3bdbc59422
The 5 kvstore lookups referenced in the previous commit that were intentionally moved, but not updated, have now been updated with the new format.
2026-05-13 14:04:13 -07:00
db8c7c8509
Initial commit of modified objects. A small set of 5 kvstore lookups could not be git moved AND updated in the same operation because git instead interpreted this as deleting the old file and creating a new one. To preserve git history, the files have been moved in this commit and will be updated in the next commit.
2026-05-13 14:02:27 -07:00
917fe77cc0
Add Big Batch of Snap Attack Converted Rules ( #4015 )
...
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
Co-authored-by: Bhavin Patel <bpatel@splunk.com >
2026-05-05 16:11:18 +02:00
ea5bd52238
Fix Issues - 2nd Round ( #3996 )
...
* Fix #3993
* Fix incorrect DS entries
* fix security_domain issue
* Fix #3992
* Fix #3988
* Update dump_lsass_via_procdump.yml
* Fix #3987
* Fix #3977
* Update network_connection_discovery_with_arp.yml
* Fix #3998
* Fix #3997
* fix versions
* revert change
* Fix #4012
* Update linux_file_creation_in_init_boot_directory.yml
* Update linux_file_creation_in_init_boot_directory.yml
* Fix #4010 and related
* fix typo
---------
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com >
2026-04-16 05:24:43 +00:00
27aeb7d95d
Add BlankGrabber Stealer Related Analytics and Tagging ( #3943 )
...
---------
Co-authored-by: Teoderick Contreras <tcontreras@splunk.com >
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com >
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2026-03-16 18:09:57 +01:00
34be5c0b0c
normalize all legacy line endings ( #3931 )
2026-03-02 23:34:35 +01:00
76f629eb2f
Update Analytics Performance ( #3866 )
...
* Update common_ransomware_notes.yml
* Update detect_rare_executables.yml
* update samsam ext
* update where clause to include null checks
* appinspect fixes
* reduce version
* fix where issue
* Update ransomware_notes_lookup.csv
* more perf enhancements
* Update windows_dotnet_binary_in_non_standard_path.yml
* fix ci issue and enhance description
* Update common_ransomware_extensions.yml
* Update common_ransomware_extensions.yml
* remove unknown and dash values
---------
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com >
2026-01-22 12:36:31 +00:00
20b0368e51
Added New HijackLibs Entry ( #3864 )
...
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2026-01-15 20:40:42 +01:00
6cc12a9b29
Analytic Enhancements and Fixes ( #3850 )
...
* update `Windows LOLBAS Executed Outside Expected Path`
* Update suspicious_email_attachment_extensions.yml
* update susp extension lookup
* some additional fixes
* Update system_processes_run_from_unexpected_locations.yml
* small changes
* Update detect_rtlo_in_file_name.yml
---------
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com >
2026-01-12 18:36:12 +05:30
498a80d469
Detections for default user agents ( #3842 )
...
* Detections for default user agents
* various updates for user agent detections
* Apply suggestions from code review
* Rename suspicious_user_agent.yml to suspicious_user_agents.yml
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2026-01-07 09:34:04 +05:30
6032db5edb
Add tuoni content and named pipe detection ( #3816 )
...
---------
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com >
2025-12-08 21:25:09 +01:00
5e86aa2345
add lokibot
2025-12-08 14:06:28 +01:00
b3d3fee5ee
re-order alphabetically
2025-12-08 13:55:27 +01:00
ce6fbc203d
update snort lookup
2025-12-08 13:53:41 +01:00
9fc8942993
New Rules & Updates - Oct 25 ( #3726 )
...
* new rules and updates
* fix issues with ci
* rename for accurate macro
* update description and logic
* new wbadmin rule and fix pwsh dataset
* more updates for the weekend
* update network rules filters
* downgrade versions
* Update windows_file_transfer_protocol_in_non_common_process_path.yml
* add missing DS for some rules
* update nirsoft lookup and add new rules
* update more nirsoft stuff
* update snort message
* Update cisco_secure_firewall_filetype_lookup.yml
* new analytic and updates / incl. fix #3730
* Update detect_new_local_admin_account.yml
* add lnx dataset and fix wildcards
2025-10-24 14:19:48 -07:00
7c092c7eb6
HTTP Request Smuggling ( #3731 )
...
