 Michael Haag
|
a548ed769a
|
Hellcat United (#3723)
* Hellcat United
* fixes
* 🍱
* 1 mas
* Update powershell_4104_hunting.yml
|
2025-10-16 16:53:02 -07:00 |
|
|
Michael Haag
|
64ed5bb1e8
|
APT 37 and The No Good Rustonotto (#3686)
* APT 37 and The No Good Rustonotto
## Updated analytics
```
detections/application/detect_html_help_spawn_child_process.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/bitsadmin_download_file.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/cobalt_strike_named_pipes.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_html_help_renamed.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_html_help_url_in_command_line.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_mshta_inline_hta_execution.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_mshta_renamed.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_mshta_url_in_command_line.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_rundll32_inline_hta_execution.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/executables_or_script_creation_in_temp_path.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/icedid_exfiltrated_archived_file_creation.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/lolbas_with_network_traffic.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/powershell_4104_hunting.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/processes_tapping_keyboard_events.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/registry_keys_used_for_persistence.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/suspicious_curl_network_connection.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/suspicious_image_creation_in_appdata_folder.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/suspicious_mshta_spawn.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/suspicious_process_executed_from_container_file.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/suspicious_scheduled_task_from_public_directory.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_alternate_datastream___base64_content.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_archive_collected_data_via_powershell.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_archive_collected_data_via_rar.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_archived_collected_data_in_temp_folder.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_cab_file_on_disk.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_curl_download_to_suspicious_path.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_file_download_via_powershell.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_high_file_deletion_frequency.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_http_network_communication_from_msiexec.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_indicator_removal_via_rmdir.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_input_capture_using_credential_ui_dll.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_iso_lnk_file_creation.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_office_product_spawned_child_process_for_download.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_office_product_spawned_uncommon_process.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_process_executed_from_removable_media.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_process_execution_from_programdata.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_process_injection_into_notepad.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_replication_through_removable_media.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_scheduled_task_with_suspicious_command.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_scheduled_task_with_suspicious_name.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_screen_capture_in_temp_folder.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_screen_capture_via_powershell.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_service_created_with_suspicious_service_path.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_suspicious_driver_loaded_path.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_usbstor_registry_key_modification.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_wpdbusenum_registry_key_modification.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/winevent_scheduled_task_created_within_public_path.yml — APT37 Rustonotto and FadeStealer
detections/web/multiple_archive_files_http_post_traffic.yml — APT37 Rustonotto and FadeStealer
detections/web/plain_http_post_exfiltrated_data.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_expand_cabinet_file_extraction.yml — APT37 Rustonotto and FadeStealer
```
## New Story
```
stories/apt37_rustonotto_and_fadestealer.yml — APT37 Rustonotto and FadeStealer
```
* Create windows_expand_cabinet_file_extraction.yml
* Apply suggestion from @nasbench
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
* Update detections/endpoint/windows_expand_cabinet_file_extraction.yml
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
* Update detections/endpoint/windows_expand_cabinet_file_extraction.yml
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
* Update detections/endpoint/windows_expand_cabinet_file_extraction.yml
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
* updating conflicts
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Bhavin Patel <bpatel@splunk.com>
|
2025-10-13 13:54:03 -07:00 |
|
|
Rod Soto
|
0bcb54b6f9
|
Ollama TA detections (#3710)
