admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
27,806 Commits 697 Branches 195 Tags
data_source_bug_fix
Commit Graph

1120 Commits

Author SHA1 Message Date
Michael Haag a548ed769a Hellcat United (#3723) 
* Hellcat United

* fixes

* 🍱

* 1 mas

* Update powershell_4104_hunting.yml
 2025-10-16 16:53:02 -07:00
Michael Haag 64ed5bb1e8 APT 37 and The No Good Rustonotto (#3686) 
* APT 37 and The No Good Rustonotto

## Updated analytics
```
detections/application/detect_html_help_spawn_child_process.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/bitsadmin_download_file.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/cobalt_strike_named_pipes.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_html_help_renamed.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_html_help_url_in_command_line.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_mshta_inline_hta_execution.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_mshta_renamed.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_mshta_url_in_command_line.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/detect_rundll32_inline_hta_execution.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/executables_or_script_creation_in_temp_path.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/icedid_exfiltrated_archived_file_creation.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/lolbas_with_network_traffic.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/powershell_4104_hunting.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/processes_tapping_keyboard_events.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/registry_keys_used_for_persistence.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/suspicious_curl_network_connection.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/suspicious_image_creation_in_appdata_folder.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/suspicious_mshta_spawn.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/suspicious_process_executed_from_container_file.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/suspicious_scheduled_task_from_public_directory.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_alternate_datastream___base64_content.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_archive_collected_data_via_powershell.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_archive_collected_data_via_rar.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_archived_collected_data_in_temp_folder.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_cab_file_on_disk.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_curl_download_to_suspicious_path.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_file_download_via_powershell.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_high_file_deletion_frequency.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_http_network_communication_from_msiexec.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_indicator_removal_via_rmdir.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_input_capture_using_credential_ui_dll.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_iso_lnk_file_creation.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_office_product_spawned_child_process_for_download.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_office_product_spawned_uncommon_process.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_process_executed_from_removable_media.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_process_execution_from_programdata.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_process_injection_into_notepad.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_replication_through_removable_media.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_scheduled_task_with_suspicious_command.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_scheduled_task_with_suspicious_name.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_screen_capture_in_temp_folder.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_screen_capture_via_powershell.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_service_created_with_suspicious_service_path.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_suspicious_driver_loaded_path.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_usbstor_registry_key_modification.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_wpdbusenum_registry_key_modification.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/winevent_scheduled_task_created_within_public_path.yml — APT37 Rustonotto and FadeStealer
detections/web/multiple_archive_files_http_post_traffic.yml — APT37 Rustonotto and FadeStealer
detections/web/plain_http_post_exfiltrated_data.yml — APT37 Rustonotto and FadeStealer
detections/endpoint/windows_expand_cabinet_file_extraction.yml — APT37 Rustonotto and FadeStealer
```

## New Story

```
stories/apt37_rustonotto_and_fadestealer.yml — APT37 Rustonotto and FadeStealer
```

* Create windows_expand_cabinet_file_extraction.yml

* Apply suggestion from @nasbench

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/endpoint/windows_expand_cabinet_file_extraction.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/endpoint/windows_expand_cabinet_file_extraction.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/endpoint/windows_expand_cabinet_file_extraction.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* updating conflicts

---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Bhavin Patel <bpatel@splunk.com>
 2025-10-13 13:54:03 -07:00
Rod Soto 0bcb54b6f9 Ollama TA detections (#3710) 
* commit1oll

* olldet2

* olldet3

* fixeddet3

* fixsp

* olldet4

* olldet5

* detoll6

* olldet7

* olldet8

* datasets

* testfixes

* modifiedtasearch

* lotsofixes

* fixednewta

* addedmorerefs

* fixedatasource

* fixedthreatobject

* fixedetectionandalertmessage

* fixedalermessage

* fixedquotes

* fixedhowtoimp

* fixeddescriptionandhowto

* changedestforuripat

* fixedowasplink

* Update detections/application/ollama_possible_api_endpoint_scan_reconnaissance.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/application/ollama_possible_rce_via_model_loading.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* Update detections/application/ollama_possible_memory_exhaustion_resource_abuse.yml

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>

* protoexnassuggestions

* mionr

* remove index=*

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Bhavin Patel <bpatel@splunk.com>
 2025-10-13 21:54:37 +02:00
Rod Soto 6cf5b0f8f6 Copilot based Detections (#3693) 
* det1

* fixeddt1

* det2

* d3

* det4

* djbk

* d6

* d7

* d8

* addedlnkds

* fixsctype

* pipegone

* fixp

* fixdevices

* jbfix

* datasetfix

* exp

* fixsynthax

* changedstory

* changeprinus

* improvedht

* changedSenderuser

* datas

* fixdoublesearch

* fixedpi

* fixeddescriptionsuser

* fixdatalink

* exportedlogsdatasource

* fixedhowtodatasource

* updating risk stuff

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Bhavin Patel <bpatel@splunk.com>
 2025-10-13 12:14:09 -07:00
Br3akp0int a52d560c80 lokibot (#3701) 
* lokibot

