Skip to content

DLUX 1 - Adding Misc New Detections - #3024

Merged
patel-bhavin merged 13 commits into
developfrom
dlux_1
Jul 17, 2024
Merged

patel-bhavin merged 13 commits into
developfrom
dlux_1

Conversation

@dluxtron

@dluxtron dluxtron commented Jul 1, 2024 •

Copy link
Copy Markdown
Collaborator

Adding a bunch of misc new detections across several security domains.

@dluxtron dluxtron changed the title Adding pwd spray detection DLUX Adding Misc New Detections Jul 2, 2024
@dluxtron dluxtron changed the title DLUX Adding Misc New Detections DLUX 1 - Adding Misc New Detections Jul 2, 2024
Comment thread detections/application/detect_distributed_password_spray_attempts.yml Outdated
Comment thread detections/application/detect_distributed_password_spray_attempts.yml Outdated
Comment thread detections/application/detect_distributed_password_spray_attempts.yml Outdated
Comment thread detections/application/detect_distributed_password_spray_attempts.yml Outdated
@patel-bhavin

Copy link
Copy Markdown
Contributor

overall results :
Failed
detections/application/detect_distributed_password_spray_attempts.yml - The dataset is does not work for the detection , the counts or the number of events are not enough

passed
detections/application/detect_password_spray_attempts.yml - pass
detections/application/windows_ad_add_self_to_group.yml - pass
detections/application/windows_increase_in_group_or_object_modification_activity.yml - pass
detections/application/windows_increase_in_user_modification_activity.yml - pass
detections/endpoint/windows_network_share_discovery_with_net.yml - pass
detections/endpoint/windows_vulnerable_driver_installed.yml - pass
detections/network/internal_horizontal_port_scan.yml - pass
detections/network/internal_vertical_port_scan.yml - pass
detections/network/internal_vulnerability_scan.yml - pass

@patel-bhavin

Copy link
Copy Markdown
Contributor

Made minor modifications and added data source fields

@patel-bhavin

Copy link
Copy Markdown
Contributor

Aweome work @dluxtron : will get this released in v.4.36.0

@patel-bhavin patel-bhavin reopened this Jul 17, 2024
@patel-bhavin
patel-bhavin merged commit 16885f0 into develop Jul 17, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants