 Rod Soto
|
0bcb54b6f9
|
Ollama TA detections (#3710)
* commit1oll
* olldet2
* olldet3
* fixeddet3
* fixsp
* olldet4
* olldet5
* detoll6
* olldet7
* olldet8
* datasets
* testfixes
* modifiedtasearch
* lotsofixes
* fixednewta
* addedmorerefs
* fixedatasource
* fixedthreatobject
* fixedetectionandalertmessage
* fixedalermessage
* fixedquotes
* fixedhowtoimp
* fixeddescriptionandhowto
* changedestforuripat
* fixedowasplink
* Update detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
* Update detections/application/ollama_possible_rce_via_model_loading.yml
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
* Update detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
* protoexnassuggestions
* mionr
* remove index=*
---------
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Bhavin Patel <bpatel@splunk.com>
|
2025-10-13 21:54:37 +02:00 |
|
|
Rod Soto
|
6cf5b0f8f6
|
Copilot based Detections (#3693)
* det1
* fixeddt1
* det2
* d3
* det4
* djbk
* d6
* d7
* d8
* addedlnkds
* fixsctype
* pipegone
* fixp
* fixdevices
* jbfix
* datasetfix
* exp
* fixsynthax
* changedstory
* changeprinus
* improvedht
* changedSenderuser
* datas
* fixdoublesearch
* fixedpi
* fixeddescriptionsuser
* fixdatalink
* exportedlogsdatasource
* fixedhowtodatasource
* updating risk stuff
---------
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Bhavin Patel <bpatel@splunk.com>
|
2025-10-13 12:14:09 -07:00 |
|
|
Bhavin Patel
|
fd9394687e
|
move to public
|
2025-09-25 13:05:25 -07:00 |
|
|
Michael Haag
|
1f709a9d67
|
The Lost Payload: MSIX Resurrection
"They thought it was just a package."
|
2025-08-18 11:46:34 -06:00 |
|
|
Bhavin Patel
|
716592ff40
|
updating spl
|
2025-08-04 14:48:58 -05:00 |
|
|
Bhavin Patel
|
75b307f0f8
|
updating def
|
2025-08-04 14:47:09 -05:00 |
|
|
Bhavin Patel
|
8a8e24ff29
|
adding macro
|
2025-08-04 14:45:49 -05:00 |
|
|
Bhavin Patel
|
efc331be05
|
Merge branch 'develop' into duo_detections_1
|
2025-07-18 13:50:53 -07:00 |
|
|
Raven Tait
|
a71c6fb38a
|
Initial batch of ESXi content
Initial batch of ESXi content
|
2025-07-11 11:59:37 -04:00 |
|
|
Patrick Bareiss
|
7da4b85353
|
add macros
|
2025-07-10 15:45:40 +02:00 |
|
|
Nasreddine Bencherchali
|
75ec47e99a
|
add new detections, story and other cool things
|
2025-07-01 23:04:48 +02:00 |
|
|
ljstella
|
ff624b020a
|
change to supported sourcetype
|
2025-06-17 09:08:10 -05:00 |
|
|
Raven Tait
|
25617e6770
|
Initial remote employment fraud detections.
|
2025-06-12 14:43:59 -04:00 |
|
|
Nasreddine Bencherchali
|
d2337f07c8
|
Update cisco_secure_firewall_inside_to_outside.yml
|
2025-04-03 14:28:58 +02:00 |
|
|
Nasreddine Bencherchali
|
c156e2bb8d
|
update macro name
|
2025-04-03 14:26:51 +02:00 |
|
|
Nasreddine Bencherchali
|
f39a6d9a50
|
cisco secure firewall detections - first batch
|
2025-04-03 14:21:27 +02:00 |
|
|
Patrick Bareiss
|
641c590df7
|
Merge branch 'develop' into output_normalization_endpoint
|
2025-03-19 15:10:33 +01:00 |
|
|
Bhavin Patel
|
77dfe52b89
|
Update macro
|
2025-03-17 16:44:09 -07:00 |
|
|
Patrick Bareiss
|
67dff5120a
|
Merge branch 'develop' into output_normalization_endpoint
|
2025-03-13 09:22:06 +01:00 |
|
|
Steven Dick
|
2445b44357
|
Update o365_suspect_search_terms_regex.yml
removing regex using $ because ContentCTL is being dumb and thinks it's a variable.
