admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
v4.9.0
splunk-security_content/stories
T
History
Michael Haag a99eeef7d7 Ivanti CVE-2023-35082
2023-08-08 10:23:50 -06:00
..
deprecated
…
3cx_supply_chain_attack.yml
3CX - CVE-2023-29059
2023-03-31 12:07:36 -06:00
acidrain.yml
…
active_directory_discovery.yml
…
active_directory_kerberos_attacks.yml
…
active_directory_lateral_movement.yml
…
active_directory_password_spraying.yml
…
active_directory_privilege_escalation.yml
updating story narrative
2023-04-24 19:02:18 -04:00
agenttesla.yml
…
amadey.yml
encode fix
2023-06-22 16:54:50 -07:00
apache_struts_vulnerability.yml
…
asset_tracking.yml
…
asyncrat.yml
…
atlassian_confluence_server_and_data_center_cve_2022_26134.yml
…
awfulshred.yml
…
aws_cross_account_activity.yml
…
aws_defense_evasion.yml
…
aws_iam_privilege_escalation.yml
…
aws_identity_and_access_management_account_takeover.yml
…
aws_network_acl_activity.yml
…
aws_security_hub_alerts.yml
…
aws_user_monitoring.yml
…
azorult.yml
…
azure_active_directory_account_takeover.yml
…
azure_active_directory_persistence.yml
…
azure_active_directory_privilege_escalation.yml
Update azure_active_directory_privilege_escalation.yml
2023-05-15 14:38:58 -04:00
baron_samedit_cve_2021_3156.yml
…
bishopfox_sliver_adversary_emulation_framework.yml
…
bits_jobs.yml
…
blackbyte_ransomware.yml
Rename ransomware_blackbyte.yml to blackbyte_ransomware.yml
2023-07-11 14:56:00 -05:00
blacklotus_campaign.yml
HVCI Disable and story
2023-04-14 10:32:12 -06:00
brand_monitoring.yml
…
brute_ratel_c4.yml
…
caddywiper.yml
…
cisa_aa22_257a.yml
…
cisa_aa22_264a.yml
…
cisa_aa22_277a.yml
…
cisa_aa22_320a.yml
…
citrix_netscaler_adc_cve_2023_3519.yml
Add ref link to story and detection.
2023-07-21 15:13:31 -07:00
citrix_sharefile_rce_cve_2023_24489.yml
Update citrix_sharefile_rce_cve_2023_24489.yml
2023-07-26 12:49:55 -06:00
cloud_cryptomining.yml
…
cloud_federated_credential_abuse.yml
…
cobalt_strike.yml
…
coldroot_macos_rat.yml
…
collection_and_staging.yml
…
command_and_control.yml
…
compromised_user_account.yml
…
credential_dumping.yml
…
cve_2022_40684_fortinet_appliance_auth_bypass.yml
…
cve_2023_21716_word_rtf_heap_corruption.yml
Haag is Back 🎆
2023-03-10 06:21:30 -07:00
cve_2023_23397_outlook_elevation_of_privilege.yml
rename story
2023-03-21 15:52:17 -05:00
cve_2023_36884_office_and_windows_html_rce_vulnerability.yml
remove hyphen
2023-07-11 13:51:42 -06:00
cyclops_blink.yml
…
darkcrystal_rat.yml
…
data_destruction.yml
Update data_destruction.yml
2023-04-17 16:23:21 -07:00
data_exfiltration.yml
Update data_exfiltration.yml
2023-05-25 16:17:47 -07:00
data_protection.yml
…
deobfuscate_decode_files_or_information.yml
…
detect_zerologon_attack.yml
…
dev_sec_ops.yml
…
dhs_report_ta18_074a.yml
…
disabling_security_tools.yml
…
dns_amplification_attacks.yml
…
dns_hijacking.yml
…
domain_controller_impersonation_&_samaccountname_spoofing.yml
…
domain_trust_discovery.yml
…
doublezerodestructor.yml
…
dynamic_dns.yml
…
emotet_malware__dhs_report_ta18_201a_.yml
…
f5_big_ip_vulnerability_cve_2022_1388.yml
…
f5_tmui_rce_cve_2020_5902.yml
…
fin7.yml
…
fortinet_fortinac_cve_2022_39952.yml
…
gcp_account_takeover.yml
…
gcp_cross_account_activity.yml
…
graceful_wipe_out_attack.yml
Update graceful_wipe_out_attack.yml
2023-06-13 16:36:53 +02:00
hafnium_group.yml
…
hermeticwiper.yml
…
hidden_cobra_malware.yml
…
Icedid.yml
…
iis_components.yml
…
industroyer2.yml
…
information_sabotage.yml
…
ingress_tool_transfer.yml
…
insider_threat.yml
…
ivanti_epmm_remote_unauthenticated_access.yml
Ivanti CVE-2023-35082
2023-08-08 10:23:50 -06:00
jboss_vulnerability.yml
…
kubernetes_scanning_activity.yml
…
kubernetes_sensitive_object_access_activity.yml
…
linux_living_off_the_land.yml
…
linux_persistence_techniques.yml
…
linux_post_exploitation.yml
…
linux_privilege_escalation.yml
