 tccontre
|
dacebfebcf
|
Delete powershell_execute_com_object.yml
|
2021-08-16 15:01:13 +02:00 |
|
|
tccontre
|
8ea2d13a07
|
Delete fsutil_zeroing_file.yml
|
2021-08-16 15:00:55 +02:00 |
|
|
tccontre
|
af13307b13
|
Delete allow_inbound_traffic_in_firewall_rule.yml
|
2021-08-16 15:00:48 +02:00 |
|
|
tccontre
|
34b36eee9d
|
devsec_ops
devsec_ops
|
2021-08-16 14:59:06 +02:00 |
|
|
tccontre
|
7eba8594b3
|
conti_leak
|
2021-08-16 14:49:38 +02:00 |
|
|
root
|
e8e306362c
|
Added detection testing service results inUninstall App Using MsiExec
|
2021-08-16 14:49:38 +02:00 |
|
|
root
|
ede4862234
|
Added detection testing service results inRundll32 LockWorkStation
|
2021-08-16 14:49:38 +02:00 |
|
|
tccontre
|
6f3a90e5f6
|
conti_leak
|
2021-08-16 14:49:38 +02:00 |
|
|
root
|
ed734278df
|
Added detection testing service results inPowershell Execute COM Object
|
2021-08-16 14:49:38 +02:00 |
|
|
root
|
d11d58d8db
|
Added detection testing service results inFsutil Zeroing File
|
2021-08-16 14:49:38 +02:00 |
|
|
tccontre
|
092996bd09
|
lockbit_ttp
|
2021-08-16 14:49:38 +02:00 |
|
|
tccontre
|
e1a96aed84
|
conti_leak
|
2021-08-16 14:49:38 +02:00 |
|
|
tccontre
|
51e4ec72c1
|
conti_leak
|
2021-08-16 14:49:38 +02:00 |
|
|
tccontre
|
d7c5f02d84
|
conti leak
conti leak
|
2021-08-16 14:49:37 +02:00 |
|
|
tccontre
|
07768fb305
|
conti_leak
conti_leak
|
2021-08-16 14:49:37 +02:00 |
|
|
research bot
|
a2bb49f089
|
updating docs and package bits [ci skip]
|
2021-08-12 18:43:04 +00:00 |
|
|
tccontre
|
dcfab01e14
|
icedid
|
2021-08-12 09:25:43 +02:00 |
|
|
github-actions[bot]
|
f078e35f81
|
Branch was auto-updated.
|
2021-08-11 19:35:37 +00:00 |
|
|
patel-bhavin
|
9f71b88e6c
|
duplicate
|
2021-08-11 11:24:14 -07:00 |
|
|
github-actions[bot]
|
7c85b0dfd8
|
Branch was auto-updated.
