 P4T12ICK
|
a4ef2443cd
|
appinspect failing fixes
|
2025-10-17 07:49:47 +02:00 |
|
|
Michael Haag
|
a548ed769a
|
Hellcat United (#3723)
* Hellcat United
* fixes
* 🍱
* 1 mas
* Update powershell_4104_hunting.yml
|
2025-10-16 16:53:02 -07:00 |
|
|
Michael Haag
|
64ed5bb1e8
|
APT 37 and The No Good Rustonotto (#3686)
* APT 37 and The No Good Rustonotto
## Updated analytics
```
detections/application/detect_html_help_spawn_child_process.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/bitsadmin_download_file.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/cobalt_strike_named_pipes.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_html_help_renamed.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_html_help_url_in_command_line.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_mshta_inline_hta_execution.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_mshta_renamed.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_mshta_url_in_command_line.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_rundll32_inline_hta_execution.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/executables_or_script_creation_in_temp_path.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/icedid_exfiltrated_archived_file_creation.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/lolbas_with_network_traffic.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/powershell_4104_hunting.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/processes_tapping_keyboard_events.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/registry_keys_used_for_persistence.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/suspicious_curl_network_connection.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/suspicious_image_creation_in_appdata_folder.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/suspicious_mshta_spawn.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/suspicious_process_executed_from_container_file.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/suspicious_scheduled_task_from_public_directory.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_alternate_datastream___base64_content.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_archive_collected_data_via_powershell.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_archive_collected_data_via_rar.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_archived_collected_data_in_temp_folder.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_cab_file_on_disk.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_curl_download_to_suspicious_path.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_file_download_via_powershell.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_high_file_deletion_frequency.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_http_network_communication_from_msiexec.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_indicator_removal_via_rmdir.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_input_capture_using_credential_ui_dll.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_iso_lnk_file_creation.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_office_product_spawned_child_process_for_download.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_office_product_spawned_uncommon_process.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_process_executed_from_removable_media.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_process_execution_from_programdata.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_process_injection_into_notepad.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_replication_through_removable_media.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_scheduled_task_with_suspicious_command.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_scheduled_task_with_suspicious_name.