100 Commits

Author	SHA1	Message	Date
research bot	67ecd29d53	updating docs and package bits [ci skip]	2022-03-03 18:22:29 +00:00
d1vious	47dbc6b946	using a different field	2022-02-26 13:39:28 -05:00
d1vious	0d49d7fc55	Merge branch 'CityOfLog4Shells' of github.com:splunk/security_content into CityOfLog4Shells	2022-02-24 23:05:48 -05:00
d1vious	6a50f02ff4	working detection	2022-02-24 23:05:31 -05:00
pyth0n1c	df824e79ac	Branch was auto-updated.	2022-02-18 15:32:15 -08:00
d1vious	ba97944d04	adding ldap detection	2022-02-18 17:39:23 -05:00
d1vious	db3605c753	adding ssa detection	2022-02-18 14:26:17 -05:00
truptilangalia-crest	179134e8ef	test:removed cim version	2022-02-08 12:05:05 +05:30
truptilangalia-crest	08f0ff6405	test: Removed tas with mapping from detection files	2022-01-31 19:46:09 +05:30
Detection Testing Service	6fd7a4e812	test: updated supported_tas to recommended_tas	2022-01-19 17:43:41 +05:30
Detection Testing Service	a2b6fff739	test:updated ymls	2021-12-15 21:15:02 +05:30
research bot	ff3319329e	updating docs and package bits [ci skip]	2021-12-15 02:58:27 +00:00
d1vious	16b771eae2	adding tags to detections	2021-12-14 19:38:51 -05:00
patel-bhavin	05b189232d	ldap outbound	2021-12-14 10:10:23 -08:00
tlangalia	343ceae12f	Updated detection files with supported TA list.	2021-12-14 13:27:55 +05:50
research bot	a1afa0fa60	updating docs and package bits [ci skip]	2021-10-28 19:55:37 +00:00
Drew Church	3b18c5abcb	Added CVE tags to 35 files	2021-10-22 10:03:24 -07:00
tccontre	9d466adc76	CARS_UPDATE_MITRE_ID_B8 ... CARS_UPDATE_MITRE_ID_B8	2021-10-15 10:22:43 +02:00
patel-bhavin	333552c326	version	2021-10-06 15:25:22 -07:00
patel-bhavin	966f63d7f1	duplicate	2021-10-06 15:17:00 -07:00
divious1	671e91ecd0	moved to experimental due to lack of testing	2021-09-09 17:30:40 -04:00
research bot	2c9e7b58a8	updating docs and package bits [ci skip]	2021-08-18 16:56:31 +00:00
github-actions[bot]	ffa8a4a805	Branch was auto-updated.	2021-07-27 20:53:22 +00:00
root	2fd2af4d29	Added detection testing service results inDNS Query Length With High Standard Deviation	2021-07-27 19:59:57 +00:00
P4T12ICK	686b0b5ca4	converted response_task to investigations	2021-07-26 13:39:17 +02:00
sec-researcher	ee3f8638c4	As I know PTR requests can not be used for data exfiltration so having them in search result is just a false positive. Also they have effect on deviation calculation and lead to a lot of false positive in result, specially when PTR requests in the environment is about 20% or more. So I add this filter to the search 'where NOT DNS.message_type IN("Pointer","PTR")'	2021-07-21 18:20:15 +04:30
P4T12ICK	76bbbe4609	add deployments to baselines	2021-07-21 11:31:40 +02:00
P4T12ICK	5e6e987fb7	resolved merge conflicts	2021-07-21 09:22:09 +02:00
research bot	3740535cca	updating docs and package bits [ci skip]	2021-07-20 17:49:09 +00:00
github-actions[bot]	23c103c192	Branch was auto-updated.	2021-07-20 15:47:19 +00:00
P4T12ICK	9568fc7807	migrated baselines into detections folder	2021-07-20 13:19:22 +02:00
P4T12ICK	cfae82505c	add analytic types to detections	2021-07-19 17:41:22 +02:00
tccontre	3d82142995	rba_task_update	2021-07-15 09:39:03 +02:00
tccontre	8477b3e3a0	rba_task_2	2021-07-14 16:35:10 +02:00
tccontre	019e9311f1	rba_task_2	2021-07-14 16:33:48 +02:00
tccontre	197e73cd61	de	2021-06-15 15:51:08 +02:00
tccontre	9e009e50b7	data_exfil	2021-06-15 15:36:41 +02:00
research bot	2d61b8e675	updating docs and package bits [ci skip]	2021-05-24 17:47:29 +00:00
tccontre	0249f2ce27	fix_validate	2021-05-18 10:47:53 +02:00
research bot	1aeb0a9f6a	updating docs and package bits [ci skip]	2021-04-29 21:32:44 +00:00
Michael Haag	80904c3093	Update plain_http_post_exfiltrated_data.yml	2021-04-23 11:48:49 -06:00
Michael Haag	84e775e972	Update multiple_archive_files_http_post_traffic.yml	2021-04-23 11:44:45 -06:00
root	bd66b44311	Added detection testing service results inMultiple Archive Files Http Post Traffic	2021-04-23 15:06:39 +00:00
root	7e31007e97	Added detection testing service results inPlain HTTP POST Exfiltrated Data	2021-04-23 14:49:36 +00:00
tcontreras	6ed8a29e4e	fix_error	2021-04-22 15:48:54 +02:00
tcontreras	162b9f0cc3	net_exfil	2021-04-22 15:37:09 +02:00
P4T12ICK	edaf9598f2	fixed merging issues	2021-03-11 19:03:54 +01:00
P4T12ICK	6e826b4e68	add required fields and check	2021-03-11 09:11:48 +01:00
mhaag-spl	b15aaa55df	Moving non-passed to experimental and deprecating some	2021-03-10 13:27:00 -07:00
mhaag-spl	a6265b60df	Moving Tor Traffic to Experimental	2021-03-10 11:47:34 -07:00