* commit1oll
* olldet2
* olldet3
* fixeddet3
* fixsp
* olldet4
* olldet5
* detoll6
* olldet7
* olldet8
* datasets
* testfixes
* modifiedtasearch
* lotsofixes
* fixednewta
* addedmorerefs
* fixedatasource
* fixedthreatobject
* fixedetectionandalertmessage
* fixedalermessage
* fixedquotes
* fixedhowtoimp
* fixeddescriptionandhowto
* changedestforuripat
* fixedowasplink
* Update detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
* Update detections/application/ollama_possible_rce_via_model_loading.yml
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
* Update detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
* protoexnassuggestions
* mionr
* remove index=*
---------
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Bhavin Patel <bpatel@splunk.com>
|
2025-10-13 21:54:37 +02:00 |
|
|
Rod Soto
|
6cf5b0f8f6
|
Copilot based Detections (#3693)
* det1
* fixeddt1
* det2
* d3
* det4
* djbk
* d6
* d7
* d8
* addedlnkds
* fixsctype
* pipegone
* fixp
* fixdevices
* jbfix
* datasetfix
* exp
* fixsynthax
* changedstory
* changeprinus
* improvedht
* changedSenderuser
* datas
* fixdoublesearch
* fixedpi
* fixeddescriptionsuser
* fixdatalink
* exportedlogsdatasource
* fixedhowtodatasource
* updating risk stuff
---------
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Bhavin Patel <bpatel@splunk.com>
|
2025-10-13 12:14:09 -07:00 |
|
|
Bhavin Patel
|
a1d2b73915
|
updating links
|
2025-09-25 18:23:04 -07:00 |
|
|
Bhavin Patel
|
e51e23aab1
|
associating with new story
|
2025-09-25 18:19:34 -07:00 |
|
|
Bhavin Patel
|
4d7faff280
|
link for debug logging
|
2025-09-25 16:35:50 -07:00 |
|
|
Bhavin Patel
|
1fc1c5629a
|
adding updates to how to implement
|
2025-09-25 16:20:10 -07:00 |
|
|
Bhavin Patel
|
46ab9105c9
|
updating links
|
2025-09-25 16:01:23 -07:00 |
|
|
Bhavin Patel
|
6734892a65
|
updating the SPL
|
2025-09-25 15:41:56 -07:00 |
|
|
Bhavin Patel
|
fd9394687e
|
move to public
|
2025-09-25 13:05:25 -07:00 |
|
|
ljstella
|
8d0935f037
|
Update attack_data links
|
2025-09-09 08:35:57 -04:00 |
|
|
Bhavin Patel
|
9cff1a1671
|
Merge branch 'develop' into 3886
|
2025-08-11 11:19:16 -07:00 |
|
|
Raven Tait
|
3fd2a02f18
|
Bump versions
|
2025-08-06 11:00:30 -05:00 |
|
|
Raven Tait
|
2dde8e118b
|
Updates for 3886
|
2025-08-05 12:32:01 -05:00 |
|
|
Bhavin Patel
|
ef128df886
|
updating spl
|
2025-08-04 14:53:47 -05:00 |
|
|
Bhavin Patel
|
c6c2175f2a
|
move to prod
|
2025-08-04 14:00:19 -05:00 |
|
|
Bhavin Patel
|
2c6248de85
|
updating based on request from Ryan Long
|
2025-08-04 13:56:35 -05:00 |
|
|
Bhavin Patel
|
e434b1ac3f
|
remove extraquote
|
2025-07-21 09:44:10 -07:00 |
|
|
Patrick Bareiss
|
034c2a7bf6
|
feedback review
|
2025-07-21 09:47:20 +02:00 |
|
|
Bhavin Patel
|
efc331be05
|
Merge branch 'develop' into duo_detections_1
|
2025-07-18 13:50:53 -07:00 |
|
|
Raven Tait
|
aba2939a07
|
Fix host field
Fix host field
|
2025-07-18 12:13:00 -04:00 |
|
|
Raven Tait
|
e16ce3b350
|
Add vmware data source
Add vmware data source
|
2025-07-16 14:16:23 -04:00 |
|
|
Raven Tait
|
f0eac4d185
|
Change host to dest
Stop using host field and use a regex for dest
|
2025-07-16 13:55:49 -04:00 |
|
|
Raven Tait
|
a71c6fb38a
|
Initial batch of ESXi content
Initial batch of ESXi content
|
2025-07-11 11:59:37 -04:00 |
|
|
Patrick Bareiss
|
fb59e54ffe
|
bug fix
|
2025-07-10 16:45:20 +02:00 |
|
|
Patrick Bareiss
|
f63c5d26ea
|
bug fix
|
2025-07-10 15:50:47 +02:00 |
|
|
Patrick Bareiss
|
2b388b09c4
|
bug fix
|
2025-07-10 14:03:01 +02:00 |
|
|
Patrick Bareiss
|
036eb92f17
|
update filter macro name
|
2025-07-10 13:54:00 +02:00 |
|
|
Patrick Bareiss
|
8601a2174a
|
Cisco Duo Detections
|
2025-07-10 13:39:55 +02:00 |
|
|
Raven Tait
|
25617e6770
|
Initial remote employment fraud detections.
|
2025-06-12 14:43:59 -04:00 |
|
|
Eric
|
d9960562b8
|
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
|
2025-05-02 14:10:46 -07:00 |
|
|
Bhavin Patel
|
5b7cfdb7d3
|
updating versions
|
2025-04-16 16:45:16 -07:00 |
|
|
pyth0n1c
|
580a0873f2
|
Merge branch 'develop' into output_normalization_endpoint
|
2025-03-27 14:53:31 -07:00 |
|
|
Bhavin Patel
|
c009a27c12
|
add back manual_test
|
2025-03-27 14:01:20 -07:00 |
|
|
Bhavin Patel
|
cdd70a10aa
|
test with local data
|
2025-03-27 13:32:37 -07:00 |
|
|
Bhavin Patel
|
f14fd8dc50
|
Merge branch 'develop' into output_normalization_endpoint
|
2025-03-27 10:23:42 -07:00 |
|
|
Bhavin Patel
|
cacaa8ac07
|
yaml update
|
2025-03-21 11:58:12 -07:00 |
|
|
Bhavin Patel
|
30135a6a15
|
dd udpate
|
2025-03-21 11:56:19 -07:00 |
|
|
Bhavin Patel
|
20f1307ddf
|
updating date
|
2025-03-21 11:54:35 -07:00 |
|
|
Bhavin Patel
|
912238a4a4
|
move to prodcution after testing
|
2025-03-21 11:54:03 -07:00 |
|
|
Patrick Bareiss
|
1c9debe9a6
|
update versions
|
2025-03-14 13:47:44 +01:00 |
|
|
Patrick Bareiss
|
00e78ab666
|
output normalisation
|
2025-03-13 14:31:23 +01:00 |
|
|
Patrick Bareiss
|
ee813d6b39
|
output normalisation
|
2025-03-05 14:25:32 +01:00 |
|
|
Patrick Bareiss
|
448b2134b2
|
Merge branch 'develop' into output_normalization_endpoint
|
2025-02-26 11:53:41 +01:00 |
|
|
Patrick Bareiss
|
0f0ec93d2f
|
improved detections
|
2025-02-25 08:53:27 +01:00 |
|
|
research-bot
|
ebdd770afd
|
udpating name
|
2025-02-20 15:08:25 -08:00 |
|
|
research-bot
|
d25d712781
|
updating detection
|
2025-02-20 15:07:29 -08:00 |
|
|
Bhavin Patel
|
49fa1c1900
|
Merge branch 'develop' into cisco_ai_defense
|
2025-02-20 15:02:29 -08:00 |
|
|
research-bot
|
aba0bdc4d3
|
updating detection
|
2025-02-20 14:47:37 -08:00 |
|