16 Commits

Author	SHA1	Message	Date
Eric McGinnis	db8c7c8509	Initial commit of modified objects. A small set of 5 kvstore lookups could not be git moved AND updated in the same operation because git instead interpreted this as deleting the old file and creating a new one. To preserve git history, the files have been moved in this commit and will be updated in the next commit.	2026-05-13 14:02:27 -07:00
Br3akp0int	7293d75700	Tagged Analytics Covering the Axios Compromise Post-Exploitation Activity (#3982) ... --------- Co-authored-by: Nasreddine Bencherchali <nbencher@cisco.com>	2026-04-02 16:07:20 +00:00
Nasreddine Bencherchali	11c909f725	Add YAML Formatting Job (#3889) ... * Add YAML formatting and validation infrastructure - Add yamlfmt configuration (.yamlfmt) with 4-space indent, LF line endings - Add yamllint configuration (.yamllint) for syntax validation (detections/ only) - Add pre-commit hook for automatic YAML formatting - Add CI validation script with unified error output - Add GitHub Actions workflow for PR validation - Add documentation for setup and usage - Support custom yamlfmt binary path via --yamlfmt-path flag * comment yaml check from pre-commit * apply yamlfmt * Update yaml-validation.yml * Update yaml-validation.yml * application folder search formatting * cloud folder search formatting * web folder search formatting * network folder search formatting * endpoint folder search formatting * resolve first conflict * apply formatting * remove additional pipe * Update README.md * update versions * restore and update formatting (#3920) --------- Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>	2026-02-26 00:00:35 +05:30
Br3akp0int	6b9201dbc3	Add SolarWinds WHD RCE Post Exploitation Coverage/Tagging (#3902) ... --------- Co-authored-by: Teoderick Contreras <tcontreras@splunk.com> Co-authored-by: Lou Stella <ljstella@gmail.com> Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com> Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>	2026-02-17 20:02:11 +01:00
Nasreddine Bencherchali	f49f3a3fc9	Fix Validation Issues (#3861)	2026-01-30 01:38:34 +01:00
Br3akp0int	73e69c0b84	stealc (#3833) ... * stealc * stealc * stealc * updating versions --------- Co-authored-by: Teoderick Contreras <tcontreras@splunk.com> Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com> Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com> Co-authored-by: Bhavin Patel <bpatel@splunk.com>	2026-01-22 18:51:16 +05:30
Michael Haag	64ed5bb1e8	APT 37 and The No Good Rustonotto (#3686) ... * APT 37 and The No Good Rustonotto ## Updated analytics ``` detections/application/detect_html_help_spawn_child_process.yml — APT37 Rustonotto and FadeStealer detections/endpoint/bitsadmin_download_file.yml — APT37 Rustonotto and FadeStealer detections/endpoint/cisco_nvm___suspicious_download_from_file_sharing_website.yml — APT37 Rustonotto and FadeStealer detections/endpoint/cobalt_strike_named_pipes.yml — APT37 Rustonotto and FadeStealer detections/endpoint/detect_html_help_renamed.yml — APT37 Rustonotto and FadeStealer detections/endpoint/detect_html_help_url_in_command_line.yml — APT37 Rustonotto and FadeStealer detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml — APT37 Rustonotto and FadeStealer detections/endpoint/detect_mshta_inline_hta_execution.yml — APT37 Rustonotto and FadeStealer detections/endpoint/detect_mshta_renamed.yml — APT37 Rustonotto and FadeStealer detections/endpoint/detect_mshta_url_in_command_line.yml — APT37 Rustonotto and FadeStealer detections/endpoint/detect_outlook_exe_writing_a_zip_file.yml — APT37 Rustonotto and FadeStealer detections/endpoint/detect_rundll32_inline_hta_execution.yml — APT37 Rustonotto and FadeStealer detections/endpoint/executables_or_script_creation_in_temp_path.yml — APT37 Rustonotto and FadeStealer detections/endpoint/icedid_exfiltrated_archived_file_creation.yml — APT37 Rustonotto and FadeStealer detections/endpoint/lolbas_with_network_traffic.yml — APT37 Rustonotto and FadeStealer detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml — APT37 Rustonotto and FadeStealer detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml — APT37 Rustonotto and FadeStealer detections/endpoint/powershell_4104_hunting.yml — APT37 Rustonotto and FadeStealer detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml — APT37 Rustonotto and FadeStealer detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml — APT37 Rustonotto and FadeStealer detections/endpoint/processes_tapping_keyboard_events.yml — APT37 Rustonotto and FadeStealer detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml — APT37 Rustonotto and FadeStealer detections/endpoint/registry_keys_used_for_persistence.yml — APT37 Rustonotto and FadeStealer detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml — APT37 Rustonotto and FadeStealer detections/endpoint/suspicious_curl_network_connection.yml — APT37 Rustonotto and FadeStealer detections/endpoint/suspicious_image_creation_in_appdata_folder.yml — APT37 Rustonotto and FadeStealer detections/endpoint/suspicious_mshta_spawn.yml — APT37 Rustonotto and FadeStealer detections/endpoint/suspicious_process_executed_from_container_file.yml — APT37 Rustonotto and FadeStealer detections/endpoint/suspicious_scheduled_task_from_public_directory.