…
linux_rootkit.yml
…
living_off_the_land.yml
…
local_privilege_escalation_with_krbrelayup.yml
…
log4shell_cve_2021_44228.yml
…
malicious_powershell.yml
…
masquerading___rename_system_utilities.yml
…
metasploit.yml
…
meterpreter.yml
…
microsoft_mshtml_remote_code_execution_cve_2021_40444.yml
…
microsoft_support_diagnostic_tool_vulnerability_cve_2022_30190.yml
…
monitor_for_updates.yml
…
moveit_transfer_critical_vulnerability.yml
Update moveit_transfer_critical_vulnerability.yml
2023-07-11 09:46:03 -06:00
netsh_abuse.yml
…
network_discovery.yml
…
nobelium_group.yml
…
office_365_detections.yml
…
okta_mfa_exhaustion.yml
…
openssl_cve_2022_3602.yml
…
orangeworm_attack_group.yml
…
papercut_mf_ng_vulnerability.yml
appinspect error
2023-05-16 12:25:20 -07:00
petitpotam_ntlm_relay_on_active_directory_certificate_services.yml
…
possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.yml
…
printnightmare_cve_2021_34527.yml
…
prohibited_traffic_allowed_or_protocol_mismatch.yml
…
proxynotshell.yml
…
proxyshell.yml
…
qakbot.yml
…
ransomware_blackmatter.yml
…
ransomware_chaos.yml
…
ransomware_clop.yml
…
ransomware_cloud.yml
…
ransomware_darkside.yml
…
ransomware_lockbit.yml
…
ransomware_prestige.yml
…
ransomware_revil.yml
…
ransomware_ryuk.yml
…
ransomware_samsam.yml
…
ransomware.yml
…
redline.yml
do_not_step_on_the_redline
2023-04-25 16:47:38 +02:00
remcos.yml
…
reverse_network_proxy.yml
…
router_and_infrastructure_security.yml
…
sandworm_tools.yml
Update sandworm_tools.yml
2023-04-13 12:15:47 -06:00
scheduled_tasks.yml
new_line_backslash
2023-06-22 16:14:18 -07:00
signed_binary_proxy_execution_installutil.yml
…
silver_sparrow.yml
…
snake_malware.yml
Guardians of the Haag: A Cosmic Adventure
2023-05-11 13:34:18 -06:00
sneaky_active_directory_persistence_tricks.yml
…
spearphishing_attachments.yml
…
splunk_vulnerabilities.yml
…
spring4shell_cve_2022_22965.yml
…
sql_injection.yml
…
suspicious_aws_login_activities.yml
…
suspicious_aws_s3_activities.yml
updates and new searches
2023-04-28 15:16:46 -07:00
suspicious_aws_traffic.yml
…
suspicious_cloud_authentication_activities.yml
…
suspicious_cloud_instance_activities.yml
…
suspicious_cloud_provisioning_activities.yml
…
suspicious_cloud_user_activities.yml
…
suspicious_command_line_executions.yml
…
suspicious_compiled_html_activity.yml
…
suspicious_dns_traffic.yml
…
suspicious_emails.yml
…
suspicious_gcp_storage_activities.yml
…
suspicious_mshta_activity.yml
…
suspicious_okta_activity.yml
…
suspicious_regsvcs_regasm_activity.yml
…
suspicious_regsvr32_activity.yml
…
suspicious_rundll32_activity.yml
…
suspicious_windows_registry_activities.yml
…
suspicious_wmi_use.yml
…
suspicious_zoom_child_processes.yml
…
swiftslicer.yml
…
text4shell_cve_2022_42889.yml
…
trickbot.yml
…
trusted_developer_utilities_proxy_execution_msbuild.yml
…
trusted_developer_utilities_proxy_execution.yml
…
unusual_processes.yml
…
use_of_cleartext_protocols.yml
…
vmware_aria_operations_vrealize_cve_2023_20887.yml
Update vmware_aria_operations_vrealize_cve_2023_20887.yml
2023-06-21 13:34:39 -07:00
vmware_server_side_injection_and_privilege_escalation.yml
…
volt_typhoon.yml
Update volt_typhoon.yml
2023-05-25 18:01:02 -07:00
whispergate.yml
…
windows_bootkits.yml
Guardians of the Haag: A Cosmic Adventure
2023-05-11 13:34:18 -06:00
windows_certificate_services.yml
…
windows_defense_evasion_tactics.yml
…
windows_discovery_techniques.yml
…
windows_dns_sigred_cve_2020_1350.yml
…
windows_drivers.yml
…
windows_file_extension_and_association_abuse.yml
…
windows_log_manipulation.yml
…
windows_persistence_techniques.yml
…
windows_post_exploitation.yml
…
windows_privilege_escalation.yml
…
windows_registry_abuse.yml
…
windows_service_abuse.yml
…
windows_system_binary_proxy_execution_msiexec.yml
…
winter_vivern.yml
update
2023-04-13 11:10:02 -06:00
xmrig.yml
…