From 71b3c2520f9a8602de4efae1992ebff95181ffcf Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Mon, 17 Mar 2025 13:37:03 -0600 Subject: [PATCH] version --- detections/endpoint/any_powershell_downloadstring.yml | 2 +- detections/endpoint/attacker_tools_on_endpoint.yml | 2 +- .../endpoint/detect_regsvr32_application_control_bypass.yml | 2 +- .../endpoint/powershell_webrequest_using_memory_stream.yml | 2 +- detections/endpoint/system_user_discovery_with_whoami.yml | 2 +- detections/endpoint/w3wp_spawning_shell.yml | 2 +- .../windows_process_writing_file_to_world_writable_path.yml | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml index ce7b0c1906..7d0f072605 100644 --- a/detections/endpoint/any_powershell_downloadstring.yml +++ b/detections/endpoint/any_powershell_downloadstring.yml @@ -1,6 +1,6 @@ name: Any Powershell DownloadString id: 4d015ef2-7adf-11eb-95da-acde48001122 -version: 9 +version: 10 date: '2025-02-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml index b4a35289fb..35056a29fd 100644 --- a/detections/endpoint/attacker_tools_on_endpoint.yml +++ b/detections/endpoint/attacker_tools_on_endpoint.yml @@ -1,6 +1,6 @@ name: Attacker Tools On Endpoint id: a51bfe1a-94f0-48cc-b4e4-16a110145893 -version: 8 +version: 9 date: '2025-02-10' author: Bhavin Patel, Splunk status: production diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml index bea7ff1ec1..70c3152db5 100644 --- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml +++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml @@ -1,6 +1,6 @@ name: Detect Regsvr32 Application Control Bypass id: 070e9b80-6252-11eb-ae93-0242ac130002 -version: 9 +version: 10 date: '2025-02-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/powershell_webrequest_using_memory_stream.yml b/detections/endpoint/powershell_webrequest_using_memory_stream.yml index 99d622ee1c..28e164d901 100644 --- a/detections/endpoint/powershell_webrequest_using_memory_stream.yml +++ b/detections/endpoint/powershell_webrequest_using_memory_stream.yml @@ -1,6 +1,6 @@ name: PowerShell WebRequest Using Memory Stream id: 103affa6-924a-4b53-aff4-1d5075342aab -version: 4 +version: 5 date: '2024-11-13' author: Steven Dick status: production diff --git a/detections/endpoint/system_user_discovery_with_whoami.yml b/detections/endpoint/system_user_discovery_with_whoami.yml index 4452538e55..f8ae794dc1 100644 --- a/detections/endpoint/system_user_discovery_with_whoami.yml +++ b/detections/endpoint/system_user_discovery_with_whoami.yml @@ -1,6 +1,6 @@ name: System User Discovery With Whoami id: 894fc43e-6f50-47d5-a68b-ee9ee23e18f4 -version: 4 +version: 5 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production diff --git a/detections/endpoint/w3wp_spawning_shell.yml b/detections/endpoint/w3wp_spawning_shell.yml index 9beffbcc76..963469e453 100644 --- a/detections/endpoint/w3wp_spawning_shell.yml +++ b/detections/endpoint/w3wp_spawning_shell.yml @@ -1,6 +1,6 @@ name: W3WP Spawning Shell id: 0f03423c-7c6a-11eb-bc47-acde48001122 -version: 6 +version: 7 date: '2025-02-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_process_writing_file_to_world_writable_path.yml b/detections/endpoint/windows_process_writing_file_to_world_writable_path.yml index 8137a6879a..3693a60cd8 100644 --- a/detections/endpoint/windows_process_writing_file_to_world_writable_path.yml +++ b/detections/endpoint/windows_process_writing_file_to_world_writable_path.yml @@ -1,6 +1,6 @@ name: Windows Process Writing File to World Writable Path id: c051b68c-60f7-4022-b3ad-773bec7a225b -version: 4 +version: 5 date: '2024-11-13' author: Michael Haag, Splunk data_source: []