750c81fb5b
updating docs and package bits [ci skip]
2021-12-02 18:50:01 +00:00
57c1ef30dd
Merge pull request #1857 from splunk/RegistryDetectionFixes
...
Registry detection fixes
2021-12-01 15:41:01 -08:00
9f91279c51
Changed affected Registry.registry_value_name
...
fields to Registry.registry_value_data and changed
value from DWORD(0x...) to 0x...
This probably does not cover all the detections that
will need to be addressed in this fix, but is a good
initial pass to see if the fixes and new TA are working
properly.
2021-10-14 14:58:03 -07:00
3f01dc7409
Touched a number of detections to see if they
...
fail with the current sysmon TA before testing
against the sysmon TA update.
2021-10-14 14:24:25 -07:00
14e3597bf4
CARS_UPDATE_MITRE_ID_B4
...
CARS_UPDATE_MITRE_ID_B3
2021-10-13 11:13:24 +02:00
5e6e987fb7
resolved merge conflicts
2021-07-21 09:22:09 +02:00
44ea56053d
updating docs and package bits [ci skip]
2021-07-20 21:12:30 +00:00
65a92a64e1
add analytic types to detections
2021-07-19 16:49:33 +02:00
1430b38fb8
Merge branch 'develop' into Risky
2021-07-14 07:49:31 -06:00
9944856c3f
updating docs and package bits [ci skip]
2021-07-13 23:26:40 +00:00
8c6e2f72f0
adding rba support for 11 more detecteions
2021-07-13 12:26:02 -04:00
bcda9adb56
Update disable_windows_behavior_monitoring.yml
2021-07-05 16:46:12 +02:00
c4befb2012
mod disable defender
2021-07-05 15:01:10 +02:00
0da7fdd61f
add ttp3
2021-07-05 14:46:16 +02:00
19ac15a485
add ttp
2021-07-05 14:44:35 +02:00
a40dc12832
updating docs and package bits [ci skip]
2021-04-15 19:40:20 +00:00
71139506d7
Added detection testing service results inDisable Windows Behavior Monitoring
2021-03-31 17:23:30 +00:00
c214e8dc53
def_evasion_detections
2021-03-31 14:42:47 +02:00
research bot