LoFP
/
infrastructure
infrastructure rule
Title
Tags
administrators may access these files for initial setup or troubleshooting. limited in most environments. tune as needed.
T1003.008
t1005
infrastructure
splunk
administrators may use this command when installing third party vibs. tune as needed.
t1562
infrastructure
splunk
administrators may use this command when troubleshooting. tune as needed.
t1005
t1082
T1673
infrastructure
splunk
false positives may occur. it is recommended to fine-tune okta settings and the analytic to ensure high fidelity. adjust the risk score as necessary.
t1078.004
infrastructure
splunk
fidelity of this is high as okta is specifying malicious infrastructure. filter and modify as needed.
t1078.001
t1556
infrastructure
splunk
limited false positives in most environments after initial setup, however tune as needed.
t1078
t1098
infrastructure
splunk
limited false positives in most environments, however tune as needed.
t1059
t1070
t1110
t1499
t1529
t1562
t1562.001
t1562.003
t1562.004
T1601.001
T1673
infrastructure
splunk
limited false positives in most environments, however tune as needed. administrators may use the root account for troubleshooting or initial user creation.
t1078
infrastructure
splunk
limited false positives in most environments, however tune as needed. some administrators may use ssh for troubleshooting.
t1021.004
infrastructure
splunk
new local accounts being created in esxi is rare in most environments. tune as needed.
t1078
t1098
t1136.001
infrastructure
splunk
none currently known
t1200
t1498
T1557.002
infrastructure
splunk
some third party vendor vibs or patches may require the force option.
T1505.006
infrastructure
splunk
this search might be prone to high false positives if dhcp snooping has been incorrectly configured or in the unlikely event that the dhcp server has been moved to another network interface.
t1200
t1498
t1557
infrastructure
splunk
this search might be prone to high false positives if dhcp snooping or arp inspection has been incorrectly configured, or if a device normally sends many arp packets (unlikely).
t1200
t1498
T1557.002
infrastructure
splunk
this search might be prone to high false positives if you have malfunctioning devices connected to your ethernet ports or if end users periodically connect physical devices to the network.
t1200
t1498
T1557.002
infrastructure
splunk
this search might be prone to high false positives. please consider this when conducting analysis or investigations. authorized devices may be detected as unauthorized. if this is the case, verify the mac address of the system responsible for the false positive and add it to the assets and identity framework with the proper information.
infrastructure
splunk
this search will also report any legitimate attempts of software downloads to network devices as well as outbound ssh sessions from network devices.
T1542.005
infrastructure
splunk
this search will return false positives for any legitimate traffic captures by network administrators.
T1020.001
t1200
t1498
infrastructure
splunk