admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
v3.46.0
splunk-security_content/stories
T
History
pyth0n1c d963ff033c Branch was auto-updated.
2022-07-28 13:47:24 -07:00
..
deprecated
moving to deprecated
2022-07-20 17:52:11 -04:00
acidrain.yml
Update acidrain.yml
2022-04-12 12:22:58 +02:00
active_directory_discovery.yml
Refactored security content
2022-03-09 14:43:09 +01:00
active_directory_kerberos_attacks.yml
Refactored security content
2022-03-09 14:43:09 +01:00
active_directory_lateral_movement.yml
Refactored security content
2022-03-09 14:43:09 +01:00
active_directory_password_spraying.yml
Refactored security content
2022-03-09 14:43:09 +01:00
apache_struts_vulnerability.yml
updated stories
2021-07-21 12:26:15 +02:00
asset_tracking.yml
updated stories
2021-07-21 12:26:15 +02:00
atlassian_confluence_server_and_data_center_cve_2022_26134.yml
Fluent in Confluence
2022-06-03 21:29:00 -06:00
aws_cross_account_activity.yml
updated stories
2021-07-21 12:26:15 +02:00
aws_defense_evasion.yml
Updates
2022-07-28 12:07:05 -06:00
aws_iam_privilege_escalation.yml
Refactored security content
2022-03-09 14:43:09 +01:00
aws_network_acl_activity.yml
updated stories
2021-07-21 12:26:15 +02:00
aws_security_hub_alerts.yml
updated stories
2021-07-21 12:26:15 +02:00
aws_user_monitoring.yml
updated stories
2021-07-21 12:26:15 +02:00
azorult.yml
Update azorult.yml
2022-06-22 18:50:08 +02:00
azure_active_directory_account_takeover.yml
updating description
2022-07-14 16:55:46 -04:00
baron_samedit_cve_2021_3156.yml
updated stories
2021-07-21 12:26:15 +02:00
bits_jobs.yml
Refactored security content
2022-03-09 14:43:09 +01:00
brand_monitoring.yml
updated stories
2021-07-21 12:26:15 +02:00
caddywiper.yml
fixeddescription
2022-03-25 18:33:41 -07:00
cloud_cryptomining.yml
updated stories
2021-07-21 12:26:15 +02:00
cloud_federated_credential_abuse.yml
Refactored security content
2022-03-09 14:43:09 +01:00
cobalt_strike.yml
Refactored security content
2022-03-09 14:43:09 +01:00
coldroot_macos_rat.yml
updated stories
2021-07-21 12:26:15 +02:00
collection_and_staging.yml
updated stories
2021-07-21 12:26:15 +02:00
command_and_control.yml
updated stories
2021-07-21 12:26:15 +02:00
credential_dumping.yml
updated stories
2021-07-21 12:26:15 +02:00
cyclops_blink.yml
Update cyclops_blink.yml
2022-04-12 12:21:30 +02:00
darkcrystal_rat.yml
dcrat-analytics
2022-07-26 12:02:35 +02:00
data_destruction.yml
Update data_destruction.yml
2022-02-15 11:04:28 +01:00
data_exfiltration.yml
updated stories
2021-07-21 12:26:15 +02:00
data_protection.yml
updated stories
2021-07-21 12:26:15 +02:00
deobfuscate_decode_files_or_information.yml
Refactored security content
2022-03-09 14:43:09 +01:00
detect_zerologon_attack.yml
updated stories
2021-07-21 12:26:15 +02:00
dev_sec_ops.yml
Refactored security content
2022-03-09 14:43:09 +01:00
dhs_report_ta18_074a.yml
updated stories
2021-07-21 12:26:15 +02:00
disabling_security_tools.yml
Updating expired References in Stories
2022-07-18 16:53:04 -07:00
dns_amplification_attacks.yml
Refactored security content
2022-03-09 14:43:09 +01:00
dns_hijacking.yml
updated stories
2021-07-21 12:26:15 +02:00
domain_controller_impersonation_&_samaccountname_spoofing.yml
Refactored security content
2022-03-09 14:43:09 +01:00
domain_trust_discovery.yml
Refactored security content
2022-03-09 14:43:09 +01:00
doublezerodestructor.yml
fixeddz
2022-03-25 19:38:51 -07:00
dynamic_dns.yml
updated stories
2021-07-21 12:26:15 +02:00
emotet_malware__dhs_report_ta18_201a_.yml
updated stories
2021-07-21 12:26:15 +02:00
f5_big_ip_vulnerability_cve_2022_1388.yml
F5 BIG-IP
2022-05-10 07:20:46 -06:00
f5_tmui_rce_cve_2020_5902.yml
updated stories
2021-07-21 12:26:15 +02:00
fin7.yml
Refactored security content
2022-03-09 14:43:09 +01:00
gcp_cross_account_activity.yml
updated stories
2021-07-21 12:26:15 +02:00
hafnium_group.yml
Refactored security content
2022-03-09 14:43:09 +01:00
hermeticwiper.yml
fixeddatadestructiontagnewstories
2022-03-25 13:35:13 -07:00
hidden_cobra_malware.yml
Updating expired References in Stories
2022-07-18 16:53:04 -07:00
Icedid.yml
Refactored security content
2022-03-09 14:43:09 +01:00
industroyer2.yml
industroyer2
2022-04-25 09:36:55 +02:00
information_sabotage.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ingress_tool_transfer.yml
Refactored security content
2022-03-09 14:43:09 +01:00
insider_threat.yml
Removing nicer formatting
2022-05-20 16:24:56 -05:00
jboss_vulnerability.yml
updated stories
2021-07-21 12:26:15 +02:00
kubernetes_scanning_activity.yml
updated stories
2021-07-21 12:26:15 +02:00
