220 Commits

Author	SHA1	Message	Date
mhaag-spl	71481634a3	macro'd netsh	2021-08-17 15:14:35 -06:00
mhaag-spl	ba6c98c292	macro'd certutil	2021-08-17 15:00:51 -06:00
mhaag-spl	e1752d3440	macro'd hh	2021-08-17 14:29:16 -06:00
mhaag-spl	5dc0e8f211	macro'd net	2021-08-17 13:56:57 -06:00
mhaag-spl	a1a670203f	macro'd mshta	2021-08-17 13:38:11 -06:00
mhaag-spl	ad88e9a0ff	macro'd regsvr32	2021-08-17 13:27:48 -06:00
mhaag-spl	3251fcc1f6	macrod rundll32	2021-08-17 13:21:24 -06:00
mhaag-spl	644747d578	macro'd reg cmd	2021-08-17 12:09:31 -06:00
mhaag-spl	9958c82c3c	macro'd wmic	2021-08-17 11:44:30 -06:00
Michael Haag	c4a62635b1	Merge branch 'develop' into The-Haag-of-The-Storm	2021-08-17 11:19:42 -06:00
mhaag-spl	20000828f3	Macro'd powershell	2021-08-17 11:15:36 -06:00
P4T12ICK	686b0b5ca4	converted response_task to investigations	2021-07-26 13:39:17 +02:00
mhaag-spl	bd69016d7e	PowerShell 4104 copy of Security HIVES ... Modified macro to capture both XML rendered and non. Issue is, if you renderXML for powershell logging, it will have different fields. Something to be aware of.	2021-07-21 13:57:10 -06:00
mhaag-spl	0c86774b15	Added a Macro	2021-07-01 12:11:49 -06:00
bpatel	4a840d4184	ericks detections from xmrig	2021-05-12 12:58:00 -07:00
Bhavin Patel	3aa6adebd6	Merge branch 'develop' into sh_test	2021-02-03 14:24:50 -08:00
P4T12ICK	7f8652b85b	bug fix	2021-02-03 15:44:56 +01:00
bpatel	4fb0488ac6	duplicating files and experimental	2021-01-28 17:35:25 -08:00
bpatel	ec76d28b60	rename	2021-01-26 19:28:03 -08:00
bpatel	edeaa89c7d	macros for all	2021-01-26 18:53:01 -08:00
David Dorsey	fd76342c94	Changed the language in some of the descriptions	2021-01-21 23:53:47 -06:00
P4T12ICK	58627b44f9	changes	2020-12-15 12:27:16 +01:00
P4T12ICK	5fee68375f	fix_bugs	2020-12-11 10:51:02 +01:00
bpatel	25c7f33866	app inspect failures fixes	2020-12-08 14:56:39 -08:00
bpatel	c156c18b6b	files not needed	2020-12-08 11:15:24 -08:00
Jose Enrique Hernandez	3c1cfbf4de	Merge branch 'develop' into develop	2020-11-18 13:30:38 -05:00
Bhavin Patel	398ee5f947	Merge pull request #843 from splunk/ransomwares3 ... Ransomwares3	2020-11-12 11:51:39 -08:00
Jose Enrique Hernandez	3e9513f4b8	Merge branch 'develop' into develop	2020-11-11 22:04:16 -05:00
Jose Enrique Hernandez	4acc8c3efb	Merge branch 'develop' into mbjerkeland-develop	2020-11-11 22:03:44 -05:00
Bhavin Patel	e185ca89ba	Merge branch 'develop' into ransomwares3	2020-11-11 16:36:34 -08:00
Bhavin Patel	3aa06e82b6	Merge branch 'develop' into mustang_beta	2020-11-10 09:59:18 -08:00
bpatel	64bd08b5ff	these macro files are not needed	2020-11-10 09:14:23 -08:00
P4T12ICK	1f3f1ae408	Merge branch 'develop' into mbjerkeland-develop	2020-11-10 09:24:55 +01:00
Shannon Davis	098aa9019a	mods	2020-11-06 11:08:38 +11:00
P4T12ICK	8a66f8e175	changed macro	2020-11-05 09:18:37 +01:00
Mikael Bjerkeland	17502e4722	Added various Network Infrastructure detections based on the MITRE Network Matrix	2020-10-28 23:14:06 +01:00
Mikael Bjerkeland	7e068a5267	Added detection for T1020.001, Traffic Duplication	2020-10-28 21:51:33 +01:00
Mikael Bjerkeland	d5c6d72361	.	2020-10-28 21:14:40 +01:00
Bhavin Patel	5e62272a68	Merge branch 'develop' into mustang_beta	2020-10-05 16:20:10 -07:00
jzsplunk	3c49885ad6	Merge branch 'develop' into TR-104-missing-input-filters	2020-10-02 08:01:15 -07:00
David Dorsey	e30924013c	single and double quote order issue	2020-09-23 17:32:52 -05:00
David Dorsey	42549c5776	Macro fixes	2020-09-23 17:22:02 -05:00
David Dorsey	b681f5faa4	macro fixes	2020-09-23 17:16:35 -05:00
David Dorsey	5fbc68936b	baseline update search fix with macros	2020-09-23 16:58:26 -05:00
Rico Valdez	359926e89b	text updates and a couple of fixes for mismatched macros	2020-09-23 14:44:00 -06:00
David Dorsey	65403cc027	Merge branch 'TR-41_aws_ec2_mods' of github.com:splunk/security-content into TR-41_aws_ec2_mods	2020-09-23 11:36:15 -05:00
David Dorsey	2d25205146	Fixes	2020-09-23 11:35:56 -05:00
Jose Enrique Hernandez	7bd6f5380e	Merge branch 'develop' into TR-41_aws_ec2_mods	2020-09-23 12:09:37 -04:00
David Dorsey	17eff649e7	Fixes	2020-09-21 23:23:57 -05:00
divious1	b78035c976	adding macros	2020-09-18 17:36:46 -04:00