f5bdb65b9e
Empty commit
2025-04-18 13:22:33 -07:00
19bd2b9be5
updating version and flag
2025-04-18 12:10:51 -07:00
310b207892
back to prod
2025-04-18 11:37:54 -07:00
e5e7fc032c
Merge pull request #3465 from splunk/remove_v5.4.0
...
Removed/ Deprecated content update for v5.4.0
2025-04-18 10:57:26 -07:00
614721e681
Merge branch 'develop' into remove_v5.4.0
2025-04-18 10:26:39 -07:00
3bf8bc509c
Merge pull request #3404 from splunk/cactus
...
Haag's Last Shadow: The Cactus Ransomware Chronicles
2025-04-18 10:25:23 -07:00
aa3187d61e
Merge branch 'develop' into remove_v5.4.0
2025-04-18 10:13:12 -07:00
9ae046285e
Merge branch 'develop' into cactus
2025-04-18 09:52:02 -07:00
a62ab6a00a
Merge pull request #3453 from splunk/aws_bedrock
...
AWS Bedrock detections
2025-04-18 09:51:02 -07:00
19221004d3
round 2
2025-04-18 10:22:37 -06:00
32962c745b
versions
2025-04-18 10:00:01 -06:00
8ca79f3f56
Merge branch 'develop' into cactus
2025-04-18 09:33:17 -06:00
5fb923447c
Merge branch 'develop' into remove_v5.4.0
2025-04-17 15:00:24 -07:00
eae0a4ed66
updating spls to match with output from data sources
2025-04-17 14:49:05 -07:00
524136ee6c
adding data sources
2025-04-17 14:42:15 -07:00
5e6418ee6e
Merge branch 'develop' into aws_bedrock
2025-04-17 14:24:55 -07:00
001da6a900
Merge pull request #3468 from splunk/csftd_third_batch
...
Cisco Secure Firewall Detections - Intrusion Event Based
2025-04-17 14:23:47 -07:00
e78f39612b
updates to rba and such
2025-04-17 13:59:44 -07:00
0bdaf9647e
Merge branch 'develop' into remove_v5.4.0
2025-04-17 13:27:58 -07:00
12e6cc7d7a
Merge branch 'develop' into csftd_third_batch
2025-04-17 12:49:38 -07:00
3842a6fc75
Merge pull request #3451 from splunk/csftd_second_batch
...
Cisco Secure Firewall Detections - File Event Based
2025-04-17 12:49:23 -07:00
8e6d4c69bf
Merge branch 'develop' into remove_v5.4.0
2025-04-17 12:00:27 -07:00
fad66d2e11
Merge branch 'develop' into csftd_second_batch
2025-04-17 11:04:31 -07:00
5c026c7c70
Merge pull request #3469 from splunk/storm
...
The Haag Identity: Storm-2460 CLFS Zero Day
2025-04-17 10:58:40 -07:00
4b73c303c8
Merge branch 'develop' into storm
2025-04-17 10:47:02 -07:00
22485da816
Merge pull request #3471 from splunk/auto-ta-update-238
...
Automated Splunk TA Update 238
2025-04-17 10:05:43 -07:00
bc6635d225
Merge branch 'develop' into storm
2025-04-17 10:04:45 -07:00
bcd5dd3fb2
Merge branch 'develop' into auto-ta-update-238
2025-04-17 19:04:44 +02:00
0699bacf84
Merge pull request #3470 from splunk/earth
...
Ground Control to Major Haag: Earth Alux
2025-04-17 10:04:10 -07:00
f9ed7b08cd
Update cisco_secure_firewall___rare_snort_rule_triggered.yml
2025-04-17 19:02:49 +02:00
4ab93da45e
rename file
2025-04-17 18:56:09 +02:00
db78bba4cd
update to RBA section
2025-04-17 09:48:48 -07:00
96f7490cde
Merge branch 'develop' into remove_v5.4.0
2025-04-17 09:15:53 -07:00
b0f1eaa08e
Merge branch 'develop' into storm
2025-04-17 09:10:45 -07:00
d57b1686fd
Merge branch 'develop' into csftd_second_batch
2025-04-17 18:06:46 +02:00
f98fe82f49
Merge branch 'develop' into csftd_third_batch
2025-04-17 18:06:43 +02:00
c4bca6ff3b
Merge branch 'develop' into earth
2025-04-17 08:58:49 -07:00
52f23c270d
Merge branch 'develop' into auto-ta-update-238
2025-04-17 08:54:31 -07:00
9bb83d7703
Merge pull request #3443 from splunk/csftd_first_batch
...
Cisco Secure Firewall Detections - Connection Event Based
2025-04-17 08:54:18 -07:00
b0e980d207
revert linux TA
2025-04-17 08:53:14 -07:00
5cff3894ed
Updated TAs
2025-04-17 06:58:05 +00:00
657ffbc9e4
Ground Control to Major Haag: Earth Alux
...
This PR adds a new analytic story for the Earth Alux threat actor, a sophisticated espionage group targeting government, technology, and telecommunications sectors in APAC and Latin America.
2025-04-16 21:55:12 -06:00
f28b475fb7
Update dump_lsass_via_procdump.yml
2025-04-16 21:45:24 -06:00
ffa5207b7e
version info
2025-04-16 21:41:49 -06:00
8a5556b252
The Haag Identity: Storm-2460 CLFS Zero Day
...
This PR adds comprehensive detection coverage for the Storm-2460 CLFS zero-day exploitation campaign.
Changes include:
- New analytic story documenting the full attack chain
- Tagged 17 existing detections with the story
- Coverage for MSBuild abuse, CertUtil usage, and system recovery tampering
The story covers the complete attack lifecycle from initial CLFS driver exploitation through ransomware deployment, with detections for:
- MSBuild execution and renaming
- CertUtil download and decode operations
- ProcDump credential theft
- System recovery disabling (bcdedit, wbadmin)
- Event log clearing (wevtutil)
2025-04-16 21:25:23 -06:00
6d5a7bf33c
Merge branch 'develop' into aws_bedrock
2025-04-16 16:58:57 -07:00
704e9ccdd7
missed a threat object
2025-04-16 16:51:46 -07:00
5b7cfdb7d3
updating versions
2025-04-16 16:45:16 -07:00
7fdcb4e7e0
adding drilldown
2025-04-16 16:31:04 -07:00
b6f87ba697
make it production
2025-04-16 16:26:45 -07:00
Bhavin Patel