* HTTP Request Smuggling
* Updates from PR comments
---------
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com >
2025-10-21 14:08:57 -07:00
21ee673940
Fix Issues & Updates ( #3705 )
...
* Fix Issues and Updates
* Update add_or_set_windows_defender_exclusion.yml
* Update windows_curl_download_to_suspicious_path.yml
* Fix more issues and bugs
* Update deprecation_mapping.YML
* Update windows_application_whitelisting_bypass_attempt_via_rundll32.yml
* More updates and fixes
* update `Windows Change Default File Association For No File Ext`
* A couple more updates for ya
* rename
* add / update rules
* Update windows_symlink_evaluation_change_via_fsutil.yml
* Update windows_symlink_evaluation_change_via_fsutil.yml
* Update linux_service_started_or_enabled.yml
* Update linux_service_started_or_enabled.yml
---------
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com >
2025-10-13 09:18:21 -07:00
17a4e1eb63
updating IDs
2025-09-24 11:20:12 -07:00
c31013241b
updatings with snort detection and lookup also contentctl
2025-08-21 09:43:02 -07:00
03f37bc312
udpated verison
2025-07-31 12:01:38 -05:00
905a1041d2
interlock_ransomware
2025-07-29 12:31:56 +02:00
6c857aac76
interlock_ransomware
2025-07-28 11:13:15 +02:00
627e4a263f
quasar_and_loader
2025-07-17 16:09:40 +02:00
98a7e95306
quasar_and_loader
2025-07-16 10:23:20 +02:00
e3bfb2da07
the final countdown
2025-07-06 02:57:39 +02:00
544645b87b
Update suspicious_ports_list.csv
2025-07-01 23:07:46 +02:00
75ec47e99a
add new detections, story and other cool things
2025-07-01 23:04:48 +02:00
f49bd318d9
update time 🚀
2025-06-30 13:55:55 +02:00
67c72b9035
add Cisco Secure Firewall - Remote Access Software Usage Traffic
2025-05-28 19:33:18 +02:00
78b11fa6a0
Update threat_snort_count.yml
2025-05-15 11:32:13 +02:00
559f472227
Rename threat_actor_snort_count.yml to threat_snort_count.yml
2025-05-15 11:31:59 +02:00
42da135696
Rename threat_actor_snort_count.csv to threat_snort_count.csv
2025-05-15 11:31:40 +02:00
8330f6bdf1
Apply suggestions from code review
2025-05-15 11:31:17 +02:00
e95c2d480d
updating code to use udpated names of lookup files
2025-05-14 13:50:22 -07:00
823652f4e2
lookup update
2025-05-13 17:41:13 -07:00
8f445c574a
updating lookup content and query
2025-05-13 13:57:44 -07:00
c1eef4cf0f
updating csv
2025-05-13 12:59:17 -07:00
0b0e5114ab
adding two lookups and updating query for test
2025-05-13 12:44:30 -07:00
29a64f2b56
change count to 4 based on dataset
2025-05-12 16:15:45 -07:00
933ff68b40
Merge branch 'develop' into snort_by_threat_actor
2025-05-12 15:36:31 -07:00
df33c55c9a
adding detection and lookup
2025-05-12 15:21:55 -07:00
629bc01aae
update output and nirsoft tools
2025-04-24 18:23:55 +02:00
614721e681
Merge branch 'develop' into remove_v5.4.0
2025-04-18 10:26:39 -07:00
8ca79f3f56
Merge branch 'develop' into cactus
2025-04-18 09:33:17 -06:00
0bdaf9647e
Merge branch 'develop' into remove_v5.4.0
2025-04-17 13:27:58 -07:00
96f7490cde
Merge branch 'develop' into remove_v5.4.0
2025-04-17 09:15:53 -07:00
d57b1686fd
Merge branch 'develop' into csftd_second_batch
2025-04-17 18:06:46 +02:00
0c57994c22
remove static lookup file
2025-04-16 16:00:49 -07:00
e1dc36ad07
revert wrong commit
2025-04-16 16:00:23 -07:00
b154c14045
remove static loookup
2025-04-16 15:52:45 -07:00
Eric McGinnis