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_alternate_datastream___base64_content.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_archive_collected_data_via_powershell.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_archive_collected_data_via_rar.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_archived_collected_data_in_temp_folder.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_cab_file_on_disk.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_curl_download_to_suspicious_path.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_exfiltration_over_c2_via_invoke_restmethod.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_exfiltration_over_c2_via_powershell_uploadstring.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_file_download_via_powershell.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_high_file_deletion_frequency.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_http_network_communication_from_msiexec.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_indicator_removal_via_rmdir.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_input_capture_using_credential_ui_dll.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_iso_lnk_file_creation.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_office_product_spawned_child_process_for_download.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_office_product_spawned_uncommon_process.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_process_executed_from_removable_media.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_process_execution_from_programdata.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_process_injection_into_commonly_abused_processes.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_process_injection_into_notepad.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_replication_through_removable_media.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_scheduled_task_with_suspicious_command.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_scheduled_task_with_suspicious_name.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_screen_capture_in_temp_folder.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_screen_capture_via_powershell.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_service_created_with_suspicious_service_path.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_spearphishing_attachment_onenote_spawn_mshta.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_suspicious_driver_loaded_path.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_usbstor_registry_key_modification.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_user_execution_malicious_url_shortcut_file.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_wpdbusenum_registry_key_modification.yml — APT37 Rustonotto and FadeStealer detections/endpoint/winevent_scheduled_task_created_within_public_path.yml — APT37 Rustonotto and FadeStealer detections/web/multiple_archive_files_http_post_traffic.yml — APT37 Rustonotto and FadeStealer detections/web/plain_http_post_exfiltrated_data.yml — APT37 Rustonotto and FadeStealer detections/endpoint/windows_expand_cabinet_file_extraction.yml — APT37 Rustonotto and FadeStealer ``` ## New Story ``` stories/apt37_rustonotto_and_fadestealer.yml — APT37 Rustonotto and FadeStealer ``` * Create windows_expand_cabinet_file_extraction.yml * Apply suggestion from @nasbench Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com> * Update detections/endpoint/windows_expand_cabinet_file_extraction.yml Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com> * Update detections/endpoint/windows_expand_cabinet_file_extraction.yml Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com> * Update detections/endpoint/windows_expand_cabinet_file_extraction.yml Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com> * updating conflicts --------- Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com> Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com> Co-authored-by: Bhavin Patel <bpatel@splunk.com>	2025-10-13 13:54:03 -07:00
Michael Haag	a265197fd0	Update windows_process_execution_from_programdata.yml	2025-09-18 13:49:54 -06:00
Michael Haag	b6083e5076	GhostRedirectors	2025-09-18 13:39:40 -06:00
Teoderick Contreras	dfac5c5239	xworm	2025-05-08 11:00:32 +02:00
Eric	d9960562b8	Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.	2025-05-02 14:10:46 -07:00
Bhavin Patel	0d93ce9c0b	updating conflicts	2025-04-02 13:18:06 -07:00
Bhavin Patel	96bd1501b6	update inspect failures	2025-03-27 10:54:24 -07:00
Teoderick Contreras	02191943c2	renamed_earth_erties	2025-03-19 16:07:11 +01:00
Patrick Bareiss	a7f5db9f55	Merge branch 'develop' into output_normalization_endpoint	2025-03-14 14:05:39 +01:00
Nasreddine Bencherchali	e21fe10f83	Update and rename windows_process_file_path_in_programdata.yml to windows_process_execution_from_programdata.yml	2025-03-13 14:20:17 +01:00