629bc01aae
update output and nirsoft tools
2025-04-24 18:23:55 +02:00
614721e681
Merge branch 'develop' into remove_v5.4.0
2025-04-18 10:26:39 -07:00
8ca79f3f56
Merge branch 'develop' into cactus
2025-04-18 09:33:17 -06:00
0bdaf9647e
Merge branch 'develop' into remove_v5.4.0
2025-04-17 13:27:58 -07:00
96f7490cde
Merge branch 'develop' into remove_v5.4.0
2025-04-17 09:15:53 -07:00
d57b1686fd
Merge branch 'develop' into csftd_second_batch
2025-04-17 18:06:46 +02:00
0c57994c22
remove static lookup file
2025-04-16 16:00:49 -07:00
e1dc36ad07
revert wrong commit
2025-04-16 16:00:23 -07:00
b154c14045
remove static loookup
2025-04-16 15:52:45 -07:00
953c8d59da
Merge branch 'develop' into csftd_first_batch
2025-04-09 16:34:47 +02:00
e9caa0de7c
cisco secure firewall detections - second batch
2025-04-09 12:33:51 +02:00
889c08ebbf
chore: update lookup date and version
2025-04-04 11:32:45 -04:00
5f1d8f6b3f
fix: addtl remote_utility typo in remote_access_software.csv
2025-04-04 11:32:32 -04:00
66889be8a6
fix: remote_utility typo in remote_access_software.csv
2025-04-04 11:20:21 -04:00
53e3105db8
Merge branch 'develop' into csftd_first_batch
2025-04-03 20:59:14 +02:00
0f084c4fb7
update lookup name
2025-04-03 14:24:53 +02:00
f39a6d9a50
cisco secure firewall detections - first batch
2025-04-03 14:21:27 +02:00
0d831661a6
updating detections with conflicts
2025-04-02 11:41:46 -07:00
f8d1d71db9
Merge branch 'develop' into medusa_ransomware
2025-04-02 11:22:19 -07:00
7666d3793f
Merge branch 'develop' into cactus
2025-04-01 14:56:49 -06:00
b31f246793
medusa_ransomware
2025-04-01 12:54:03 +02:00
ada8585d6f
Merge branch 'develop' into rceattack
2025-03-31 12:05:21 -06:00
db0455a024
Merge branch 'develop' into win_sus_service_fix
2025-03-28 12:36:36 -07:00
7e1cc06c3c
Merge branch 'develop' into win_sus_service_fix
2025-03-28 09:50:36 -07:00
14bf638d06
Merge branch 'develop' into vanhelsing
2025-03-28 09:48:19 -07:00
60e4f3881c
Adding default match back to lookups where used
2025-03-26 13:03:42 -05:00
a0b45b8248
update lookup and revert back to where isnotnull
2025-03-26 16:01:17 +00:00
f491d2a512
Removing default match from lookups
2025-03-26 11:01:05 -05:00
dfd995e93f
Merge branch 'develop' into rceattack
2025-03-24 19:25:46 -06:00
e6b1c4d102
The Haag Has Landed: VanHelsing's Revenge
...
Added VanHelsing Ransomware analytic story and associated it with relevant detections. Updated 7 existing detections to include VanHelsing Ransomware in their analytic stories:
- detect_renamed_psexec.yml
- detect_psexec_with_accepteula_flag.yml
- executable_file_written_in_administrative_smb_share.yml
- deleting_shadow_copies.yml
- delete_shadowcopy_with_powershell.yml
- detect_copy_of_shadowcopy_with_script_block_logging.yml
- resize_shadowstorage_volume.yml
- Updated ransomware extensions
The story provides comprehensive coverage of this new ransomware-as-a-service threat, focusing on its key TTPs including shadow copy deletion, process hollowing, and encryption behaviors.
2025-03-24 13:43:51 -06:00
0bde0e2bf8
Merge branch 'develop' into cactus
2025-03-20 11:15:34 -06:00
5e8e6cbdf8
Update ransomware_extensions_lookup.yml
2025-03-19 09:57:31 -06:00
58aca7db99
Update the deprecation_info.csv file, manually generated with a version of contentctl that has not yet been merged or released in main branch.
2025-03-18 15:41:21 -07:00
f07bb01e83
Haag's Last Shadow: The Cactus Ransomware Chronicles
...
## New Stories
- Cactus Ransomware
## New Analytics
- Windows WMIC Shadowcopy Delete
2025-03-18 11:53:26 -06:00
17f0b8e5f3
attacker tools
2025-03-17 12:47:17 -06:00
1dca8f9f38
Merge branch 'develop' into deprecated_mapping_update
2025-03-17 11:43:14 -07:00
3b8c44ca28
PHP-CGI RCE Attack on Japanese Organizations
2025-03-17 12:28:10 -06:00
1b845ba176
Merge branch 'develop' into systembc
2025-03-17 10:27:20 -07:00
bebfe2e13e
updating lookups from latest mapping
2025-03-13 18:12:45 -07:00
93b714ec08
Merge branch 'develop' into nterl0k-t1053-suspicious-task-lookups
2025-03-11 13:26:31 -07:00
6e84f4cab9
updating lookup
2025-03-03 16:20:52 -08:00
d87b3f6a48
systembc
2025-03-03 15:10:33 +01:00
c8087bc330
systembc
2025-03-03 14:12:55 +01:00
489bcc427d
Merge branch 'develop' into nterl0k-t1053-suspicious-task-lookups
2025-02-28 12:44:17 -08:00
9428a91911
Merge branch 'develop' into 8_million_requests
2025-02-20 17:53:03 -05:00
347caf1538
remove empty coloums
2025-02-20 09:04:20 -08:00
f6646f58c6
Merge branch 'splunk:develop' into nterl0k-t1053-suspicious-task-lookups
2025-02-20 07:00:51 -05:00
7907bd82d8
remove lookup CSV that is not used
2025-02-19 14:51:59 -08:00
fde93c6d32
convert csv lookup to kvstore lookup.
...
Update references in description files
as well.
2025-02-19 14:50:53 -08:00
bdb79594e5
Merge branch 'develop' into 8_million_requests
2025-02-19 13:57:40 -08:00
Nasreddine Bencherchali