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_screen_capture_in_temp_folder.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_screen_capture_via_powershell.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_service_created_with_suspicious_service_path.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_suspicious_driver_loaded_path.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_usbstor_registry_key_modification.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_wpdbusenum_registry_key_modification.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/winevent_scheduled_task_created_within_public_path.yml — APT37 Rustonotto and FadeStealer
detections/web/multiple_archive_files_http_post_traffic.yml — APT37 Rustonotto and FadeStealer
detections/web/plain_http_post_exfiltrated_data.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_expand_cabinet_file_extraction.yml — APT37 Rustonotto and FadeStealer
```
## New Story
```
stories/apt37_rustonotto_and_fadestealer.yml — APT37 Rustonotto and FadeStealer
```
* Create windows_expand_cabinet_file_extraction.yml
* Apply suggestion from @nasbench
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
* Update detections/endpoint/windows_expand_cabinet_file_extraction.yml
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
* Update detections/endpoint/windows_expand_cabinet_file_extraction.yml
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
* Update detections/endpoint/windows_expand_cabinet_file_extraction.yml
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
* updating conflicts
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Bhavin Patel <bpatel@splunk.com>
|
2025-10-13 13:54:03 -07:00 |
|
|
Nasreddine Bencherchali
|
547be58923
|
Update windows_ad_self_dacl_assignment.yml (#3721)
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
|
2025-10-13 09:30:50 -07:00 |
|
|
Nasreddine Bencherchali
|
21ee673940
|
Fix Issues & Updates (#3705)
* Fix Issues and Updates
* Update add_or_set_windows_defender_exclusion.yml
* Update windows_curl_download_to_suspicious_path.yml
* Fix more issues and bugs
* Update deprecation_mapping.YML
* Update windows_application_whitelisting_bypass_attempt_via_rundll32.yml
* More updates and fixes
* update `Windows Change Default File Association For No File Ext`
* A couple more updates for ya
* rename
* add / update rules
* Update windows_symlink_evaluation_change_via_fsutil.yml
* Update windows_symlink_evaluation_change_via_fsutil.yml
* Update linux_service_started_or_enabled.yml
* Update linux_service_started_or_enabled.yml
---------
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
|
2025-10-13 09:18:21 -07:00 |
|
|
Bhavin Patel
|
ae022339ac
|
Remove manual test (#3717)
* remove manual test
* Update potential_password_in_username.yml
|
2025-10-10 11:51:50 -07:00 |
|
|
Br3akp0int
|
a52d560c80
|
lokibot (#3701)
* lokibot
* lokibot
* lokibot
---------
Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
|
2025-10-10 18:32:18 +00:00 |
|
|
Br3akp0int
|
e41bd98cb9
|
fix_net_profile_analytic (#3689)
* fix_net_profile_analytic
* fix_net_profile_analytic
* fix_net_profile_analytic
* fix_net_profile_analytic
* fix_net_profile_analytic
* fix_net_profile_analytic
* fix_net_profile_analytic
* Update windows_set_network_profile_category_to_private_via_registry.yml
* Update deprecation_mapping.YML
* Remove deprecated web fraud detection mapping
Removed deprecated analytic story for web fraud detection.
---------
Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
|
2025-10-10 17:20:14 +00:00 |
|
|
Bhavin Patel
|
52b42c0da9
|
Merge branch 'develop' into promptlock
|
2025-09-29 13:31:36 -07:00 |
|
|
Bhavin Patel
|
55577a6e56
|
Merge branch 'develop' into fix-issue-3690
|
2025-09-29 12:57:48 -07:00 |
|
|
Bhavin Patel
|
6721794934
|
Update windows_process_execution_in_temp_dir.yml
|
2025-09-29 12:11:26 -07:00 |
