admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
12,626 Commits 697 Branches 195 Tags
DockerDetectionUpdatesAndFixes
Commit Graph

109 Commits

Author SHA1 Message Date
mhaag-spl 25dc457c3c The Unbroken Haag 2021-12-06 11:57:20 -07:00
mhaag-spl 1aa5852b19 Update exchange_powershell_module_usage.yml 2021-11-15 07:53:20 -07:00
research bot c1410c0e95 updating docs and package bits [ci skip] 2021-11-10 16:16:30 +00:00
Bhavin Patel 1329ff2998 Branch was auto-updated. 2021-11-03 10:43:48 -07:00
patel-bhavin 0dfff97830 yml errors 2021-11-02 18:11:32 -07:00
patel-bhavin 0a9c396e08 search update 2021-11-02 18:03:21 -07:00
patel-bhavin ad5afdc3dc calendar search 2021-11-01 16:14:12 -07:00
patel-bhavin 0539ea52f2 macro update 2021-11-01 13:30:50 -07:00
Bhavin Patel 44d1bafd0c Branch was auto-updated. 2021-10-29 07:58:31 -07:00
d1vious 70d68fe35c moving to prod 2021-10-29 10:56:04 -04:00
Jose Enrique Hernandez a4d3b8480d minor updates given the feedback on issue 1767 2021-10-29 10:54:45 -04:00
research bot a1afa0fa60 updating docs and package bits [ci skip] 2021-10-28 19:55:37 +00:00
Bhavin Patel 8f1af508e4 Branch was auto-updated. 2021-10-25 08:08:50 -07:00
Rod Soto e9d1a85251 prforbhavingsuiteexperimentalsearches 2021-10-24 12:08:39 -07:00
Drew Church 3b18c5abcb Added CVE tags to 35 files 2021-10-22 10:03:24 -07:00
tccontre 9d466adc76 CARS_UPDATE_MITRE_ID_B8 
CARS_UPDATE_MITRE_ID_B8
 2021-10-15 10:22:43 +02:00
tccontre 5226dbd99c privilege_escalation_persistence 2021-10-08 14:23:55 +02:00
divious1 671e91ecd0 moved to experimental due to lack of testing 2021-09-09 17:30:40 -04:00
research bot 2783c3fe43 updating docs and package bits [ci skip] 2021-09-09 19:07:07 +00:00
mhaag-spl e8de140562 fixes 2021-09-01 16:58:23 -06:00
mhaag-spl 06b6d96819 Create exchange_powershell_abuse_via_ssrf.yml 2021-09-01 12:26:03 -06:00
github-actions[bot] e08886eab3 Branch was auto-updated. 2021-08-27 22:52:18 +00:00
research bot 02e58a1dfa updating docs and package bits [ci skip] 2021-08-27 21:52:55 +00:00
Bhavin Patel 9d83664db7 Update exchange_powershell_module_usage.yml 2021-08-27 11:04:01 -07:00
mhaag-spl 77aea09e0d Update exchange_powershell_module_usage.yml 2021-08-25 12:57:35 -06:00
mhaag-spl 25aaf33a98 Update exchange_powershell_module_usage.yml 2021-08-25 12:35:41 -06:00
mhaag-spl 36f3a9c250 Create exchange_powershell_module_usage.yml 2021-08-25 12:31:48 -06:00
Michael Haag b831023bd4 Update protocols_passing_authentication_in_cleartext.yml 
Added a few more changes to make it more clear. Thank you @sec-researcher for updating!
 2021-08-24 07:04:52 -06:00
Amir hossein Mahboubi 0945cc72c9 Update protocols_passing_authentication_in_cleartext.yml 2021-08-21 08:55:07 +04:30
Amir hossein Mahboubi 546e70f2d8 Merge branch 'splunk:develop' into optimized 2021-08-21 08:53:50 +04:30
sec-researcher 0bfb8ba325 Filter blocked traffic because it made a lot of false positive specially when something like port scan happen, also add description to "how_to_implement" section to limit result just to organization private and public IP range for more accurate result 2021-08-19 18:59:04 +04:30
patel-bhavin e1ff3993cd run generate again 2021-08-16 15:57:44 -07:00
Jose Enrique Hernandez d1d2aa92dc Rename detect_phishing_content___ssa.yml to ssa___detect_phishing_content.yml 2021-08-12 12:26:04 -04:00
P4T12ICK 1fca39be77 updated generate 2021-07-20 16:41:53 +02:00
P4T12ICK cfae82505c add analytic types to detections 2021-07-19 17:41:22 +02:00
divious1 022c5be43e Revert "updated AWS IAM to AWS Identity Access Manager (IAM) in all detections to fit mustang required naming" 
This reverts commit 45c138d518.
 2021-06-25 15:03:55 -04:00
divious1 f262360d0a updated CloudTrails to AWS CloudTrails 2021-06-25 14:50:50 -04:00
divious1 45c138d518 updated AWS IAM to AWS Identity Access Manager (IAM) in all detections to fit mustang required naming 2021-06-25 14:44:02 -04:00
tccontre 09796e3f67 revil 2021-06-04 16:07:02 +02:00
research bot 2d61b8e675 updating docs and package bits [ci skip] 2021-05-24 17:47:29 +00:00
mhaag-spl b411f2b1fc CVE-2021-31166 2021-05-21 11:25:37 -06:00
research bot e80bc45423 updating docs and package bits [ci skip] 2021-05-13 22:09:29 +00:00
bpatel 90cae048e2 Merge branch 'darkside' of github.com:splunk/security_content into darkside 2021-05-13 14:22:16 -07:00
bpatel 888aae21d3 moving to experimental 2021-05-13 14:22:07 -07:00
github-actions[bot] 3790936f7a Branch was auto-updated. 2021-04-22 18:19:49 +00:00
divious1 a8a69a97a5 renaming product to new name 2021-04-21 18:23:09 -04:00
mhaag-spl dc319b6eda Spearphishing Attachments detections 2021-04-21 10:16:49 -06:00
mhaag-spl 1ab256593f Domain Trust Discovery 2021-03-31 13:24:32 -06:00
mhaag-spl 249fd0a549 Update Certutil 
- Renamed "attempt to add certificate to untrusted store" to "Attempt to add untrusted certificate to certificate store"
New Detections:
- CertUtil Download With URLCache and Split Arguments
- CertUtil Download With VerifyCtl and Split Arguments
 2021-03-24 15:15:47 -06:00
mhaag-spl 00965fbd34 Delete detect_exchange_web_shell.yml 2021-03-19 06:41:51 -06:00