kubernetes_sensitive_object_access_activity.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_living_off_the_land.yml
Analytic Stories + Tagging
2022-07-27 10:29:47 -06:00
linux_persistence_techniques.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_post_exploitation.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_privilege_escalation.yml
Refactored security content
2022-03-09 14:43:09 +01:00
linux_rootkit.yml
Analytic Stories + Tagging
2022-07-27 10:29:47 -06:00
living_off_the_land.yml
Capitalization is important
2022-03-28 09:55:37 -05:00
local_privilege_escalation_with_krbrelayup.yml
updating analytics story narrative
2022-04-28 18:46:05 -04:00
log4shell_cve_2021_44228.yml
Refactored security content
2022-03-09 14:43:09 +01:00
malicious_powershell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
masquerading___rename_system_utilities.yml
Refactored security content
2022-03-09 14:43:09 +01:00
meterpreter.yml
Refactored security content
2022-03-09 14:43:09 +01:00
microsoft_mshtml_remote_code_execution_cve_2021_40444.yml
Refactored security content
2022-03-09 14:43:09 +01:00
microsoft_support_diagnostic_tool_vulnerability_cve_2022_30190.yml
Complete Follina
2022-05-31 07:16:05 -06:00
monitor_for_updates.yml
updated stories
2021-07-21 12:26:15 +02:00
netsh_abuse.yml
Added caching of the results of link-verification to the --cached_and_offline argument. This means that if a link returns successfully and you run the tool again, the link won't be checked again. However, this means that if that cache sticks around for a long time, the link may actually stop returning but we won't continue checking it. Still, this makes it significantly easier to quickly find broken links, fix the broken links, and then run the tool again in a short period of time, only re-checking the broken links that have been fixed. This makes repairing and checking broken links a must faster workflow.
2022-05-10 17:08:24 -07:00
network_discovery.yml
linux_lolbin_stage1
2022-02-14 10:17:46 +01:00
nobelium_group.yml
Refactored security content
2022-03-09 14:43:09 +01:00
office_365_detections.yml
updated stories
2021-07-21 12:26:15 +02:00
orangeworm_attack_group.yml
updated stories
2021-07-21 12:26:15 +02:00
petitpotam_ntlm_relay_on_active_directory_certificate_services.yml
Refactored security content
2022-03-09 14:43:09 +01:00
possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.yml
updated stories
2021-07-21 12:26:15 +02:00
printnightmare_cve_2021_34527.yml
Refactored security content
2022-03-09 14:43:09 +01:00
prohibited_traffic_allowed_or_protocol_mismatch.yml
updated stories
2021-07-21 12:26:15 +02:00
proxyshell.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ransomware_blackmatter.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ransomware_clop.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ransomware_cloud.yml
updated stories
2021-07-21 12:26:15 +02:00
ransomware_darkside.yml
Updating link from Fireeye to Mandiant since links changed due to acquisition.
2022-07-19 10:06:50 -07:00
ransomware_revil.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ransomware_ryuk.yml
Refactored security content
2022-03-09 14:43:09 +01:00
ransomware_samsam.yml
updated stories
2021-07-21 12:26:15 +02:00
ransomware.yml
Added caching of the results of link-verification to the --cached_and_offline argument. This means that if a link returns successfully and you run the tool again, the link won't be checked again. However, this means that if that cache sticks around for a long time, the link may actually stop returning but we won't continue checking it. Still, this makes it significantly easier to quickly find broken links, fix the broken links, and then run the tool again in a short period of time, only re-checking the broken links that have been fixed. This makes repairing and checking broken links a must faster workflow.
2022-05-10 17:08:24 -07:00
remcos.yml
Refactored security content
2022-03-09 14:43:09 +01:00
router_and_infrastructure_security.yml
Added caching of the results of link-verification to the --cached_and_offline argument. This means that if a link returns successfully and you run the tool again, the link won't be checked again. However, this means that if that cache sticks around for a long time, the link may actually stop returning but we won't continue checking it. Still, this makes it significantly easier to quickly find broken links, fix the broken links, and then run the tool again in a short period of time, only re-checking the broken links that have been fixed. This makes repairing and checking broken links a must faster workflow.
