Merge branch 'TR-2838_AD_PrivilegeEscalation' of github.com:splunk/security_content into TR-2838_AD_PrivilegeEscalation

dist/escu/default/transforms.conf

@@ -338,6 +338,7 @@ case_sensitive_match = false
 # description = A list of file extensions that are associated with ransomware
 match_type = WILDCARD(Extensions)
 min_matches = 1
+case_sensitive_match = false
 
 [ransomware_notes_lookup]
 filename = ransomware_notes.csv
@@ -345,6 +346,7 @@ default_match = false
 # description = A list of file names that are ransomware note files
 match_type = WILDCARD(ransomware_notes)
 min_matches = 1
+case_sensitive_match = false
 
 [remote_access_software]
 filename = remote_access_software.csv

lookups/ransomware_notes_lookup.yml

@@ -4,3 +4,4 @@ filename: ransomware_notes.csv
 match_type: WILDCARD(ransomware_notes)
 min_matches: 1
 name: ransomware_notes_lookup
+case_sensitive_match: 'false'

playbooks/CrowdStrike_OAuth_API_Device_Attribute_Lookup.yml

@@ -1,15 +1,15 @@
-name: Crowdstrike OAuth API Device Attribute Lookup
+name: CrowdStrike OAuth API Device Attribute Lookup
 id: fc0eac01-af2b-4cb0-7b4d-63da67d3fe74
 version: 1
 date: '2023-01-11'
 author: Teoderick Contreras, Splunk
 type: Investigation
 description: "Accepts a user or device and looks up the most recent attributes and groups for that user or device. This playbook produces a normalized output for each user and device."
-playbook: Crowdstrike_OAuth_API_Device_Attribute_Lookup
+playbook: CrowdStrike_OAuth_API_Device_Attribute_Lookup
 how_to_implement: This input playbook requires the Crowdstrike OAuth API connector to be configured. It is designed to work in conjunction with the Dynamic Attribute Lookup playbook or other playbooks in the same style. 
 references: []
 app_list: 
-  - Crowdstrike OAuth API
+  - CrowdStrike OAuth API
 tags:
   platform_tags:
     - attributes 
@@ -22,4 +22,4 @@ tags:
   vpe_type: Modern
   playbook_fields: []
   product:
-  - Splunk SOAR
+  - Splunk SOAR