Merge branch 'data_source_improvements_2' of github.com:splunk/security_content into data_source_improvements_2

Patrick Bareiss · Patrick Bareiss · commit d03cb6268681 · 2025-02-18T09:13:25.000+01:00
diff --git a/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml b/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml
@@ -1,6 +1,6 @@
 name: Detect web traffic to dynamic domain providers
 id: 134da869-e264-4a8f-8d7e-fcd01c18f301
-version: 5
+version: 6
 date: '2024-11-14'
 author: Bhavin Patel, Splunk
 status: deprecated
diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml
@@ -1,6 +1,6 @@
 name: Allow Operation with Consent Admin
 id: 7de17d7a-c9d8-11eb-a812-acde48001122
-version: 8
+version: 9
 date: '2024-12-08'
 author: Teoderick Contreras, Splunk, Steven Dick
 status: production
diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml
@@ -1,6 +1,6 @@
 name: Disable Security Logs Using MiniNt Registry
 id: 39ebdc68-25b9-11ec-aec7-acde48001122
-version: 8
+version: 9
 date: '2024-12-08'
 author: Teoderick Contreras, Splunk, Steven Dick
 status: production
diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml
@@ -1,6 +1,6 @@
 name: Disabling SystemRestore In Registry
 id: f4f837e2-91fb-11eb-8bf6-acde48001122
-version: 9
+version: 10
 date: '2024-12-08'
 author: Teoderick Contreras, Splunk, Steven Dick
 status: production
diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml
@@ -1,6 +1,6 @@
 name: Enable RDP In Other Port Number
 id: 99495452-b899-11eb-96dc-acde48001122
-version: 9
+version: 10
 date: '2024-12-16'
 author: Teoderick Contreras, Splunk, Steven Dick
 status: production
diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml
@@ -1,6 +1,6 @@
 name: Enable WDigest UseLogonCredential Registry
 id: 0c7d8ffe-25b1-11ec-9f39-acde48001122
-version: 8
+version: 9
 date: '2024-12-08'
 author: Teoderick Contreras, Splunk, Steven Dick
 status: production
diff --git a/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml b/detections/endpoint/windows_autostart_execution_lsass_driver_registry_modification.yml
@@ -1,6 +1,6 @@
 name: Windows Autostart Execution LSASS Driver Registry Modification
 id: 57fb8656-141e-4d8a-9f51-62cff4ecb82a
-version: 4
+version: 5
 date: '2024-11-13'
 author: Michael Haag, Splunk
 status: production
diff --git a/detections/endpoint/windows_disable_change_password_through_registry.yml b/detections/endpoint/windows_disable_change_password_through_registry.yml
@@ -1,6 +1,6 @@
 name: Windows Disable Change Password Through Registry
 id: 0df33e1a-9ef6-11ec-a1ad-acde48001122
-version: 7
+version: 8
 date: '2024-12-08'
 author: Teoderick Contreras, Splunk, Steven Dick
 status: production
diff --git a/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml b/detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml
@@ -1,6 +1,6 @@
 name: Windows Disable Lock Workstation Feature Through Registry
 id: c82adbc6-9f00-11ec-a81f-acde48001122
-version: 7
+version: 8
 date: '2024-12-08'
 author: Teoderick Contreras, Splunk, Steven Dick
 status: production
diff --git a/detections/endpoint/windows_disable_logoff_button_through_registry.yml b/detections/endpoint/windows_disable_logoff_button_through_registry.yml
@@ -1,6 +1,6 @@
 name: Windows Disable LogOff Button Through Registry
 id: b2fb6830-9ed1-11ec-9fcb-acde48001122
-version: 7
+version: 8
 date: '2024-12-08'
 author: Teoderick Contreras, Splunk, Steven Dick
 status: production
diff --git a/detections/endpoint/windows_disable_notification_center.yml b/detections/endpoint/windows_disable_notification_center.yml
@@ -1,6 +1,6 @@
 name: Windows Disable Notification Center
 id: 1cd983c8-8fd6-11ec-a09d-acde48001122
-version: 7
+version: 8
 date: '2024-12-08'
 author: Teoderick Contreras, Splunk, Steven Dick
 status: production
diff --git a/detections/endpoint/windows_disable_shutdown_button_through_registry.yml b/detections/endpoint/windows_disable_shutdown_button_through_registry.yml
@@ -1,6 +1,6 @@
 name: Windows Disable Shutdown Button Through Registry
 id: 55fb2958-9ecd-11ec-a06a-acde48001122
-version: 7
+version: 8
 date: '2024-12-08'
 author: Teoderick Contreras, Splunk, Steven Dick
 status: production