|
2025-03-12 07:32:14 -04:00 |
|
|
Bhavin Patel
|
60ba75f2a8
|
Merge branch 'develop' into nterl0k-T1552-sus-o365-searches
|
2025-03-11 13:25:48 -07:00 |
|
|
Patrick Bareiss
|
ee813d6b39
|
output normalisation
|
2025-03-05 14:25:32 +01:00 |
|
|
Bhavin Patel
|
6033082600
|
Merge branch 'develop' into haagsqldb
|
2025-03-04 10:12:52 -08:00 |
|
|
Bhavin Patel
|
cf52e66778
|
Merge branch 'develop' into nterl0k-t1114-sus-o365-email-actions
|
2025-02-28 11:52:31 -08:00 |
|
|
Steven Dick
|
a500515a33
|
Add files via upload
|
2025-02-27 10:52:01 -05:00 |
|
|
Bhavin Patel
|
52ad8c4ebb
|
Merge branch 'develop' into auditd_detection_updates
|
2025-02-26 12:09:47 -08:00 |
|
|
Michael Haag
|
31937902ee
|
Merge branch 'develop' into haagsqldb
|
2025-02-21 08:41:11 -07:00 |
|
|
Nasreddine Bencherchali
|
6869ca91e6
|
Merge branch 'develop' into auditd_detection_updates
|
2025-02-21 11:02:45 +01:00 |
|
|
Patrick Bareiss
|
77cbb835ce
|
Merge branch 'develop' into github_detections_improvement
|
2025-02-21 09:37:10 +01:00 |
|
|
Patrick Bareiss
|
41e69bd182
|
Merge branch 'develop' into github_detections_improvement
|
2025-02-21 09:24:24 +01:00 |
|
|
Bhavin Patel
|
49fa1c1900
|
Merge branch 'develop' into cisco_ai_defense
|
2025-02-20 15:02:29 -08:00 |
|
|
Teoderick Contreras
|
7f09aa976d
|
auditd_detection_updates
|
2025-02-20 13:36:03 +01:00 |
|
|
pyth0n1c
|
f9ab1d168d
|
Merge branch 'develop' into nterl0k-t1114-sus-o365-email-actions
|
2025-02-19 12:15:02 -08:00 |
|
|
Nasreddine Bencherchali
|
7df0472037
|
update exchange macro
|
2025-02-19 21:11:52 +01:00 |
|
|
Nasreddine Bencherchali
|
ba36467ece
|
feat: add new analytic story and analytic
|
2025-02-19 11:22:18 +01:00 |
|
|
Nasreddine Bencherchali
|
c16e7a1a74
|
feat: add auditpol macro
|
2025-02-19 11:22:18 +01:00 |
|
|
Bhavin Patel
|
f8fc280263
|
Merge branch 'develop' into nterl0k-t1114-sus-o365-email-actions
|
2025-02-18 17:44:35 -08:00 |
|
|
Bhavin Patel
|
47c2f4fc20
|
Merge branch 'develop' into other-updates
|
2025-02-18 09:22:56 -08:00 |
|
|
Bhavin Patel
|
e2863ae378
|
Merge branch 'develop' into github_detections_improvement
|
2025-02-18 09:03:42 -08:00 |
|
|
Patrick Bareiss
|
3563fdd417
|
Merge branch 'develop' into github_detections_improvement
|
2025-02-18 09:38:19 +01:00 |
|
|
research-bot
|
2933334f4c
|
updaing for validate
|
2025-02-14 13:42:13 -08:00 |
|
|
research-bot
|
c1a10beef5
|
drafting a search
|
2025-02-14 12:53:18 -08:00 |
|
|
Steven Dick
|
8a75b887dd
|
Merge branch 'splunk:develop' into nterl0k-t1114-sus-o365-email-actions
|
2025-02-14 09:23:48 -05:00 |
|
|
Michael Haag
|
f4a5cb9b4d
|
Haag's SQL Server Story Time: Tales of SQLCMD and Suspicious Queries 📚
|
2025-02-13 17:14:27 -07:00 |
|
|
Bhavin Patel
|
690874895b
|
Merge branch 'develop' into app_dynamics_alerts
|
2025-02-13 11:15:10 -08:00 |
|
|
Patrick Bareiss
|
7e119c82ee
|
Merge branch 'develop' into github_detections_improvement
|
2025-02-06 15:41:05 +01:00 |
|
|
research-bot
|
0544e801b2
|
adding draft detections
|
2025-02-04 11:55:10 -08:00 |
|
|
tccontre
|
f78bd48e7c
|
analytics_enhancement
|
2025-02-03 18:34:10 +01:00 |
|
|
tccontre
|
37db646b29
|
analytics_enhancement
|
2025-02-03 18:28:47 +01:00 |
|
|
Steven Dick
|
41f5366c15
|
Merge branch 'splunk:develop' into nterl0k-t1114-sus-o365-email-actions
|
2025-02-02 12:54:51 -05:00 |
|