db8c7c8509
Initial commit of modified objects. A small set of 5 kvstore lookups could not be git moved AND updated in the same operation because git instead interpreted this as deleting the old file and creating a new one. To preserve git history, the files have been moved in this commit and will be updated in the next commit.
2026-05-13 14:02:27 -07:00
ba59855b1d
updating risk drilldowns ( #4016 )
...
* updating drilldows
* inspect failures
* updating versions
* updating versins
* chore: empty commit to trigger CI
2026-04-17 17:28:53 +05:30
3da4f7958a
anomaly_standard_init_score ( #3946 )
...
Co-authored-by: Teoderick Contreras <tcontreras@splunk.com >
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com >
2026-03-10 14:19:08 +05:30
11c909f725
Add YAML Formatting Job ( #3889 )
...
* Add YAML formatting and validation infrastructure
- Add yamlfmt configuration (.yamlfmt) with 4-space indent, LF line endings
- Add yamllint configuration (.yamllint) for syntax validation (detections/ only)
- Add pre-commit hook for automatic YAML formatting
- Add CI validation script with unified error output
- Add GitHub Actions workflow for PR validation
- Add documentation for setup and usage
- Support custom yamlfmt binary path via --yamlfmt-path flag
* comment yaml check from pre-commit
* apply yamlfmt
* Update yaml-validation.yml
* Update yaml-validation.yml
* application folder search formatting
* cloud folder search formatting
* web folder search formatting
* network folder search formatting
* endpoint folder search formatting
* resolve first conflict
* apply formatting
* remove additional pipe
* Update README.md
* update versions
* restore and update formatting (#3920 )
---------
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com >
2026-02-26 00:00:35 +05:30
b6b0b47a66
Storm-0501 Ransomware Analytic Story and Tagging ( #3871 )
...
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
Co-authored-by: Bhavin Patel <bpatel@splunk.com >
2026-01-22 22:32:14 +01:00
7b9274f9fb
Scattered Lapsus$ Hunters ( #3724 )
...
* Scattered Lapsus$ Hunters
* fixes
* 👀
* bump versions
---------
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com >
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-10-21 11:27:25 -07:00
b6083e5076
GhostRedirectors
2025-09-18 13:39:40 -06:00
7883693801
Merge branch 'develop' into scatteringspider
2025-08-01 10:21:00 -06:00
ea0121c2f1
Scattered Spider Tags
2025-07-31 10:54:21 -06:00
96786372a3
interlock_ransomware
2025-07-28 11:58:45 +02:00
d9960562b8
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
26e2f59462
add back manual_Test
2025-04-30 12:20:03 -07:00
6b2f2e9636
remove manual test for a CI run
2025-04-30 12:15:14 -07:00
884eede4ce
updating search
2025-04-30 12:14:30 -07:00
19221004d3
round 2
2025-04-18 10:22:37 -06:00
0d831661a6
updating detections with conflicts
2025-04-02 11:41:46 -07:00
7666d3793f
Merge branch 'develop' into cactus
2025-04-01 14:56:49 -06:00
7541027f8e
Merge branch 'develop' into output_normalization_endpoint
2025-04-01 09:41:58 +02:00
ec5cf468e3
The Haag Identity: Operation Seashell Blizzard 🌊 ❄️
...
This PR introduces comprehensive updates to our detection analytics, focusing on tagging relevant detections with the new "Seashell Blizzard" analytic story. The changes include:
Version and date updates across 20 detection files, with dates standardized to '2025-03-24' or '2025-03-25', and version numbers incremented appropriately.
Analytics tagged with "Seashell Blizzard" include:
ConnectWise ScreenConnect vulnerability detections (authentication bypass, path traversal)
Exchange Server exploitation detections (ProxyShell, ProxyNotShell, web shell)
Credential access monitoring (LSASS dumps via TaskMgr and ProcDump)
Remote access software usage detections (file, process, registry)
Scheduled task abuse detections
SQL Server xp_cmdshell configuration changes
Registry hive dumping detection
Key updates:
- Added "Seashell Blizzard" tag to 20 existing detections
These changes enhance our ability to track and detect activities associated with the Seashell Blizzard threat actor.
2025-03-24 14:18:40 -06:00
6b299cf58e
Tagged analytics
2025-03-20 11:34:39 -06:00
1c9debe9a6
update versions
2025-03-14 13:47:44 +01:00
b52bac9b19
output normalization endpoint
2025-02-14 12:40:57 +01:00
778d7fa7cd
Update detect_remote_access_software_usage_process.yml
2025-02-06 08:01:53 -05:00
fdaa038eab
Finish removing extra fields, or renaming
...
misnamed fields, in endpoint detections
2025-01-03 15:47:32 -08:00
bc14854c55
endpoint: more typefixes
2024-11-15 10:36:13 -06:00
c9186e0b7d
endpoint: lowercase rba types
2024-11-15 10:16:37 -06:00
514123089d
endpoint detection score field rename
2024-11-15 09:49:53 -06:00
f88eb16c6f
endpoint detection score fix
2024-11-15 09:34:59 -06:00
92cc97a5a7
endpoint first pass
2024-11-14 15:44:51 -06:00
0bb378b19b
updating drilldowns
2024-10-24 14:13:05 -07:00
8b03f3d58f
updating all detections with quotes
2024-10-24 14:08:37 -07:00
7bc11be7dc
updating drilldown_formatting
2024-10-23 18:25:39 -07:00
385ac7adc1
remove end hours
2024-10-23 17:52:24 -07:00
cf169b3de0
adding drilldowns to all
2024-09-30 22:04:57 +05:30
dafa859f55
The Haag Element: Breaking Down AA24-241A
2024-09-03 13:03:21 -06:00
a980709e4b
Modified macro name for clarity, updated how to implements with details
2024-07-26 14:11:24 -05:00
6f18511791
Merge branch 'develop' into nterl0k-rmm_must_die_update_1
2024-07-26 12:09:47 -05:00
09eb52ec50
Merge branch 'develop' into nterl0k-rmm_must_die_update_1
2024-07-26 10:32:02 -05:00
1f657a3689
Branch was auto-updated.
2024-07-25 17:42:20 -05:00
a86ea6fa51
Manual Testing flag due to ES Lookups
2024-07-25 10:52:00 -05:00
c35925b3a9
Haag's Hunt for Gozi Gremlins
2024-07-24 14:36:47 -06:00
87108a5aac
Improved data sources
2024-07-17 14:41:50 +02:00
9e0d8426c1
improved data source field
2024-07-16 14:06:31 +02:00
be8560118f
Update detect_remote_access_software_usage_process.yml
2024-07-09 08:44:59 -04:00
22e5ea3f83
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
6c5446cfbc
Release Branch - ESCU v4.32.0
2024-05-22 16:47:39 +00:00
046acb8871
ESCU v4.26.0 Release branch
2024-03-06 19:30:20 +00:00
Eric McGinnis