284 Commits

Author	SHA1	Message	Date
P4T12ICK	53bf235622	k8s scanner detection	2021-08-24 14:39:15 +02:00
github-actions[bot]	8ff6371446	Branch was auto-updated.	2021-08-23 15:21:50 +00:00
github-actions[bot]	6f0170b022	Branch was auto-updated.	2021-08-23 15:21:43 +00:00
P4T12ICK	749df59357	new detection	2021-08-23 10:17:40 +02:00
tccontre	e5ae722014	dev_git	2021-08-20 13:59:06 +02:00
github-actions[bot]	3f90fc50cb	Branch was auto-updated.	2021-08-19 15:42:43 +00:00
P4T12ICK	dd419961e7	container upload aws ecr	2021-08-19 15:51:17 +02:00
mhaag-spl	0e19432a1d	msbuild and microsoftworkflowcompiler	2021-08-19 06:57:11 -06:00
github-actions[bot]	59ae237866	Branch was auto-updated.	2021-08-19 11:15:58 +00:00
mhaag-spl	495a94bbbc	Update process_esentutl.yml	2021-08-18 11:14:13 -06:00
mhaag-spl	1eb1f40ae0	esentutil ... Related to Conti leaks	2021-08-18 10:47:58 -06:00
mhaag-spl	09f29ad081	macros	2021-08-18 09:50:08 -06:00
tccontre	1bde88fc3f	dev_ops_uc	2021-08-18 15:58:35 +02:00
mhaag-spl	d648d525b3	macro'd bitsadmin	2021-08-17 15:20:40 -06:00
mhaag-spl	71481634a3	macro'd netsh	2021-08-17 15:14:35 -06:00
mhaag-spl	ba6c98c292	macro'd certutil	2021-08-17 15:00:51 -06:00
mhaag-spl	e1752d3440	macro'd hh	2021-08-17 14:29:16 -06:00
mhaag-spl	5dc0e8f211	macro'd net	2021-08-17 13:56:57 -06:00
mhaag-spl	a1a670203f	macro'd mshta	2021-08-17 13:38:11 -06:00
mhaag-spl	ad88e9a0ff	macro'd regsvr32	2021-08-17 13:27:48 -06:00
mhaag-spl	3251fcc1f6	macrod rundll32	2021-08-17 13:21:24 -06:00
mhaag-spl	644747d578	macro'd reg cmd	2021-08-17 12:09:31 -06:00
mhaag-spl	9958c82c3c	macro'd wmic	2021-08-17 11:44:30 -06:00
Michael Haag	c4a62635b1	Merge branch 'develop' into The-Haag-of-The-Storm	2021-08-17 11:19:42 -06:00
mhaag-spl	20000828f3	Macro'd powershell	2021-08-17 11:15:36 -06:00
P4T12ICK	686b0b5ca4	converted response_task to investigations	2021-07-26 13:39:17 +02:00
mhaag-spl	bd69016d7e	PowerShell 4104 copy of Security HIVES ... Modified macro to capture both XML rendered and non. Issue is, if you renderXML for powershell logging, it will have different fields. Something to be aware of.	2021-07-21 13:57:10 -06:00
mhaag-spl	0c86774b15	Added a Macro	2021-07-01 12:11:49 -06:00
bpatel	4a840d4184	ericks detections from xmrig	2021-05-12 12:58:00 -07:00
Bhavin Patel	3aa6adebd6	Merge branch 'develop' into sh_test	2021-02-03 14:24:50 -08:00
P4T12ICK	7f8652b85b	bug fix	2021-02-03 15:44:56 +01:00
bpatel	4fb0488ac6	duplicating files and experimental	2021-01-28 17:35:25 -08:00
bpatel	ec76d28b60	rename	2021-01-26 19:28:03 -08:00
bpatel	edeaa89c7d	macros for all	2021-01-26 18:53:01 -08:00
David Dorsey	fd76342c94	Changed the language in some of the descriptions	2021-01-21 23:53:47 -06:00
P4T12ICK	58627b44f9	changes	2020-12-15 12:27:16 +01:00
P4T12ICK	5fee68375f	fix_bugs	2020-12-11 10:51:02 +01:00
bpatel	25c7f33866	app inspect failures fixes	2020-12-08 14:56:39 -08:00
bpatel	c156c18b6b	files not needed	2020-12-08 11:15:24 -08:00
Jose Enrique Hernandez	3c1cfbf4de	Merge branch 'develop' into develop	2020-11-18 13:30:38 -05:00
Bhavin Patel	398ee5f947	Merge pull request #843 from splunk/ransomwares3 ... Ransomwares3	2020-11-12 11:51:39 -08:00
Jose Enrique Hernandez	3e9513f4b8	Merge branch 'develop' into develop	2020-11-11 22:04:16 -05:00
Jose Enrique Hernandez	4acc8c3efb	Merge branch 'develop' into mbjerkeland-develop	2020-11-11 22:03:44 -05:00
Bhavin Patel	e185ca89ba	Merge branch 'develop' into ransomwares3	2020-11-11 16:36:34 -08:00
Bhavin Patel	3aa06e82b6	Merge branch 'develop' into mustang_beta	2020-11-10 09:59:18 -08:00
bpatel	64bd08b5ff	these macro files are not needed	2020-11-10 09:14:23 -08:00
P4T12ICK	1f3f1ae408	Merge branch 'develop' into mbjerkeland-develop	2020-11-10 09:24:55 +01:00
Shannon Davis	098aa9019a	mods	2020-11-06 11:08:38 +11:00
P4T12ICK	8a66f8e175	changed macro	2020-11-05 09:18:37 +01:00
Mikael Bjerkeland	17502e4722	Added various Network Infrastructure detections based on the MITRE Network Matrix	2020-10-28 23:14:06 +01:00