splunk/security_content v4.27.0

on GitHub

Updated Analytics Story

• Cyclops Blink
• Sneaky Active Directory Persistence Tricks

New Analytics

• Windows Credential Access From Browser Password Store
• Windows Known Abused DLL Created

Updated Analytics

• Okta User Logins From Multiple Cities
• Path traversal SPL injection
• Splunk User Enumeration Attempt
• AWS Concurrent Sessions From Different Ips
• AWS Credential Access RDS Password reset
• Kubernetes Nginx Ingress LFI
• Kubernetes Nginx Ingress RFI
• Kubernetes Previously Unseen Process
• O365 Multiple Users Failing To Authenticate From Ip
• Detect AzureHound Command-Line Arguments
• Detect AzureHound File Modifications
• Detect SharpHound Command-Line Arguments
• Detect SharpHound File Modifications
• Detect SharpHound Usage
• Disabling Windows Local Security Authority Defences via Registry
• Linux Iptables Firewall Modification
• Linux Kworker Process In Writable Process Path
• Linux Stdout Redirection To Dev Null File
• Network Traffic to Active Directory Web Services Protocol
• System Information Discovery Detection
• Windows SOAPHound Binary Execution

Lookups Added

• browser_app_list
• hijacklibs_loaded

Playbooks Updated

• All playbook yamls updated to use a list of D3FEND IDs