admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
18,530 Commits 697 Branches 195 Tags
fixDetectionTestingPassFail
Commit Graph

18530 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
pyth0n1c be2e0dfc61 Branch was auto-updated. 2022-07-29 15:44:06 -07:00
pyth0n1c f58e086d92 Branch was auto-updated. 2022-07-29 15:44:04 -07:00
pyth0n1c 9b9ee9b2bf Branch was auto-updated. 2022-07-29 15:44:01 -07:00
Jose Enrique Hernandez 014ea9855d Merge pull request #2311 from splunk/0729_playbooks 
Adding hunting playbook
 2022-07-29 18:43:40 -04:00
Lou Stella d1f890a4e9 Adding hunting playbook 2022-07-29 17:12:35 -05:00
pyth0n1c 44a58cb582 Merge pull request #2310 from splunk/FixDetectExcessiveLockoutDetections 
Fix Lockout Detections
 2022-07-29 14:25:56 -07:00
pyth0n1c aafee44783 Temporary fix to outstanding, known 
issue with field naming
 2022-07-29 14:23:49 -07:00
pyth0n1c 07d72ad142 Fixed a number of detections around anomalous aws 
console logins from different areas.  These include
city, country, and region. They are all built around
the same template and could still use some discussion.
 2022-07-29 14:22:50 -07:00
Michael Haag 978e4c3ef7 Update linux_ingress_tool_transfer_hunting.yml 
fixed risk
 2022-07-29 11:19:42 -06:00
Michael Haag 8ad83a0b5f Haag It 
Linux Curl Upload File
Linux Ingress Tool Transfer Hunting
Linux Ingress Tool Transfer with Curl
Linux Proxy Socks Curl
 2022-07-29 11:17:19 -06:00
tccontre a0336d013a dcrat-analytics3 2022-07-29 10:12:22 +02:00
tccontre bcb5aab4ee dcrat-analytics3 2022-07-29 10:06:40 +02:00
pyth0n1c 3dfd3c6ed6 Updated search strings from "lockout" 
to "*locked out*" to reflect the string
that actually appears in the logs.  Also,
removed the nodename from the seach
since it was not required.
 2022-07-28 17:17:21 -07:00
research bot b622c65def updating docs and package bits [ci skip] 2022-07-28 22:52:59 +00:00
pyth0n1c 1423e955d7 Branch was auto-updated. 2022-07-28 14:33:11 -07:00
pyth0n1c 32cbdc3c88 Branch was auto-updated. 2022-07-28 14:33:09 -07:00
Bhavin Patel 7bf7bfe134 Merge pull request #2278 from splunk/TR-2219_AzureAD_Password_Srapying 
Azure Active Directory Account Takeover Analytic Story
v3.46.0 		2022-07-28 14:32:50 -07:00
patel-bhavin 114df09d78 meta updates 2022-07-28 14:18:45 -07:00
Bhavin Patel 1b645a499c Update azure_ad_successful_single_factor_authentication.yml 2022-07-28 14:12:18 -07:00
Bhavin Patel 95e47b7fd4 Update azure_ad_unusual_number_of_failed_authentications_from_ip.yml 2022-07-28 14:11:40 -07:00
Bhavin Patel 22f3d9bfee Update azure_ad_successful_powershell_authentication.yml 2022-07-28 14:09:17 -07:00
Bhavin Patel 07290ffeb7 Update azure_ad_successful_powershell_authentication.yml 2022-07-28 14:08:32 -07:00
Bhavin Patel 42241b1b2e Update azure_ad_multiple_users_failing_to_authenticate_from_ip.yml 2022-07-28 14:07:47 -07:00
Bhavin Patel 72d0a37a12 Update azure_ad_authentication_failed_during_mfa_challenge.yml 2022-07-28 14:05:57 -07:00
Bhavin Patel f22813da22 Update azure_active_directory_high_risk_sign_in.yml 2022-07-28 14:05:14 -07:00
pyth0n1c 280d6aed18 Branch was auto-updated. 2022-07-28 13:50:33 -07:00
pyth0n1c faf01969d7 Branch was auto-updated. 2022-07-28 13:50:30 -07:00
pyth0n1c 204bf3192b Branch was auto-updated. 2022-07-28 13:50:29 -07:00
Bhavin Patel 21278f8d68 Merge pull request #2305 from splunk/dcrat-analytics2 
dcrat-analytics2
 2022-07-28 13:50:05 -07:00
pyth0n1c f4f375113e Branch was auto-updated. 2022-07-28 13:47:25 -07:00
pyth0n1c d963ff033c Branch was auto-updated. 2022-07-28 13:47:24 -07:00
pyth0n1c 7262660bd6 Branch was auto-updated. 2022-07-28 13:47:22 -07:00
pyth0n1c b3c8645b06 Branch was auto-updated. 2022-07-28 13:47:21 -07:00
Bhavin Patel 19dfced28f Merge pull request #2301 from splunk/haagonymous 
Haagnux
 2022-07-28 13:47:00 -07:00
Bhavin Patel f2731454b1 Update windows_system_time_discovery_w32tm_delay.yml 2022-07-28 13:30:37 -07:00
Bhavin Patel 979dd80466 Update windows_system_shutdown_commandline.yml 2022-07-28 13:28:00 -07:00
Bhavin Patel d71ddb7e26 Update windows_system_reboot_commandline.yml 2022-07-28 13:26:54 -07:00
Bhavin Patel c0427508a9 Update windows_command_shell_dcrat_forkbomb_payload.yml 2022-07-28 13:25:36 -07:00
Bhavin Patel 8f78e18334 Update windows_system_logoff_commandline.yml 2022-07-28 13:24:39 -07:00
Bhavin Patel 1498d090fe Update windows_system_reboot_commandline.yml 2022-07-28 13:23:33 -07:00
Bhavin Patel b2d1bdb62e Update windows_system_shutdown_commandline.yml 2022-07-28 13:23:07 -07:00
pyth0n1c 319530efa2 Branch was auto-updated. 2022-07-28 13:11:04 -07:00
pyth0n1c 5977a676f3 Branch was auto-updated. 2022-07-28 13:11:03 -07:00
pyth0n1c 53fb29f36e Branch was auto-updated. 2022-07-28 13:11:00 -07:00
pyth0n1c 82b586c77e Branch was auto-updated. 2022-07-28 13:10:59 -07:00
pyth0n1c e35f6dc30a Branch was auto-updated. 2022-07-28 13:10:57 -07:00
Bhavin Patel 099a7d029a Merge pull request #2293 from splunk/TR-2222_AWS_defense_evasion_story 
Tr 2222 aws defense evasion story
 2022-07-28 13:10:40 -07:00
Michael Haag e0bdf82ff3 Fix 
https://splunk.atlassian.net/browse/TR-2308
 2022-07-28 13:37:50 -06:00
Michael Haag 508424da99 Updates 2022-07-28 12:07:05 -06:00
d1vious f5a53d0a64 fixing base on feedback from users 2022-07-28 13:48:29 -04:00