1048 Commits

Author	SHA1	Message	Date
Nasreddine Bencherchali	cc57496610	add analytic story	2025-05-05 15:05:24 +02:00
Michael Haag	074d13f001	BasketNetWeaving with Haag: No Shell Left Behind!	2025-04-28 10:33:17 -06:00
Eric	a219deb751	Merge branch 'develop' into water	2025-04-21 10:25:16 -07:00
Bhavin Patel	067eb13fe1	Merge branch 'develop' into dep_cli	2025-04-18 13:48:27 -07:00
Bhavin Patel	93a1b752fe	updating this detection	2025-04-18 13:35:11 -07:00
Bhavin Patel	bb2045cce0	Merge branch 'develop' into crushingit	2025-04-18 12:45:18 -07:00
Bhavin Patel	614721e681	Merge branch 'develop' into remove_v5.4.0	2025-04-18 10:26:39 -07:00
pyth0n1c	aa3187d61e	Merge branch 'develop' into remove_v5.4.0	2025-04-18 10:13:12 -07:00
Bhavin Patel	949b59900f	Merge branch 'develop' into water	2025-04-18 10:11:56 -07:00
Bhavin Patel	9ae046285e	Merge branch 'develop' into cactus	2025-04-18 09:52:02 -07:00
Michael Haag	8ca79f3f56	Merge branch 'develop' into cactus	2025-04-18 09:33:17 -06:00
Bhavin Patel	eae0a4ed66	updating spls to match with output from data sources	2025-04-17 14:49:05 -07:00
Bhavin Patel	5e6418ee6e	Merge branch 'develop' into aws_bedrock	2025-04-17 14:24:55 -07:00
Bhavin Patel	8e6d4c69bf	Merge branch 'develop' into remove_v5.4.0	2025-04-17 12:00:27 -07:00
Michael Haag	e913143339	Water Gamayun	2025-04-17 11:26:37 -06:00
Bhavin Patel	bc6635d225	Merge branch 'develop' into storm	2025-04-17 10:04:45 -07:00
Bhavin Patel	96f7490cde	Merge branch 'develop' into remove_v5.4.0	2025-04-17 09:15:53 -07:00
Bhavin Patel	b0f1eaa08e	Merge branch 'develop' into storm	2025-04-17 09:10:45 -07:00
Bhavin Patel	c4bca6ff3b	Merge branch 'develop' into earth	2025-04-17 08:58:49 -07:00
Michael Haag	657ffbc9e4	Ground Control to Major Haag: Earth Alux ... This PR adds a new analytic story for the Earth Alux threat actor, a sophisticated espionage group targeting government, technology, and telecommunications sectors in APAC and Latin America.	2025-04-16 21:55:12 -06:00
Michael Haag	8a5556b252	The Haag Identity: Storm-2460 CLFS Zero Day ... This PR adds comprehensive detection coverage for the Storm-2460 CLFS zero-day exploitation campaign. Changes include: - New analytic story documenting the full attack chain - Tagged 17 existing detections with the story - Coverage for MSBuild abuse, CertUtil usage, and system recovery tampering The story covers the complete attack lifecycle from initial CLFS driver exploitation through ransomware deployment, with detections for: - MSBuild execution and renaming - CertUtil download and decode operations - ProcDump credential theft - System recovery disabling (bcdedit, wbadmin) - Event log clearing (wevtutil)	2025-04-16 21:25:23 -06:00
Bhavin Patel	bf3fe8b361	remove yamls and update mapping	2025-04-15 15:19:48 -07:00
Michael Haag	fc81c76727	Haag's Crushed Shell: A Tale of CrushFTP Exploitation ... CVE-2025-31161	2025-04-14 12:39:07 -06:00
Bhavin Patel	b6b55499db	Merge branch 'develop' into aws_bedrock	2025-04-09 14:38:00 -07:00
Nasreddine Bencherchali	953c8d59da	Merge branch 'develop' into csftd_first_batch	2025-04-09 16:34:47 +02:00
Nasreddine Bencherchali	53e3105db8	Merge branch 'develop' into csftd_first_batch	2025-04-03 20:59:14 +02:00
Bhavin Patel	49d75bbc36	Merge branch 'develop' into firewall_win_events	2025-04-03 10:44:21 -07:00
Nasreddine Bencherchali	f39a6d9a50	cisco secure firewall detections - first batch	2025-04-03 14:21:27 +02:00
Bhavin Patel	50ad208b2c	Merge branch 'develop' into cactus	2025-04-02 14:50:43 -07:00
Bhavin Patel	ae45debc8b	Merge branch 'develop' into firewall_win_events	2025-04-02 14:47:40 -07:00
Bhavin Patel	43abc9471f	Merge branch 'develop' into medusa_ransomware	2025-04-02 14:28:10 -07:00
Bhavin Patel	70a04d7ca0	Merge branch 'develop' into firewall_win_events	2025-04-02 13:23:42 -07:00
Bhavin Patel	0d93ce9c0b	updating conflicts	2025-04-02 13:18:06 -07:00
Bhavin Patel	0d831661a6	updating detections with conflicts	2025-04-02 11:41:46 -07:00
Bhavin Patel	f8d1d71db9	Merge branch 'develop' into medusa_ransomware	2025-04-02 11:22:19 -07:00
Michael Haag	b5a7ce9852	Merge branch 'develop' into cactus	2025-04-02 10:16:35 -06:00
Bhavin Patel	f03979077a	Merge branch 'develop' into rceattack	2025-04-01 15:47:23 -07:00
Bhavin Patel	a679c2e510	Merge branch 'develop' into medusa_ransomware	2025-04-01 14:52:23 -07:00
Bhavin Patel	72e2438196	Merge branch 'develop' into rceattack	2025-04-01 14:34:38 -07:00
Bhavin Patel	deb9ca1eba	Merge branch 'develop' into ZDI-CAN-25373	2025-04-01 14:22:38 -07:00
Bhavin Patel	7168e32ea6	Merge branch 'develop' into sunnyside	2025-04-01 14:05:53 -07:00
Michael Haag	7666d3793f	Merge branch 'develop' into cactus	2025-04-01 14:56:49 -06:00
Michael Haag	09e184389b	Merge branch 'develop' into ZDI-CAN-25373	2025-04-01 14:49:25 -06:00
Michael Haag	452378b283	fixor	2025-04-01 14:37:35 -06:00
Bhavin Patel	c85370b142	Merge branch 'develop' into firewall_win_events	2025-04-01 12:44:49 -07:00
Teoderick Contreras	b31f246793	medusa_ransomware	2025-04-01 12:54:03 +02:00
Br3akp0int	294128f9dc	Merge branch 'develop' into medusa_ransomware	2025-04-01 09:36:41 +02:00
Michael Haag	ada8585d6f	Merge branch 'develop' into rceattack	2025-03-31 12:05:21 -06:00
Bhavin Patel	bd3c6a0800	Merge branch 'develop' into sunnyside	2025-03-28 12:22:09 -07:00
Bhavin Patel	a87a568a2a	Update seashell_blizzard.yml	2025-03-28 12:02:11 -07:00