|
2021-08-09 18:42:36 +00:00 |
|
|
root
|
4e3dc7fe9c
|
Added detection testing service results inSqlite Module In Temp Folder
|
2021-08-05 15:43:52 +00:00 |
|
|
tccontre
|
9a79673dbd
|
Merge branch 'icedid' of github.com:splunk/security_content into icedid
|
2021-08-05 17:22:51 +02:00 |
|
|
tccontre
|
5e8393c3b7
|
icedid
|
2021-08-05 17:22:35 +02:00 |
|
|
root
|
665a99e197
|
Added detection testing service results inSuspicious IcedID Regsvr32 Cmdline
|
2021-08-05 14:54:43 +00:00 |
|
|
Detection Testing Service
|
765f7a184f
|
Merge branch 'icedid' of https://github.com/splunk/security_content into icedid
|
2021-08-05 14:26:04 +00:00 |
|
|
root
|
442cbd9787
|
Added detection testing service results inDrop IcedID License dat
|
2021-08-05 14:26:02 +00:00 |
|
|
Detection Testing Service
|
ba91dfc63f
|
Merge branch 'icedid' of https://github.com/splunk/security_content into icedid
|
2021-08-05 14:25:26 +00:00 |
|
|
root
|
a79f8718eb
|
Added detection testing service results inIcedID Exfiltrated Archived File Creation
|
2021-08-05 14:25:26 +00:00 |
|
|
Detection Testing Service
|
40cf94a229
|
Merge branch 'icedid' of https://github.com/splunk/security_content into icedid
|
2021-08-05 14:11:56 +00:00 |
|
|
root
|
8c20f6fdb0
|
Added detection testing service results inCHCP Command Execution
|
2021-08-05 14:11:56 +00:00 |
|
|
Detection Testing Service
|
549cb603b8
|
Merge branch 'icedid' of https://github.com/splunk/security_content into icedid
|
2021-08-05 14:10:59 +00:00 |
|
|
root
|
ea12f51783
|
Added detection testing service results inOffice Application Spawn Regsvr32 process
|
2021-08-05 14:10:58 +00:00 |
|
|
Detection Testing Service
|
83dd255433
|
Merge branch 'icedid' of https://github.com/splunk/security_content into icedid
|
2021-08-05 14:09:32 +00:00 |
|
|
root
|
2b3346a7c5
|
Added detection testing service results inCreate Remote Thread In Shell Application
|
2021-08-05 14:09:32 +00:00 |
|
|
Detection Testing Service
|
b109f5517e
|
Merge branch 'icedid' of https://github.com/splunk/security_content into icedid
|
2021-08-05 14:08:17 +00:00 |
|
|
root
|
e0b24a1984
|
Added detection testing service results inSuspicious Rundll32 PluginInit
|
2021-08-05 14:08:16 +00:00 |
|
|
Detection Testing Service
|
4990119ca4
|
Merge branch 'icedid' of https://github.com/splunk/security_content into icedid
|
2021-08-05 14:00:50 +00:00 |
|
|
root
|
7ac92524f1
|
Added detection testing service results inSuspicious IcedID Rundll32 Cmdline
|
2021-08-05 14:00:49 +00:00 |
|
|
Detection Testing Service
|
6d6f066d47
|
Merge branch 'icedid' of https://github.com/splunk/security_content into icedid
|
2021-08-05 13:45:15 +00:00 |
|
|
root
|
de016c4686
|
Added detection testing service results inRundll32 Process Creating Exe Dll Files
|
2021-08-05 13:45:14 +00:00 |
|
|
Detection Testing Service
|
890546ac8b
|
Merge branch 'icedid' of https://github.com/splunk/security_content into icedid
|
2021-08-05 13:36:43 +00:00 |
|
|
root
|
0fde378b6f
|
Added detection testing service results inRundll32 DNSQuery
|
2021-08-05 13:36:42 +00:00 |
|
|
root
|
f9d9e07f7b
|
Added detection testing service results inRundll32 CreateRemoteThread In Browser
|
2021-08-05 13:34:25 +00:00 |
|
|
root
|
4d47c30783
|
Added detection testing service results inRundll32 Create Remote Thread To A Process
|
2021-08-05 13:10:18 +00:00 |
|
|
tccontre
|
ede0bd7675
|
icedid
|
2021-08-05 13:48:42 +02:00 |
|
|
tccontre
|
c7e8f72fa6
|
icedid
|
2021-08-05 13:36:35 +02:00 |
|
|
tccontre
|
8539d351da
|
icedid
|
2021-08-04 11:49:52 +02:00 |
|
|
peter-cg
|
f8fc79d4e1
|
Adding event_id extraction
|
2021-08-03 14:56:18 -05:00 |
|
|
Jose Enrique Hernandez
|
b8fea6311e
|
Delete powershell_encoded_command.yml
|
2021-08-03 14:56:17 -05:00 |
|
|
divious1
|
d7000e7608
|
added event_id to ssa detections
|
2021-08-03 14:56:17 -05:00 |
|