bc18194661
Reordering keys
2026-05-19 14:21:30 -04:00
9dfb1706f9
Manual Review of correlation searches
2026-05-19 10:10:45 -04:00
db8c7c8509
Initial commit of modified objects. A small set of 5 kvstore lookups could not be git moved AND updated in the same operation because git instead interpreted this as deleting the old file and creating a new one. To preserve git history, the files have been moved in this commit and will be updated in the next commit.
2026-05-13 14:02:27 -07:00
ba59855b1d
updating risk drilldowns ( #4016 )
...
* updating drilldows
* inspect failures
* updating versions
* updating versins
* chore: empty commit to trigger CI
2026-04-17 17:28:53 +05:30
11c909f725
Add YAML Formatting Job ( #3889 )
...
* Add YAML formatting and validation infrastructure
- Add yamlfmt configuration (.yamlfmt) with 4-space indent, LF line endings
- Add yamllint configuration (.yamllint) for syntax validation (detections/ only)
- Add pre-commit hook for automatic YAML formatting
- Add CI validation script with unified error output
- Add GitHub Actions workflow for PR validation
- Add documentation for setup and usage
- Support custom yamlfmt binary path via --yamlfmt-path flag
* comment yaml check from pre-commit
* apply yamlfmt
* Update yaml-validation.yml
* Update yaml-validation.yml
* application folder search formatting
* cloud folder search formatting
* web folder search formatting
* network folder search formatting
* endpoint folder search formatting
* resolve first conflict
* apply formatting
* remove additional pipe
* Update README.md
* update versions
* restore and update formatting (#3920 )
---------
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com >
2026-02-26 00:00:35 +05:30
d9960562b8
Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.
2025-05-02 14:10:46 -07:00
5b7cfdb7d3
updating versions
2025-04-16 16:45:16 -07:00
ec5cf468e3
The Haag Identity: Operation Seashell Blizzard 🌊 ❄️
...
This PR introduces comprehensive updates to our detection analytics, focusing on tagging relevant detections with the new "Seashell Blizzard" analytic story. The changes include:
Version and date updates across 20 detection files, with dates standardized to '2025-03-24' or '2025-03-25', and version numbers incremented appropriately.
Analytics tagged with "Seashell Blizzard" include:
ConnectWise ScreenConnect vulnerability detections (authentication bypass, path traversal)
Exchange Server exploitation detections (ProxyShell, ProxyNotShell, web shell)
Credential access monitoring (LSASS dumps via TaskMgr and ProcDump)
Remote access software usage detections (file, process, registry)
Scheduled task abuse detections
SQL Server xp_cmdshell configuration changes
Registry hive dumping detection
Key updates:
- Added "Seashell Blizzard" tag to 20 existing detections
These changes enhance our ability to track and detect activities associated with the Seashell Blizzard threat actor.
2025-03-24 14:18:40 -06:00
d1442c2805
remove update_timestamps, confidence, impact,
...
related_fields, and risk_score from detections
2025-01-03 15:25:52 -08:00
b600be3ad9
web: remove rba config from correlations
2024-11-15 11:42:52 -06:00
393c038cf4
web: more typefixes
2024-11-15 10:37:23 -06:00
6384bea952
web: lowercase rba types
2024-11-15 10:17:03 -06:00
a33df66bec
web detection score field rename
2024-11-15 09:50:18 -06:00
c4eb58cd71
web detections score fix
2024-11-15 09:40:45 -06:00
c218c03e48
web detections initial translation
2024-11-15 09:04:43 -06:00
0bb378b19b
updating drilldowns
2024-10-24 14:13:05 -07:00
8b03f3d58f
updating all detections with quotes
2024-10-24 14:08:37 -07:00
7bc11be7dc
updating drilldown_formatting
2024-10-23 18:25:39 -07:00
385ac7adc1
remove end hours
2024-10-23 17:52:24 -07:00
cf169b3de0
adding drilldowns to all
2024-09-30 22:04:57 +05:30
22e5ea3f83
Release Branch - ESCU v4.34.0
2024-06-26 14:41:53 +00:00
f78e4404d2
blackbyte_campaign
2023-07-10 12:55:29 +02:00
c541aacf10
T1133 Tags + description updates
2023-06-01 13:44:32 -06:00
78909f6429
merged with develop
2023-03-03 12:40:16 +01:00
ffa1210a00
merged with develop
2023-02-02 09:15:59 +01:00
11ff0fa87d
onenote
2023-01-24 06:38:23 -07:00
fd0c8b349f
updated tags
2023-01-09 09:33:30 +01:00
5ae53c9368
Migrated all detections to v4
2023-01-03 13:42:10 +01:00
82387357eb
Update proxyshell_proxynotshell_behavior_detected.yml
2022-10-10 10:09:11 -06:00
df804a8343
ProxyShell ProxyNotShell Behavior Detected
2022-10-09 07:31:02 -06:00
ljstella