diff --git a/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml b/detections/endpoint/windows_disable_windows_group_policy_features_through_registry.yml
@@ -1,6 +1,6 @@
 name: Windows Disable Windows Group Policy Features Through Registry
 id: 63a449ae-9f04-11ec-945e-acde48001122
-version: 8
+version: 9
 date: '2024-12-16'
 author: Steven Dick, Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_enable_win32_scheduledjob_via_registry.yml b/detections/endpoint/windows_enable_win32_scheduledjob_via_registry.yml
@@ -1,6 +1,6 @@
 name: Windows Enable Win32 ScheduledJob via Registry
 id: 12c80db8-ef62-4456-92df-b23e1b3219f6
-version: 4
+version: 5
 date: '2024-11-13'
 author: Michael Haag, Splunk
 type: Anomaly
diff --git a/detections/endpoint/windows_hide_notification_features_through_registry.yml b/detections/endpoint/windows_hide_notification_features_through_registry.yml
@@ -1,6 +1,6 @@
 name: Windows Hide Notification Features Through Registry
 id: cafa4bce-9f06-11ec-a7b2-acde48001122
-version: 7
+version: 8
 date: '2024-12-08'
 author: Teoderick Contreras, Splunk, Steven Dick
 status: production
diff --git a/detections/endpoint/windows_lsa_secrets_nolmhash_registry.yml b/detections/endpoint/windows_lsa_secrets_nolmhash_registry.yml
@@ -1,6 +1,6 @@
 name: Windows LSA Secrets NoLMhash Registry
 id: 48cc1605-538c-4223-8382-e36bee5b540d
-version: 5
+version: 6
 date: '2025-01-21'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml b/detections/endpoint/windows_modify_registry_authenticationleveloverride.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry AuthenticationLevelOverride
 id: 6410a403-36bb-490f-a06a-11c3be7d2a41
-version: 4
+version: 5
 date: '2024-11-13'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_auto_minor_updates.yml b/detections/endpoint/windows_modify_registry_auto_minor_updates.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry Auto Minor Updates
 id: be498b9f-d804-4bbf-9fc0-d5448466b313
-version: 4
+version: 5
 date: '2024-11-13'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_auto_update_notif.yml b/detections/endpoint/windows_modify_registry_auto_update_notif.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry Auto Update Notif
 id: 4d1409df-40c7-4b11-aec4-bd0e709dfc12
-version: 4
+version: 5
 date: '2024-11-13'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_default_icon_setting.yml b/detections/endpoint/windows_modify_registry_default_icon_setting.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry Default Icon Setting
 id: a7a7afdb-3c58-45b6-9bff-63e5acfd9d40
-version: 4
+version: 5
 date: '2024-11-13'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_disable_restricted_admin.yml b/detections/endpoint/windows_modify_registry_disable_restricted_admin.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry Disable Restricted Admin
 id: cee573a0-7587-48e6-ae99-10e8c657e89a
-version: 5
+version: 6
 date: '2025-01-21'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml b/detections/endpoint/windows_modify_registry_disable_toast_notifications.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry Disable Toast Notifications
 id: ed4eeacb-8d5a-488e-bc97-1ce6ded63b84
-version: 4
+version: 5
 date: '2024-11-13'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml b/detections/endpoint/windows_modify_registry_disable_win_defender_raw_write_notif.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry Disable Win Defender Raw Write Notif
 id: 0e5e25c3-32f4-46f7-ba4a-5b95c3b90f5b
-version: 4
+version: 5
 date: '2024-11-13'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml b/detections/endpoint/windows_modify_registry_disable_windefender_notifications.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry Disable WinDefender Notifications
 id: 8e207707-ad40-4eb3-b865-3a52aec91f26
-version: 4
+version: 5
 date: '2024-11-13'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml b/detections/endpoint/windows_modify_registry_disable_windows_security_center_notif.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry Disable Windows Security Center Notif
 id: 27ed3e79-6d86-44dd-b9ab-524451c97a7b
-version: 4
