splunk/security_content

Issues

• [BUG] browser_app_list lookup doesn't exist in indexers, causing query to fail in "Windows Credential Access From Browser Password Store"

  #3014 opened 16 days ago by iso-rgomez
  0

• [BUG] please, fix links in wiki: https://github.com/splunk/security_content/wiki/Detection-Analytic-Types

  #3011 opened 24 days ago by yaroslav-nakonechnikov
  1

• [BUG] Incorrect logic statement in detection search "Detect Renamed PSExec"

  #3009 opened a month ago by OberAlex
  0

• Add custom annotation for versioning

  #2907 opened 2 months ago by TheLawsOfChaos
  4

• [BUG] Missing Wildcards in Splunk Rule for Detecting Known Services Killed by Ransomware

  #2996 opened 2 months ago by shimonShouei
  0

• [BUG] Detections with joins failed to properly translate to Sigma

  #2987 opened 2 months ago by ajkingio
  0

• Minor malicious_powershell_process___encoded_command search update

  #2982 opened 3 months ago by SirDuckly
  0

• Azure AD Multi-Source Failed Authentications Spike - Missing ADFSSignInLogs category

  #2980 opened 3 months ago by atgithub11
  0

• Scheduled Task Initiation on Remote Endpoint - Update Analytics

  #2977 opened 3 months ago by Badoodish
  0

• [BUG] ESCU - Get ADUser with PowerShell - Rule has no Adaptive Reponse Actions

  #2965 opened 3 months ago by albertenc13
  3

• [BUG] DNS Query Length With High Standard Deviation

  #2958 opened 4 months ago by josehelps
  1

• [BUG] Datasource is set incorrectly on this detection

  #2962 opened 4 months ago by josehelps
  0

• [BUG] Windows Excessive Disabled Services Event uses ComputerName instead of src field (CIM issue)

  #2825 opened 4 months ago by iso-rgomez
  3

• [BUG] - Unknown Process Using The Kerberos Protocol is too noisy

  #2943 opened 4 months ago by wkleinhenz
  3

• Consider adding Scope for search Azure AD Tenant Wide Admin Consent Granted

  #2950 opened 4 months ago by atgithub11
  1

• [BUG] sourcetype macro not consistent across Azure AD correlations

  #2938 opened 4 months ago by atgithub11
  2

• [BUG] Build is not working

  #2948 opened 4 months ago by yaroslav-nakonechnikov
  6

• [BUG] ESCU - Detect Excessive Account Lockouts From Endpoint

  #2929 opened 6 months ago by githubonlyy
  3

• pre trained Deep Learning models for ESCU - Support for DSDL Version 5.1.1

  #2939 opened 5 months ago by atgithub11
  1

• [BUG] Linux Service Started Or Enabled triggering on Windows events

  #2944 opened 5 months ago by 0xC0FFEEEE
  2

• [BUG] O365 Mailbox Inbox Folder Shared with All Users. Field "object" doesn't exist.

  #2937 opened 5 months ago by atgithub11
  1

• CMD Carry Out String Command Parameter - false negatives due to trailing space before wildcard in search [BUG]

  #2928 opened 5 months ago by cxosmo
  2

• [BUG] "Kerberos TGT Request Using RC4 Encryption" using non-CIM field "Account_Name"

  #2920 opened 6 months ago by iso-rgomez
  1

• [BUG] Active_Directory_Disable_Account_Dispatch

  #2769 opened 5 months ago by kelby-shelton
  1

• Include `tags.atomic_guid` and `tags.required_fields` into ESCU

  #2904 opened 7 months ago by ccl0utier
  0

• [BUG] System Processes Run From Unexpected Locations - missing field for Risk Message

  #2871 opened 5 months ago by ccl0utier
  2

• [BUG] ESCU CS fields LogonType and TargetUserName

  #2869 opened 8 months ago by cp-sn
  3

• [BUG] VirusTotal v3 Identifier Reputation Playbook failing with math domain error

  #2772 opened 5 months ago by gdollasigns
  2

• Build constraints based on tags

  #2767 opened 5 months ago by schimpy
  1

• [Feature Req] MITRE ATT&CK IDs are not versioned in published content

  #2758 opened 5 months ago by alexhaydock
  1

• [BUG] Broken link and missing instructions for producing MITRE Navigator map

  #2757 opened 5 months ago by alexhaydock
  1

• [BUG] Unable to overwrite default lookup with custom lookup in macro dynamic_dns_providers

  #2709 opened 5 months ago by vvlier
  1

• kubernetes detections to be ported to opentelemetry output because of EOS of sc4k

  #2679 opened a year ago by hhgsplk
  1

• [BUG] - Build Failing Everytime

  #2894 opened 7 months ago by abhinavkakku
  4

• [BUG]

  #2892 opened 7 months ago by cp-sn
  1

• [BUG] Azure AD Authentication Failed During MFA Challenge - Rename userPrincipalName field

  #2685 opened 8 months ago by cp-sn
  1

• Improve performance of pretrained DGA model

  #2744 opened 8 months ago by dglauche
  2

• [BUG] artifact_update custom function fails if cef_value passed is 0

  #2821 opened 10 months ago by ianwills-splunk
  0

• [BUG] False positive in rule "Suspicious Copy on System32"

  #2805 opened 10 months ago by iso-rgomez
  2

• [BUG] `Unusually Long Command Line` Detection has incorrect Risk Message and Threat Object

  #2806 opened 10 months ago by ccl0utier
  1

• When trying to build attack range I get the following error 'No module named 'azure.mgmt.resource'[BUG]

  #2762 opened 10 months ago by Cybertooth34
  1

• [BUG] Splunk Attack Analyzer Input Playbok

  #2755 opened 10 months ago by kelby-shelton
  1

• Apparent improper logic in Okta Verify Push detection

  #2644 opened a year ago by SethHanford
  2

• Hi All, I am facing an issue when trying to configure the attack range locally.... The error I am getting is 'configuration.py, line 150, answers = questionary.prompt(questions) NameError: name 'questionary' is not defined. Did you mean: 'questions''... I cant find any answers online from people having the same issue.[BUG]

  #2761 opened a year ago by Cybertooth34
  1

• [BUG] Rule ESCU - Windows Vulnerable Driver Loaded - Rule fails to run

  #2631 opened a year ago by ccl0utier
  1

• [BUG] Rule ESCU - Windows AD Rogue Domain Controller Network Activity - Rule fails to run

  #2630 opened a year ago by ccl0utier
  1

• [BUG] Rule ESCU - Windows AD Replication Service Traffic - Rule fails to run

  #2628 opened a year ago by ccl0utier
  1

• [BUG] Rule ESCU - Windows AD Privileged Account SID History Addition - Rule fails to run

  #2627 opened a year ago by ccl0utier
  1

• [BUG] ESCU - Windows AD Domain Replication ACL Addition - Rule fails to run

  #2626 opened a year ago by ccl0utier
  1

• [BUG] ESCU - Prohibited Software On Endpoint - Rule

  #2624 opened a year ago by ccl0utier
  2