:15 +02:00
kubernetes_scanning_activity.yml
updated stories
2021-07-21 12:26:15 +02:00
kubernetes_sensitive_object_access_activity.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_persistence_techniques.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_post_exploitation.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_privilege_escalation.yml
Refactored security content
2022-03-09 14:43:09 +01:00
living_off_the_land.yml
Capitalization is important
2022-03-28 09:55:37 -05:00
log4shell_cve_2021_44228.yml
Refactored security content
2022-03-09 14:43:09 +01:00
malicious_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
masquerading___rename_system_utilities.yml
Refactored security content
2022-03-09 14:43:09 +01:00
meterpreter.yml
Refactored security content
2022-03-09 14:43:09 +01:00
microsoft_mshtml_remote_code_execution_cve_2021_40444.yml
Refactored security content
2022-03-09 14:43:09 +01:00
monitor_for_updates.yml
updated stories
2021-07-21 12:26:15 +02:00
netsh_abuse.yml
updated stories
2021-07-21 12:26:15 +02:00
network_discovery.yml
linux_lolbin_stage1
2022-02-14 10:17:46 +01:00
nobelium_group.yml
Refactored security content
2022-03-09 14:43:09 +01:00
office_365_detections.yml
updated stories
2021-07-21 12:26:15 +02:00
orangeworm_attack_group.yml
updated stories
2021-07-21 12:26:15 +02:00
petitpotam_ntlm_relay_on_active_directory_certificate_services.yml
Refactored security content
2022-03-09 14:43:09 +01:00
possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.yml
updated stories
2021-07-21 12:26:15 +02:00
printnightmare_cve_2021_34527.yml
Refactored security content
2022-03-09 14:43:09 +01:00
prohibited_traffic_allowed_or_protocol_mismatch.yml
updated stories
2021-07-21 12:26:15 +02:00
proxyshell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ransomware_blackmatter.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ransomware_clop.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ransomware_cloud.yml
updated stories
2021-07-21 12:26:15 +02:00
ransomware_darkside.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ransomware_revil.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ransomware_ryuk.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ransomware_samsam.yml
updated stories
2021-07-21 12:26:15 +02:00
ransomware.yml
updated stories
2021-07-21 12:26:15 +02:00
remcos.yml
Refactored security content
2022-03-09 14:43:09 +01:00
router_and_infrastructure_security.yml
updated stories
2021-07-21 12:26:15 +02:00
signed_binary_proxy_execution_installutil.yml
Refactored security content
2022-03-09 14:43:09 +01:00
silver_sparrow.yml
Refactored security content
2022-03-09 14:43:09 +01:00
spearphishing_attachments.yml
updated stories
2021-07-21 12:26:15 +02:00
splunk_vulnerabilities.yml
Updated story
2022-03-28 09:55:06 -05:00
sql_injection.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_aws_login_activities.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_aws_s3_activities.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_aws_traffic.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_cloud_authentication_activities.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_cloud_instance_activities.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_cloud_provisioning_activities.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_cloud_user_activities.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_command_line_executions.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_compiled_html_activity.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_dns_traffic.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_emails.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_gcp_storage_activities.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_mshta_activity.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_okta_activity.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_regsvcs_regasm_activity.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_regsvr32_activity.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_rundll32_activity.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_windows_registry_activities.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_wmi_use.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_zoom_child_processes.yml
updated stories
2021-07-21 12:26:15 +02:00
trickbot.yml
Refactored security content
2022-03-09 14:43:09 +01:00
trusted_developer_utilities_proxy_execution_msbuild.yml
Refactored security content
2022-03-09 14:43:09 +01:00
trusted_developer_utilities_proxy_execution.yml
updated stories
2021-07-21 12:26:15 +02:00
unusual_processes.yml
updated stories
2021-07-21 12:26:15 +02:00
use_of_cleartext_protocols.yml
updated stories
2021-07-21 12:26:15 +02:00
whispergate.yml
fixeddatadestructiontagnewstories
2022-03-25 13:35:13 -07:00
windows_defense_evasion_tactics.yml
updated stories
2021-07-21 12:26:15 +02:00
windows_discovery_techniques.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_dns_sigred_cve_2020_1350.yml
updated stories
2021-07-21 12:26:15 +02:00
windows_file_extension_and_association_abuse.yml
updated stories
2021-07-21 12:26:15 +02:00
windows_log_manipulation.yml
updated stories
2021-07-21 12:26:15 +02:00
windows_persistence_techniques.yml
updated stories
2021-07-21 12:26:15 +02:00
windows_privilege_escalation.yml
updated stories
2021-07-21 12:26:15 +02:00
windows_registry_abuse.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
windows_service_abuse.yml
updated stories
2021-07-21 12:26:15 +02:00
xmrig.yml
Refactored security content
2022-03-09 14:43:09 +01:00