+version: 5
 date: '2024-11-13'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml b/detections/endpoint/windows_modify_registry_disableremotedesktopantialias.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry DisableRemoteDesktopAntiAlias
 id: 4927c6f1-4667-42e6-bd7a-f5222116386b
-version: 4
+version: 5
 date: '2024-11-13'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml b/detections/endpoint/windows_modify_registry_disablesecuritysettings.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry DisableSecuritySettings
 id: 989019b4-b7aa-418a-9a17-2293e91288b6
-version: 4
+version: 5
 date: '2024-11-13'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml b/detections/endpoint/windows_modify_registry_disabling_wer_settings.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry Disabling WER Settings
 id: 21cbcaf1-b51f-496d-a0c1-858ff3070452
-version: 4
+version: 5
 date: '2024-11-13'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_disallow_windows_app.yml b/detections/endpoint/windows_modify_registry_disallow_windows_app.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry DisAllow Windows App
 id: 4bc788d3-c83a-48c5-a4e2-e0c6dba57889
-version: 4
+version: 5
 date: '2024-11-13'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml b/detections/endpoint/windows_modify_registry_do_not_connect_to_win_update.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry Do Not Connect To Win Update
 id: e09c598e-8dd0-4e73-b740-4b96b689199e
-version: 4
+version: 5
 date: '2024-11-13'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_dontshowui.yml b/detections/endpoint/windows_modify_registry_dontshowui.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry DontShowUI
 id: 4ff9767b-fdf2-489c-83a5-c6c34412d72e
-version: 4
+version: 5
 date: '2024-11-13'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml b/detections/endpoint/windows_modify_registry_enablelinkedconnections.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry EnableLinkedConnections
 id: 93048164-3358-4af0-8680-aa5f38440516
-version: 5
+version: 6
 date: '2025-01-21'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_longpathsenabled.yml b/detections/endpoint/windows_modify_registry_longpathsenabled.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry LongPathsEnabled
 id: 36f9626c-4272-4808-aadd-267acce681c0
-version: 5
+version: 6
 date: '2025-01-21'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml b/detections/endpoint/windows_modify_registry_maxconnectionperserver.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry MaxConnectionPerServer
 id: 064cd09f-1ff4-4823-97e0-45c2f5b087ec
-version: 4
+version: 5
 date: '2024-11-13'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml b/detections/endpoint/windows_modify_registry_no_auto_reboot_with_logon_user.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry No Auto Reboot With Logon User
 id: 6a12fa9f-580d-4627-8c7f-313e359bdc6a
-version: 4
+version: 5
 date: '2024-11-13'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_no_auto_update.yml b/detections/endpoint/windows_modify_registry_no_auto_update.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry No Auto Update
 id: fbd4f333-17bb-4eab-89cb-860fa2e0600e
-version: 4
+version: 5
 date: '2024-11-13'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_nochangingwallpaper.yml b/detections/endpoint/windows_modify_registry_nochangingwallpaper.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry NoChangingWallPaper
 id: a2276412-e254-4e9a-9082-4d92edb6a3e0
-version: 5
+version: 6
 date: '2025-01-21'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_proxyenable.yml b/detections/endpoint/windows_modify_registry_proxyenable.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry ProxyEnable
 id: b27f20bd-ef20-41d1-a1e9-25dedd5bf2f5
-version: 4
+version: 5
 date: '2024-11-13'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_proxyserver.yml b/detections/endpoint/windows_modify_registry_proxyserver.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry ProxyServer
 id: 12bdaa0b-3c59-4489-aae1-bff6d67746ef
-version: 4
+version: 5
