e8de140562
fixes
2021-09-01 16:58:23 -06:00
06b6d96819
Create exchange_powershell_abuse_via_ssrf.yml
2021-09-01 12:26:03 -06:00
e08886eab3
Branch was auto-updated.
2021-08-27 22:52:18 +00:00
02e58a1dfa
updating docs and package bits [ci skip]
2021-08-27 21:52:55 +00:00
9d83664db7
Update exchange_powershell_module_usage.yml
2021-08-27 11:04:01 -07:00
77aea09e0d
Update exchange_powershell_module_usage.yml
2021-08-25 12:57:35 -06:00
25aaf33a98
Update exchange_powershell_module_usage.yml
2021-08-25 12:35:41 -06:00
36f3a9c250
Create exchange_powershell_module_usage.yml
2021-08-25 12:31:48 -06:00
b831023bd4
Update protocols_passing_authentication_in_cleartext.yml
...
Added a few more changes to make it more clear. Thank you @sec-researcher for updating!
2021-08-24 07:04:52 -06:00
0945cc72c9
Update protocols_passing_authentication_in_cleartext.yml
2021-08-21 08:55:07 +04:30
546e70f2d8
Merge branch 'splunk:develop' into optimized
2021-08-21 08:53:50 +04:30
0bfb8ba325
Filter blocked traffic because it made a lot of false positive specially when something like port scan happen, also add description to "how_to_implement" section to limit result just to organization private and public IP range for more accurate result
2021-08-19 18:59:04 +04:30
e1ff3993cd
run generate again
2021-08-16 15:57:44 -07:00
d1d2aa92dc
Rename detect_phishing_content___ssa.yml to ssa___detect_phishing_content.yml
2021-08-12 12:26:04 -04:00
1fca39be77
updated generate
2021-07-20 16:41:53 +02:00
cfae82505c
add analytic types to detections
2021-07-19 17:41:22 +02:00
022c5be43e
Revert "updated AWS IAM to AWS Identity Access Manager (IAM) in all detections to fit mustang required naming"
...
This reverts commit 45c138d518
2021-06-25 15:03:55 -04:00
f262360d0a
updated CloudTrails to AWS CloudTrails
2021-06-25 14:50:50 -04:00
45c138d518
updated AWS IAM to AWS Identity Access Manager (IAM) in all detections to fit mustang required naming
2021-06-25 14:44:02 -04:00
09796e3f67
revil
2021-06-04 16:07:02 +02:00
2d61b8e675
updating docs and package bits [ci skip]
2021-05-24 17:47:29 +00:00
b411f2b1fc
CVE-2021-31166
2021-05-21 11:25:37 -06:00
e80bc45423
updating docs and package bits [ci skip]
2021-05-13 22:09:29 +00:00
90cae048e2
Merge branch 'darkside' of github.com:splunk/security_content into darkside
2021-05-13 14:22:16 -07:00
888aae21d3
moving to experimental
2021-05-13 14:22:07 -07:00
3790936f7a
Branch was auto-updated.
2021-04-22 18:19:49 +00:00
a8a69a97a5
renaming product to new name
2021-04-21 18:23:09 -04:00
dc319b6eda
Spearphishing Attachments detections
2021-04-21 10:16:49 -06:00
1ab256593f
Domain Trust Discovery
2021-03-31 13:24:32 -06:00
249fd0a549
Update Certutil
...
- Renamed "attempt to add certificate to untrusted store" to "Attempt to add untrusted certificate to certificate store"
New Detections:
- CertUtil Download With URLCache and Split Arguments
- CertUtil Download With VerifyCtl and Split Arguments
2021-03-24 15:15:47 -06:00
00965fbd34
Delete detect_exchange_web_shell.yml
2021-03-19 06:41:51 -06:00
4b27622a3f
updating docs and package bits [ci skip]
2021-03-12 17:32:09 +00:00
592e63779c
fixing merge conflicts
2021-03-12 11:43:55 -05:00
40e1f95e2d
fixed validation errors
2021-03-11 12:35:04 -08:00
2643be22ff
w3wp spawning shell
2021-03-11 12:34:21 -07:00
69d73f3dc1
unified messaging service spawning a shell
2021-03-11 12:12:52 -07:00
edaf9598f2
fixed merging issues
2021-03-11 19:03:54 +01:00
43644ff368
add required fields
2021-03-11 09:32:33 +01:00
6e826b4e68
add required fields and check
2021-03-11 09:11:48 +01:00
b15aaa55df
Moving non-passed to experimental and deprecating some
2021-03-10 13:27:00 -07:00
a6265b60df
Moving Tor Traffic to Experimental
2021-03-10 11:47:34 -07:00
c1c1d1733e
WIP
2021-03-10 15:22:14 +01:00
7c134dbb5d
WIP
2021-03-10 14:44:44 +01:00
851a46ed41
Updated name
2021-03-10 06:43:26 -07:00
90a385e941
Create detect_exchange_webshell.yml
2021-03-10 06:23:54 -07:00
51823d81d3
Sunburst malware renamed NOBELIUM Group
...
Renaming Sunburst Malware to NOBELIUM Group
2021-03-05 10:30:34 -07:00
746997c92c
updating docs and package bits [ci skip]
2021-03-04 20:11:07 +00:00
fcb9fa5340
W3WP Spawning shells
2021-03-04 06:38:00 -07:00
ac49f9ab9e
HAFNIUM and more updates
2021-03-03 14:10:11 -07:00
ecb82ec8ca
Fixes
2021-03-01 06:52:02 -07:00
mhaag-spl