Skip to content

Commit e1b7aa4

Browse files
patel-bhavinpatel-bhavin
authored
Merge branch 'develop' into nterl0k-t1200-sysmon-usb-use-execution
2 parents b968f68 + 0786bf2 commit e1b7aa4

File tree

876 files changed

+3741
-3465
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

876 files changed

+3741
-3465
lines changed

‎.github/labeler.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,3 +22,8 @@ Lookups:
2222
Datasource:
2323
- changed-files:
2424
- any-glob-to-any-file: data_sources/*
25+
26+
Baselines:
27+
- changed-files:
28+
- any-glob-to-any-file: baselines/*
29+

‎detections/application/detect_distributed_password_spray_attempts.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Distributed Password Spray Attempts
22
id: b1a82fc8-8a9f-4344-9ec2-bde5c5331b57
3-
version: 3
4-
date: '2025-01-21'
3+
version: 4
4+
date: '2025-02-10'
55
author: Dean Luxton
66
status: production
77
type: Hunting
@@ -65,7 +65,6 @@ tags:
6565
- 90bc2e54-6c84-47a5-9439-0a2a92b4b175
6666
mitre_attack_id:
6767
- T1110.003
68-
- T1110
6968
product:
7069
- Splunk Enterprise
7170
- Splunk Enterprise Security

‎detections/application/detect_password_spray_attempts.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Detect Password Spray Attempts
22
id: 086ab581-8877-42b3-9aee-4a7ecb0923af
3-
version: 5
4-
date: '2025-01-21'
3+
version: 6
4+
date: '2025-02-10'
55
author: Dean Luxton
66
status: production
77
type: TTP
@@ -83,7 +83,6 @@ tags:
8383
- 90bc2e54-6c84-47a5-9439-0a2a92b4b175
8484
mitre_attack_id:
8585
- T1110.003
86-
- T1110
8786
product:
8887
- Splunk Enterprise
8988
- Splunk Enterprise Security

‎detections/application/email_files_written_outside_of_the_outlook_directory.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Email files written outside of the Outlook directory
22
id: 8d52cf03-ba25-4101-aa78-07994aed4f74
3-
version: 6
4-
date: '2025-01-21'
3+
version: 7
4+
date: '2025-02-10'
55
author: Bhavin Patel, Splunk
66
status: experimental
77
type: TTP
@@ -44,7 +44,6 @@ tags:
4444
- Collection and Staging
4545
asset_type: Endpoint
4646
mitre_attack_id:
47-
- T1114
4847
- T1114.001
4948
product:
5049
- Splunk Enterprise

‎detections/application/email_servers_sending_high_volume_traffic_to_hosts.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Email servers sending high volume traffic to hosts
22
id: 7f5fb3e1-4209-4914-90db-0ec21b556378
3-
version: 5
4-
date: '2025-01-21'
3+
version: 6
4+
date: '2025-02-10'
55
author: Bhavin Patel, Splunk
66
status: experimental
77
type: Anomaly
@@ -51,7 +51,6 @@ tags:
5151
- HAFNIUM Group
5252
asset_type: Endpoint
5353
mitre_attack_id:
54-
- T1114
5554
- T1114.002
5655
product:
5756
- Splunk Enterprise

‎detections/application/okta_authentication_failed_during_mfa_challenge.yml‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Okta Authentication Failed During MFA Challenge
22
id: e2b99e7d-d956-411a-a120-2b14adfdde93
3-
version: 4
4-
date: '2025-01-21'
3+
version: 5
4+
date: '2025-02-10'
55
author: Bhavin Patel, Splunk
66
data_source:
77
- Okta
@@ -59,10 +59,8 @@ tags:
5959
- Okta Account Takeover
6060
asset_type: Okta Tenant
6161
mitre_attack_id:
62-
- T1586
63-
- T1586.003
64-
- T1078
6562
- T1078.004
63+
- T1586.003
6664
- T1621
6765
product:
6866
- Splunk Enterprise

‎detections/application/okta_multi_factor_authentication_disabled.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Okta Multi-Factor Authentication Disabled
22
id: 7c0348ce-bdf9-45f6-8a57-c18b5976f00a
3-
version: 5
4-
date: '2025-01-21'
3+
version: 6
4+
date: '2025-02-10'
55
author: Mauricio Velazco, Splunk
66
data_source:
77
- Okta
@@ -57,7 +57,6 @@ tags:
5757
- Okta Account Takeover
5858
asset_type: Okta Tenant
5959
mitre_attack_id:
60-
- T1556
6160
- T1556.006
6261
product:
6362
- Splunk Enterprise

‎detections/application/okta_new_api_token_created.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Okta New API Token Created
22
id: c3d22720-35d3-4da4-bd0a-740d37192bd4
3-
version: 6
4-
date: '2025-01-21'
3+
version: 7
4+
date: '2025-02-10'
55
author: Michael Haag, Mauricio Velazco, Splunk
66
status: production
77
type: TTP
@@ -54,7 +54,6 @@ tags:
5454
- Okta Account Takeover
5555
asset_type: Okta Tenant
5656
mitre_attack_id:
57-
- T1078
5857
- T1078.001
5958
product:
6059
- Splunk Enterprise

‎detections/application/okta_new_device_enrolled_on_account.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Okta New Device Enrolled on Account
22
id: bb27cbce-d4de-432c-932f-2e206e9130fb
3-
version: 6
4-
date: '2025-01-21'
3+
version: 7
4+
date: '2025-02-10'
55
author: Michael Haag, Mauricio Velazco, Splunk
66
status: production
77
type: TTP
@@ -54,7 +54,6 @@ tags:
5454
- Okta Account Takeover
5555
asset_type: Okta Tenant
5656
mitre_attack_id:
57-
- T1098
5857
- T1098.005
5958
product:
6059
- Splunk Enterprise

‎detections/application/okta_phishing_detection_with_fastpass_origin_check.yml‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
name: Okta Phishing Detection with FastPass Origin Check
22
id: f4ca0057-cbf3-44f8-82ea-4e330ee901d3
3-
version: 4
4-
date: '2025-01-21'
3+
version: 5
4+
date: '2025-02-10'
55
author: Okta, Inc, Michael Haag, Splunk
66
type: TTP
77
status: experimental
@@ -38,7 +38,6 @@ tags:
3838
- Okta Account Takeover
3939
asset_type: Infrastructure
4040
mitre_attack_id:
41-
- T1078
4241
- T1078.001
4342
- T1556
4443
product:

0 commit comments

Comments
 (0)