Update 50 detections

[gowthamarajr]

Details

Updated description for the below detections:

1. Azure AD Privileged Role Assigned to Service Principal
2. Access LSASS Memory for Dump Creation
3. Detect Windows DNS SIGRed via Splunk Stream
4. Attempt To Add Certificate To Untrusted Store
5. Correlation by Repository and Risk
6. Correlation by User and Risk
7. Script Execution via WMI
8. Detect Baron Samedit CVE-2021-3156 Segfault
9. Detect Baron Samedit CVE-2021-3156 via OSQuery
10. Detect Baron Samedit CVE-2021-3156
11. GitHub Pull Request from Unknown User
12. GitHub Dependabot Alert
13. Create Remote Thread into LSASS
14. Cloud Compute Instance Created With Previously Unseen Instance Type
15. Circle CI Disable Security Job
16. Circle CI Disable Security Step
17. O365 New Federated Domain Added
18. Dump LSASS via comsvcs DLL
19. Cloud API Calls From Previously Unseen User Roles
20. Detect Credential Dumping through LSASS access
21. WMI Permanent Event Subscription
22. WMI Temporary Event Subscription
23. Detect Windows DNS SIGRed via Zeek
24. Amazon EKS Kubernetes Pod scan detection
25. Windows AD Domain Controller Audit Policy Disabled
26. Common Ransomware Extensions
27. Attempt To Stop Security Service
28. Credential Dumping via Copy Command from Shadow Copy
29. Suspicious Email Attachment Extensions
30. Credential Dumping via Symlink to Shadow Copy
31. Linux Decode Base64 to Shell
32. Create local admin accounts using net exe
33. Attacker Tools On Endpoint
34. Supernova Webshell
35. Web Servers Executing Suspicious Processes
36. Create or delete windows shares using net exe
37. Single Letter Process On Endpoint
38. Detect New Local Admin account
39. O365 Suspicious User Email Forwarding
40. Cloud Compute Instance Created With Previously Unseen Image
41. File with Samsam Extension
42. Short Lived Windows Accounts
43. SQL Injection with Long URLs
44. Suspicious writes to windows Recycle Bin
45. Remcos client registry install entry
46. Creation of Shadow Copy with wmic and powershell
47. Detect Zerologon via Zeek
48. Unusually Long Command Line
49. Windows Service Creation Using Registry Entry
50. SMB Traffic Spike

Checklist

• Validate name matches <platform>_<mitre att&ck technique>_<short description> nomenclature
• CI/CD jobs passed ✔️
• Validated SPL logic.
• Validated tags, description, and how to implement.
• Verified references match analytic.

[patel-bhavin]

Tested on ES!!