2022-05-10 17:08:24 -07:00
signed_binary_proxy_execution_installutil.yml
Refactored security content
2022-03-09 14:43:09 +01:00
silver_sparrow.yml
Refactored security content
2022-03-09 14:43:09 +01:00
spearphishing_attachments.yml
updated stories
2021-07-21 12:26:15 +02:00
splunk_vulnerabilities.yml
Updated story
2022-05-02 10:25:04 -05:00
spring4shell_cve_2022_22965.yml
function and CVE-2022-22965 fixes
2022-04-05 15:36:38 -06:00
sql_injection.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_aws_login_activities.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_aws_s3_activities.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_aws_traffic.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_cloud_authentication_activities.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_cloud_instance_activities.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_cloud_provisioning_activities.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_cloud_user_activities.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_command_line_executions.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_compiled_html_activity.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_dns_traffic.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_emails.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_gcp_storage_activities.yml
Added caching of the results of link-verification to the --cached_and_offline argument. This means that if a link returns successfully and you run the tool again, the link won't be checked again. However, this means that if that cache sticks around for a long time, the link may actually stop returning but we won't continue checking it. Still, this makes it significantly easier to quickly find broken links, fix the broken links, and then run the tool again in a short period of time, only re-checking the broken links that have been fixed. This makes repairing and checking broken links a must faster workflow.
2022-05-10 17:08:24 -07:00
suspicious_mshta_activity.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_okta_activity.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_regsvcs_regasm_activity.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_regsvr32_activity.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_rundll32_activity.yml
Refactored security content
2022-03-09 14:43:09 +01:00
suspicious_windows_registry_activities.yml
updated stories
2021-07-21 12:26:15 +02:00
suspicious_wmi_use.yml
Added caching of the results of link-verification to the --cached_and_offline argument. This means that if a link returns successfully and you run the tool again, the link won't be checked again. However, this means that if that cache sticks around for a long time, the link may actually stop returning but we won't continue checking it. Still, this makes it significantly easier to quickly find broken links, fix the broken links, and then run the tool again in a short period of time, only re-checking the broken links that have been fixed. This makes repairing and checking broken links a must faster workflow.
2022-05-10 17:08:24 -07:00
suspicious_zoom_child_processes.yml
updated stories
2021-07-21 12:26:15 +02:00
trickbot.yml
Refactored security content
2022-03-09 14:43:09 +01:00
trusted_developer_utilities_proxy_execution_msbuild.yml
Refactored security content
2022-03-09 14:43:09 +01:00
trusted_developer_utilities_proxy_execution.yml
updated stories
2021-07-21 12:26:15 +02:00
unusual_processes.yml
Added caching of the results of link-verification to the --cached_and_offline argument. This means that if a link returns successfully and you run the tool again, the link won't be checked again. However, this means that if that cache sticks around for a long time, the link may actually stop returning but we won't continue checking it. Still, this makes it significantly easier to quickly find broken links, fix the broken links, and then run the tool again in a short period of time, only re-checking the broken links that have been fixed. This makes repairing and checking broken links a must faster workflow.
2022-05-10 17:08:24 -07:00
use_of_cleartext_protocols.yml
updated stories
2021-07-21 12:26:15 +02:00
vmware_server_side_injection_and_privilege_escalation.yml
Updated one broken reference link.
2022-06-23 15:02:26 -07:00
whispergate.yml
fixeddatadestructiontagnewstories
2022-03-25 13:35:13 -07:00
windows_defense_evasion_tactics.yml
updated stories
2021-07-21 12:26:15 +02:00
windows_discovery_techniques.yml
Refactored security content
2022-03-09 14:43:09 +01:00
windows_dns_sigred_cve_2020_1350.yml
updated stories
2021-07-21 12:26:15 +02:00
windows_drivers.yml
Update windows_drivers.yml
2022-05-31 07:43:57 -06:00
windows_file_extension_and_association_abuse.yml
updated stories
2021-07-21 12:26:15 +02:00
windows_log_manipulation.yml
updated stories
2021-07-21 12:26:15 +02:00
windows_persistence_techniques.yml
updated stories
2021-07-21 12:26:15 +02:00
windows_privilege_escalation.yml
updated stories
2021-07-21 12:26:15 +02:00
windows_registry_abuse.yml
add_story_and_minor_fix
2022-03-17 16:41:29 +01:00
windows_service_abuse.yml
updated stories
2021-07-21 12:26:15 +02:00
windows_system_binary_proxy_execution_msiexec.yml
T1218.007 - MSIExec
2022-06-17 09:36:34 -06:00
xmrig.yml
Refactored security content
2022-03-09 14:43:09 +01:00