97bc95f773
bug fix
2022-08-04 14:55:21 +02:00
7422fb3eda
dcrat-analytics3
2022-08-04 09:44:22 +02:00
c1b74d4675
Branch was auto-updated.
2022-08-04 00:42:15 -07:00
8d32deae1e
Branch was auto-updated.
2022-08-04 00:42:14 -07:00
7e57901376
Branch was auto-updated.
2022-08-04 00:42:12 -07:00
8e8871603f
Branch was auto-updated.
2022-08-04 00:42:10 -07:00
59c80dae8d
Branch was auto-updated.
2022-08-04 00:42:08 -07:00
1ee1b76968
Branch was auto-updated.
2022-08-04 00:42:05 -07:00
6343ecb5ea
Branch was auto-updated.
2022-08-04 00:42:03 -07:00
5355b4f2f1
Merge pull request #2297 from splunk/attack_data_helper
...
attack_data_helper
2022-08-04 09:41:41 +02:00
0fb17dd617
bug fix
2022-08-04 09:28:56 +02:00
939493337d
adding research site links
2022-08-03 17:34:32 -04:00
ca11a32aeb
dcrat-analytics3
2022-08-03 17:53:06 +02:00
ce9980bcfb
Branch was auto-updated.
2022-08-03 08:28:31 -07:00
ddee50f930
Branch was auto-updated.
2022-08-03 08:28:29 -07:00
c0d5fd80e0
Branch was auto-updated.
2022-08-03 08:28:28 -07:00
aa7660ecec
Branch was auto-updated.
2022-08-03 08:28:26 -07:00
3d16da7d47
Branch was auto-updated.
2022-08-03 08:28:25 -07:00
439779d28e
Branch was auto-updated.
2022-08-03 08:28:23 -07:00
eb30f6c6fd
Branch was auto-updated.
2022-08-03 08:28:23 -07:00
d9649aeaf3
Branch was auto-updated.
2022-08-03 08:28:22 -07:00
0ded2877dd
Merge pull request #2261 from splunk/security_content_automation
...
Enrich detections with supported TAs
2022-08-03 08:28:02 -07:00
87a8bc0442
Merged develop into this branch and resolved merge conflicts.
2022-08-03 06:47:22 -07:00
544afe862c
edit risk score
2022-08-02 16:34:22 -04:00
29a61f8cb6
Add detections for Awk, Node, Docker Lotl
2022-08-02 16:23:31 -04:00
66a679471c
Merge branch 'develop' into faking_appcert
2022-08-02 11:36:23 -04:00
c9099e8a41
doing a fix to pass appcert
2022-08-02 11:28:58 -04:00
99d0b47a14
Update active_directory_password_spraying.yml
2022-08-02 11:22:22 -04:00
83e57921ad
iscsi fix
2022-08-02 08:35:54 -06:00
9cfa2151e7
Update windows_ingress_tool_transfer_using_explorer.yml
2022-08-02 14:01:38 +02:00
da230f6ed6
dcrat-analytics3
2022-08-02 13:31:49 +02:00
e189299cf2
dcrat-analytics3
2022-08-02 12:00:40 +02:00
c71b04a866
Updated detection files with recommended TA list.
2022-08-01 18:43:39 +00:00
4fb7bb3306
Merge branch 'dcrat-analytics3' of github.com:splunk/security_content into dcrat-analytics3
2022-08-01 17:34:40 +02:00
0fc18fcbdb
dcrat-analytics3
2022-08-01 17:34:21 +02:00
2df3a64798
Rename windows_ingress_tool_transfer_using_explorer_exe.yml to windows_ingress_tool_transfer_using_explorer.yml
2022-08-01 14:23:01 +02:00
44517188c1
Rename windows_ingress_tool_transfer_using_explorer_exe.test.yml to windows_ingress_tool_transfer_using_explorer.test.yml
2022-08-01 14:22:35 +02:00
f3f40edf9e
Update windows_gather_victim_host_information_camera.yml
2022-08-01 14:22:03 +02:00
7ef8d1dadf
Update windows_ingress_tool_transfer_using_explorer_exe.test.yml
2022-08-01 14:18:38 +02:00
d8690a4386
Update windows_ingress_tool_transfer_using_explorer_exe.yml
2022-08-01 14:18:20 +02:00
b67f2c69a1
dcrat-analytics3
2022-08-01 14:15:02 +02:00
9dac698c46
solve merge conflicts
2022-08-01 11:39:02 +02:00
bcb943d150
fix tests
2022-08-01 11:31:23 +02:00
1b3707932b
Fixed known outstanding issue with process_name
...
and parent_process_name
2022-07-31 16:49:35 -07:00
cdbdc51033
Patched for a known outstanding issue -
...
process_name to parent_process_name
2022-07-31 16:47:59 -07:00
e2c3c7590d
Changed process_name to parent_process_name
...
Known issue pending a fix.
2022-07-31 15:25:56 -07:00
08107a940e
Quoted strings in severity field. Fixed typo
...
in severity field list from UNKNWON to
UNKOWN. Removed the non-existent
stats field 'user' (username exists) which
was causing the test to fail, returning
no results.
2022-07-31 15:09:35 -07:00
bbd4b67e9d
fixed query
...
modified query to use NOT instead of !=
2022-07-30 06:02:04 -06:00
8bc3086675
iscsicpl
2022-07-29 17:39:55 -06:00
f9771fa90e
Branch was auto-updated.
2022-07-29 15:44:09 -07:00
P4T12ICK