* lokibot

* lokibot

---------

Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2025-10-10 18:32:18 +00:00
Bhavin Patel 3784436646 Merge branch 'develop' into promptlock 2025-09-29 12:06:29 -07:00
Bhavin Patel 8b2056475f Merge branch 'develop' into GhostRedirector 2025-09-29 11:34:54 -07:00
Bhavin Patel a1d2b73915 updating links 2025-09-25 18:23:04 -07:00
Bhavin Patel e51e23aab1 associating with new story 2025-09-25 18:19:34 -07:00
Bhavin Patel 46ab9105c9 updating links 2025-09-25 16:01:23 -07:00
Bhavin Patel c93f077146 adding a story file 2025-09-25 09:11:05 -07:00
Michael Haag b6083e5076 GhostRedirectors 2025-09-18 13:39:40 -06:00
Raven Tait 1a85b440dd NotDoor Outlook Macro Detections 2025-09-11 11:42:25 -04:00
Teoderick Contreras 06cb9fe29d promptlock 2025-09-10 09:55:05 +02:00
Bhavin Patel 8488f805d8 Merge branch 'develop' into lamehug 2025-09-04 10:28:02 -07:00
Bhavin Patel a2ba81b078 Merge branch 'develop' into secret_blizzard 2025-09-03 16:20:07 -07:00
pyth0n1c 71a9285a89 Merge branch 'develop' into lamehug 2025-08-28 09:17:17 -07:00
Teoderick Contreras 2b32858091 lamehug 2025-08-27 13:50:38 +02:00
Bhavin Patel 9c8742b4d8 Merge branch 'develop' into objectivity_stealer 2025-08-26 09:48:14 -07:00
Nasreddine Bencherchali 72912a9d6b Merge branch 'develop' into secret_blizzard 2025-08-26 15:12:00 +02:00
Bhavin Patel aa1608fc24 Merge branch 'develop' into path_wiper 2025-08-25 13:28:31 -07:00
Teoderick Contreras 897986eaa5 objectivity_stealer 2025-08-25 18:46:15 +02:00
Br3akp0int 9e56adf724 Update stories/obj3ctivity_stealer.yml 
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2025-08-25 18:02:15 +02:00
Br3akp0int 0dde715c39 Update stories/pathwiper.yml 
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2025-08-25 13:22:30 +02:00
Br3akp0int 039ac190e2 Update stories/secret_blizzard.yml 
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2025-08-25 13:12:56 +02:00
Teoderick Contreras e99692b3e6 objectivity_stealer 2025-08-22 09:54:09 +02:00
Michael Haag 521cfc1d2c Create cisco_smart_install_remote_code_execution_cve_2018_0171.yml 2025-08-21 08:16:14 -06:00
Teoderick Contreras ffa784db1e path_wiper 2025-08-20 12:13:44 +02:00
Bhavin Patel 2600cb12e9 Merge branch 'develop' into MSIX-Resurrection 2025-08-18 13:33:48 -07:00
Raven Tait 5e9242d20f add additional references 2025-08-18 15:23:14 -04:00
Raven Tait 5e948ce3fc Updates for 3886 2025-08-18 15:17:37 -04:00
Bhavin Patel 295d094bd2 Merge branch 'develop' into MSIX-Resurrection 2025-08-18 11:30:14 -07:00
Michael Haag 1f709a9d67 The Lost Payload: MSIX Resurrection 
"They thought it was just a package."
 2025-08-18 11:46:34 -06:00
Teoderick Contreras 4796778d91 rdp_artifacts_and_evasion 2025-08-18 16:17:51 +02:00
Bhavin Patel 1b36c0ffda Merge branch 'develop' into rdp_artifacts_and_evasion 2025-08-14 10:47:48 -07:00
Teoderick Contreras 1cb141ab70 secret_blizzard 2025-08-14 12:53:44 +02:00
Bhavin Patel 9cff1a1671 Merge branch 'develop' into 3886 2025-08-11 11:19:16 -07:00
Raven Tait 39b85548d2 Add Medusa content 2025-08-06 10:16:03 -05:00
Br3akp0int ce1bfce684 Merge branch 'develop' into rdp_artifacts_and_evasion 2025-08-06 11:49:38 +02:00
Michael Haag 7883693801 Merge branch 'develop' into scatteringspider 2025-08-01 10:21:00 -06:00
Teoderick Contreras 8c265f4881 rdp_artifacts_and_evasion 2025-08-01 10:13:08 +02:00
Michael Haag dbc7dd12e8 Scattered Spider Ashes 2025-07-31 10:34:07 -06:00
Teoderick Contreras d97a6d1dc2 interlock_ransomware 2025-07-29 12:34:34 +02:00
Teoderick Contreras 905a1041d2 interlock_ransomware 2025-07-29 12:31:56 +02:00
Teoderick Contreras d6febb57c4 interlock_ransomware 2025-07-29 12:05:44 +02:00
Teoderick Contreras 6c857aac76 interlock_ransomware 2025-07-28 11:13:15 +02:00
Bhavin Patel 299f54a1e7 Merge branch 'develop' into sharepoint 2025-07-21 14:04:54 -07:00
Bhavin Patel 955b4af394 Merge branch 'develop' into quasar_and_loader 2025-07-21 11:20:16 -07:00
Bhavin Patel 5c707ed2fa Merge branch 'develop' into sharepoint 2025-07-21 10:33:38 -07:00
Patrick Bareiss 034c2a7bf6 feedback review 2025-07-21 09:47:20 +02:00