 date: '2024-11-13'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml b/detections/endpoint/windows_modify_registry_suppress_win_defender_notif.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry Suppress Win Defender Notif
 id: e3b42daf-fff4-429d-bec8-2a199468cea9
-version: 4
+version: 5
 date: '2024-11-13'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_tamper_protection.yml b/detections/endpoint/windows_modify_registry_tamper_protection.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry Tamper Protection
 id: 12094335-88fc-4c3a-b55f-e62dd8c93c23
-version: 4
+version: 5
 date: '2024-11-13'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_to_add_or_modify_firewall_rule.yml b/detections/endpoint/windows_modify_registry_to_add_or_modify_firewall_rule.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry to Add or Modify Firewall Rule
 id: 43254751-e2ce-409a-b6b4-4f851e8dcc26
-version: 4
+version: 5
 date: '2024-12-08'
 author: Teoderick Contreras, Splunk
 data_source:
diff --git a/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml b/detections/endpoint/windows_modify_registry_updateserviceurlalternate.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry UpdateServiceUrlAlternate
 id: ca4e94fb-7969-4d63-8630-3625809a1f70
-version: 4
+version: 5
 date: '2024-11-13'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_usewuserver.yml b/detections/endpoint/windows_modify_registry_usewuserver.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry USeWuServer
 id: c427bafb-0b2c-4b18-ad85-c03c6fed9e75
-version: 4
+version: 5
 date: '2024-11-13'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml b/detections/endpoint/windows_modify_registry_with_md5_reg_key_name.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry With MD5 Reg Key Name
 id: 4662c6b1-0754-455e-b9ff-3ee730af3ba8
-version: 4
+version: 5
 date: '2024-11-13'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_wuserver.yml b/detections/endpoint/windows_modify_registry_wuserver.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry WuServer
 id: a02ad386-e26d-44ce-aa97-6a46cee31439
-version: 4
+version: 5
 date: '2024-11-13'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_registry_wustatusserver.yml b/detections/endpoint/windows_modify_registry_wustatusserver.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Registry wuStatusServer
 id: 073e69d0-68b2-4142-aa90-a7ee6f590676
-version: 4
+version: 5
 date: '2024-11-13'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml
@@ -1,6 +1,6 @@
 name: Windows Modify Show Compress Color And Info Tip Registry
 id: b7548c2e-9a10-11ec-99e3-acde48001122
-version: 7
+version: 8
 date: '2024-12-08'
 author: Teoderick Contreras, Splunk, Steven Dick
 status: production
diff --git a/detections/endpoint/windows_mshta_execution_in_registry.yml b/detections/endpoint/windows_mshta_execution_in_registry.yml
@@ -1,6 +1,6 @@
 name: Windows Mshta Execution In Registry
 id: e13ceade-b673-4d34-adc4-4d9c01729753
-version: 4
+version: 5
 date: '2024-11-13'
 author: Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_registry_bootexecute_modification.yml b/detections/endpoint/windows_registry_bootexecute_modification.yml
@@ -1,6 +1,6 @@
 name: Windows Registry BootExecute Modification
 id: eabbac3a-45aa-4659-920f-6b8cff383fb8
-version: 6
+version: 7
 date: '2024-12-16'
 author: Michael Haag, Teoderick Contreras, Splunk
 status: production
diff --git a/detections/endpoint/windows_registry_delete_task_sd.yml b/detections/endpoint/windows_registry_delete_task_sd.yml
diff --git a/detections/endpoint/windows_registry_sip_provider_modification.yml b/detections/endpoint/windows_registry_sip_provider_modification.yml
diff --git a/detections/endpoint/windows_remote_access_software_rms_registry.yml b/detections/endpoint/windows_remote_access_software_rms_registry.yml
diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml
diff --git a/detections/endpoint/windows_service_deletion_in_registry.yml b/detections/endpoint/windows_service_deletion_in_registry.yml
diff --git a/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml b/detections/endpoint/windows_snake_malware_registry_modification_wav_openwithprogids.yml
