Steven Dick
Steven Dick
### Details A few detections that pull forward suspect process elevation/escalation behaviors - Detect when a low integrity process spawns a high integrity process from user controlled locations - Detect...
### Details This is a generic password spray detection that can be used across all CIM compliant authentication sources. Works based on a failure to success ratios common with malicious...
Data sourced from https://hijacklibs.net / https://github.com/wietze/HijackLibs/tree/main. This include file was written mostly programmatically for each DLL in this project and it's known/expected load locations. It is rather long, so any...
### Details This PR includes a number of detections written for the O365 Azure Active Directory workload from the universal audit log (o365 management activity). A few of the detections...
### Details A set of detections bult to detect anomalous behaviors using the NTLM Operational via organization domain controllers. - https://www.varonis.com/blog/investigate-ntlm-brute-force - https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/ntlm-blocking-and-you-application-analysis-and-auditing/ba-p/397191 - https://techcommunity.microsoft.com/t5/microsoft-defender-for-identity/enriched-ntlm-authentication-data-using-windows-event-8004/m-p/871827 Pending https://github.com/splunk/attack_data/pull/887 ### Checklist -...
### Details Mostly focused on bubbling up the various O365 security alerting for both built-in and premium features. ZAP, DLP, Safe Links, Safe Attachments Security & Compliance alerting Report A...
### Details Rewrote the previous tstats based search to work solely on EID7, while using backwards compatible evals/extractions in the detection. It's less efficient cause no tstats, but shouldn't break...
Data for upcoming content submission.
Data for upcoming detection submissions
Detection data for upcoming content submission. Data taken from testing in a production E3/E5 licensed environment, but sanitized. Covers a number of O365 default/premium security feature alerts or changes to...