|
|
Bhavin Patel
|
889a9e4dc1
|
Update cisco_nvm___curl_execution_with_insecure_flags.yml
|
2025-09-29 12:11:02 -07:00 |
|
|
Bhavin Patel
|
3784436646
|
Merge branch 'develop' into promptlock
|
2025-09-29 12:06:29 -07:00 |
|
|
Bhavin Patel
|
b647bfaba9
|
Merge branch 'develop' into GhostRedirector
|
2025-09-23 11:37:29 -07:00 |
|
|
Nasreddine Bencherchali
|
c0f7c69e14
|
Update windows_driver_load_non_standard_path.yml
|
2025-09-23 15:07:01 +02:00 |
|
|
Nasreddine Bencherchali
|
a529bb79b2
|
Update windows_driver_load_non_standard_path.yml
|
2025-09-23 12:15:24 +02:00 |
|
|
Michael Haag
|
a265197fd0
|
Update windows_process_execution_from_programdata.yml
|
2025-09-18 13:49:54 -06:00 |
|
|
Michael Haag
|
b6083e5076
|
GhostRedirectors
|
2025-09-18 13:39:40 -06:00 |
|
|
Teoderick Contreras
|
6ac89f25f5
|
fix_auditd_service_Start
|
2025-09-18 10:36:04 +02:00 |
|
|
Bhavin Patel
|
dbea574ff8
|
Merge branch 'develop' into notdoor_outlook_macros
|
2025-09-15 11:47:28 -07:00 |
|
|
Raven Tait
|
1a85b440dd
|
NotDoor Outlook Macro Detections
|
2025-09-11 11:42:25 -04:00 |
|
|
Teoderick Contreras
|
b3c9f1a719
|
promptlock
|
2025-09-10 10:01:04 +02:00 |
|
|
Teoderick Contreras
|
06cb9fe29d
|
promptlock
|
2025-09-10 09:55:05 +02:00 |
|
|
ljstella
|
d6f03a2d24
|
Bumped versions
|
2025-09-09 08:49:59 -04:00 |
|
|
ljstella
|
8d0935f037
|
Update attack_data links
|
2025-09-09 08:35:57 -04:00 |
|
|
Bhavin Patel
|
8488f805d8
|
Merge branch 'develop' into lamehug
|
2025-09-04 10:28:02 -07:00 |
|
|
Teoderick Contreras
|
afa518bd69
|
lamehug
|
2025-09-04 17:38:02 +02:00 |
|
|
Teoderick Contreras
|
0ed670c5e7
|
lamehug
|
2025-09-04 17:17:14 +02:00 |
|
|
Teoderick Contreras
|
1ce551dfdb
|
lamehug
|
2025-09-04 09:53:22 +02:00 |
|
|
Bhavin Patel
|
a2ba81b078
|
Merge branch 'develop' into secret_blizzard
|
2025-09-03 16:20:07 -07:00 |
|
|
Bhavin Patel
|
3d3ddf395c
|
Merge branch 'develop' into lamehug
|
2025-09-03 13:36:03 -07:00 |
|
|
Bhavin Patel
|
816736e910
|
Update windows_ai_platform_dns_query.yml
|
2025-09-03 13:22:04 -07:00 |
|
|
Bhavin Patel
|
556013455c
|
Merge branch 'develop' into lamehug
|
2025-09-03 09:29:59 -07:00 |
|
|
Bhavin Patel
|
c2c32cf060
|
Merge branch 'develop' into backwards
|
2025-09-03 09:25:27 -07:00 |
|
|
Bhavin Patel
|
0823e53978
|
Update windows_sql_server_critical_procedures_enabled.yml
|
2025-09-03 09:18:14 -07:00 |
|
|
Bhavin Patel
|
10e2e118f5
|
Update windows_sql_server_xp_cmdshell_config_change.yml
|
2025-09-03 09:17:56 -07:00 |
|
|
Michael Haag
|
9b0a748b3d
|
updates to manual
|
2025-08-29 12:28:59 -06:00 |
|
|
Milad Cheraghi
|
655bd7fee3
|
Merge branch 'develop' into lnx_auditd_magic_system_request_key
|
2025-08-29 20:05:46 +03:30 |
|
|
Teoderick Contreras
|
15108547c5
|
lamehug
|
2025-08-29 11:21:53 +02:00 |
|
|
Milad Cheraghi
|
8af6a90839
|
file name issue fix
|
2025-08-29 00:54:42 +03:30 |
|
|
Milad Cheraghi
|
1eefd8ffb6
|
Macro and message issue fixed
|
2025-08-28 22:36:02 +03:30 |
|
|
Lou Stella
|
9a6c0a75ae
|
Merge branch 'develop' into backwards
|
2025-08-28 13:48:40 -05:00 |
|
|
Raven Tait
|
dcf3888ca2
|
Improve descriptions
|
2025-08-28 13:59:56 -04:00 |
|
|
Michael Haag
|
b0b5bf1092
|
Updates to SQL Content
Resolving https://github.com/splunk/security_content/issues/3643
Thank you!
|
2025-08-28 11:32:03 -06:00 |
|
|
pyth0n1c
|
71a9285a89
|
Merge branch 'develop' into lamehug
|
2025-08-28 09:17:17 -07:00 |
|
|
Teoderick Contreras
|
cc20859527
|
lamehug
|
2025-08-28 15:22:47 +02:00 |
|
|
Teoderick Contreras
|
e4722e4dde
|
lamehug
|
2025-08-28 14:34:09 +02:00 |
|
|
Milad Cheraghi
|
acaceb8d18
|
Added new technique for linux - magic system request key
|
2025-08-28 15:10:04 +03:30 |
|
|
Raven Tait
|
8b0a37860d
|
SpeechRuntime Lateral Movement
|
2025-08-27 14:58:33 -04:00 |
|
|
Teoderick Contreras
|
17ecc5ce65
|
lamehug
|
2025-08-27 13:48:15 +02:00 |
|