Updating detections and adding a new one - Githubissues

splunk / security_content

Splunk Security Content

https://research.splunk.com

Apache License 2.0

1.26k stars 354 forks source link

Updating detections and adding a new one #3140

Open dluxtron opened 1 week ago

dluxtron commented 1 week ago

DL PR

Updates to existing ESCU Detections

detect_large_outbound_icmp_packets.yml

Added Risk Message
Updated Risk Object from dest to dest_ip
Added another risk object for src_ip
Added the renamed field to the values commands
Added filtering for dest_ips to the where clause of the tstats command
Added iplocation

detect_outbound_smb_traffic.yml

All_Traffic.direction is not populated by all firewall logs, added internal to external logic to the where clause of the tstats instaed
Added dest_port and dest_ip to the by clause of the tstats for better filtering & RBA experience
Added iplocation

remote_desktop_network_bruteforce.yml

Updated search logic to use port 3389 as well (customer didn't have the RDP app resolving)
Added filtering for allowed traffic only - inbound blocked traffic was triggering this rule
Added src as a risk object

remote_desktop_network_traffic.yml

Added risk message

smb_traffic_spike.yml

Added risk message
Added src as risk object

high_volume_of_bytes_out_to_url.yml

Moved from Network folder to web folder

java_class_file_download_by_java_user_agent.yml

Moved from Network folder to web folder

multiple_archive_files_http_post_traffic.yml

Moved from Network folder to web folder

plain_http_post_exfiltrated_data.yml

Moved from Network folder to web folder

unusually_long_content_type_length.yml

Moved from Network folder to web folder
Rewrote detection to use Web Datamodel
Added risk message
Added risk object for src

Added new detection

internal_horizontal_port_scan_nmap_top_20.yml Same as the other internal horizontal port scan, but focused on the nmap top 20.