Commit Graph

5587 Commits

Author SHA1 Message Date
Jose Enrique Hernandez ab74318614 Merge pull request #2178 from splunk/TR1807fix
Removing false positives
2022-04-27 16:01:35 -04:00
Lou Stella 28566660fa Removing false positives 2022-04-27 14:13:01 -05:00
pyth0n1c 46fcfbdf7c Branch was auto-updated. 2022-04-25 11:32:00 -07:00
Bhavin Patel 93b1f025dc Update windows_registry_modification_for_safe_mode_persistence.yml 2022-04-25 13:46:43 -04:00
Bhavin Patel 324b7b9dfc Update windows_iso_lnk_file_creation.yml
minor change
2022-04-25 13:44:30 -04:00
tccontre 1acfac609c industroyer2 2022-04-25 12:03:54 +02:00
tccontre 11d372b63c industroyer2 2022-04-25 09:36:55 +02:00
Michael Haag e04e3690f8 Update windows_registry_delete_task_sd.yml 2022-04-22 11:37:08 -06:00
Michael Haag 7d4e75523f Update windows_drivers_loaded_by_signature.yml 2022-04-22 10:32:33 -06:00
mhaag-spl abd668b260 updates and story 2022-04-22 10:21:29 -06:00
mhaag-spl 6ba1225077 SD Delete 2022-04-18 10:55:08 -06:00
mhaag-spl 12350f451e Update nltest_domain_trust_discovery.yml 2022-04-18 10:01:25 -06:00
pyth0n1c 5d8d3c0613 Branch was auto-updated. 2022-04-14 13:55:46 -07:00
d1vious fdcd471d5d moving to experimental 2022-04-14 16:37:54 -04:00
pyth0n1c 3cdd79a0dd Branch was auto-updated. 2022-04-14 13:34:35 -07:00
mhaag-spl 327042ede5 Merge branch 'fishsticks' of https://github.com/splunk/security_content into fishsticks 2022-04-14 14:13:26 -06:00
mhaag-spl b356157dc0 Update ssa___windows_rundll32_comsvcs_memory_dump.yml 2022-04-14 14:13:22 -06:00
pyth0n1c ef83f1ed8f Branch was auto-updated. 2022-04-14 13:09:52 -07:00
pyth0n1c 9ff0da4725 Branch was auto-updated. 2022-04-14 13:09:51 -07:00
Michael Haag ccffa29e3f Merge pull request #2171 from splunk/ssa_mshta_fix
Unicode + Regex = There be demons
2022-04-14 14:09:32 -06:00
mhaag-spl 79ee477a19 comsvcs 2022-04-14 14:04:13 -06:00
Lou Stella 71ad17def8 Modified 'required fields' 2022-04-14 14:43:30 -05:00
Lou Stella b75f8ed6aa Modifying field name 2022-04-14 14:40:38 -05:00
mhaag-spl c3e7e4c850 Update ssa___windows_lolbin_binary_in_non_standard_path.yml 2022-04-14 13:40:01 -06:00
mhaag-spl be60ac00b4 Revert "Update ssa___windows_lolbin_binary_in_non_standard_path.yml"
This reverts commit b25fc779c3.
2022-04-14 13:39:00 -06:00
Lou Stella 81e57c3591 Modified Regex 2022-04-14 14:37:01 -05:00
mhaag-spl b25fc779c3 Update ssa___windows_lolbin_binary_in_non_standard_path.yml 2022-04-14 13:20:46 -06:00
Lou Stella 3ad0e714fc push for Jud 2022-04-13 19:46:49 -05:00
pyth0n1c 558d47a35d Branch was auto-updated. 2022-04-13 05:29:58 -07:00
tccontre ce0f0852dd acidrain 2022-04-13 10:07:22 +02:00
tccontre a7bf512c15 acidrain 2022-04-13 09:34:11 +02:00
mhaag-spl cab258e211 Update windows_registry_certificate_added.yml 2022-04-12 15:29:20 -06:00
pyth0n1c 790b753e70 Branch was auto-updated. 2022-04-12 11:29:17 -07:00
pyth0n1c 03e2cf0b91 Branch was auto-updated. 2022-04-12 11:29:14 -07:00
Lou Stella ec66e01b78 Fixed formatting 2022-04-12 13:11:57 -05:00
Lou Stella da5eb1be3a Updated logic & fixed pathing 2022-04-12 12:01:48 -05:00
Lou Stella 63968601d2 parentheses to separate logic 2022-04-12 11:40:08 -05:00
tccontre 7c95560d2d Update linux_high_frequency_of_file_deletion_in_etc_folder.yml 2022-04-12 14:36:01 +02:00
tccontre 5c248ae716 Merge branch 'acidrain' of github.com:splunk/security_content into acidrain 2022-04-12 14:34:52 +02:00
tccontre 28d98d1af4 acidrain 2022-04-12 14:34:36 +02:00
pyth0n1c 4a9f25cd2c Branch was auto-updated. 2022-04-12 04:13:49 -07:00
pyth0n1c aada5bf4f9 Branch was auto-updated. 2022-04-12 04:13:38 -07:00
tccontre 558953524e Update linux_deletion_of_services.yml 2022-04-12 12:22:42 +02:00
tccontre 2f3cc3d6f5 Update linux_deletion_of_init_daemon_script.yml 2022-04-12 12:22:29 +02:00
tccontre fbbe658060 Update linux_deletion_of_cron_jobs.yml 2022-04-12 12:22:19 +02:00
tccontre 143b243003 Update linux_stdout_redirection_to_dev_null_file.yml 2022-04-12 12:21:20 +02:00
tccontre 43c89619b2 Update linux_kworker_process_commandline.yml 2022-04-12 12:21:10 +02:00
tccontre 58aa54a1da Update linux_iptables_firewall_modification.yml 2022-04-12 12:21:00 +02:00
tccontre 03ea408fc1 acidrain 2022-04-12 12:01:17 +02:00
tccontre ede69dcf57 Update linux_deletion_of_cron_jobs.yml 2022-04-12 11:34:55 +02:00