admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
24,687 Commits 697 Branches 195 Tags
powershell_updates
Commit Graph

9666 Commits

Author SHA1 Message Date
Bhavin Patel 9571b406fa Branch was auto-updated. 2024-11-01 13:58:04 -07:00
Sittikorn S 50ab1a0488 Update MITRE aws_defense_evasion_putbucketlifecycle.yml 
Add New Mitre Techniques
https://attack.mitre.org/techniques/T1485/001/

refer: https://attack.mitre.org/resources/updates/updates-october-2024/
 2024-11-01 11:04:03 +07:00
research-bot 8f83eb6be9 updating powershell 2024-10-31 14:11:30 -07:00
research-bot d1c7e1b6e5 udpating sysmon source 2024-10-30 18:42:30 -07:00
pyth0n1c 815e1d3043 Merge branch 'develop' into fix_missing_summariesonly 2024-10-29 11:57:45 -07:00
research-bot cb2f92b445 udpating drilldowns 2024-10-29 11:23:42 -07:00
research-bot c537507793 remove wrong detection 2024-10-29 11:20:33 -07:00
research-bot 89e4b081b5 updating Victim 2024-10-29 11:07:40 -07:00
research-bot 3298d7ec67 log 2024-10-29 10:29:10 -07:00
research-bot 736a230590 updating conflicts 2024-10-29 10:13:23 -07:00
research-bot 7aa3ee6801 adding data source 2024-10-29 10:11:24 -07:00
research-bot 06fb9c4aa7 txt 2024-10-29 09:59:36 -07:00
research-bot dfe604d443 updating detection 2024-10-29 09:59:20 -07:00
Bhavin Patel c67f17a7ee comment 2024-10-24 16:38:30 -07:00
Bhavin Patel f32e110c5c updating score 2024-10-24 16:17:01 -07:00
Bhavin Patel 817f0fe0d2 updating the detection 2024-10-24 15:41:04 -07:00
Bhavin Patel 0bb378b19b updating drilldowns 2024-10-24 14:13:05 -07:00
Bhavin Patel 8b03f3d58f updating all detections with quotes 2024-10-24 14:08:37 -07:00
Bhavin Patel 7bc11be7dc updating drilldown_formatting 2024-10-23 18:25:39 -07:00
Bhavin Patel 385ac7adc1 remove end hours 2024-10-23 17:52:24 -07:00
Bhavin Patel 0c44f8ed3e Branch was auto-updated. 2024-10-23 12:43:55 -07:00
Lou Stella e8e0087b48 Merge branch 'develop' into fix-missing-wildcard-in-detection-id-2452e632-9e0d-11eb-bacd-acde48001122 2024-10-23 12:01:25 -05:00
Wouter Jansen 7878f7c49b Update version, date, and author field 2024-10-23 09:27:51 +02:00
Bhavin Patel c32080d754 Branch was auto-updated. 2024-10-22 17:02:09 -07:00
pyth0n1c 6e3366457d fix names for time fields and add count 2024-10-22 11:54:20 -07:00
pyth0n1c c5f378eed8 bump all versions and dates 2024-10-22 10:38:25 -07:00
pyth0n1c 6da6231f1e Update erroneous cloud security_domain 
to valid values
 2024-10-22 10:29:06 -07:00
Wouter Jansen 2a49fca09a Add missing wildcard to -type parameter 
The detection won't hit on e.g. "nslookup.exe -type=MX" without the leading wildcard
 2024-10-22 17:32:23 +02:00
pyth0n1c d027d55796 add missing summariesonly macro. 
We will still need to determine if we
want to add the missing COUNT after
it as well, but this will take a hands 
on test of the rule
 2024-10-18 06:49:28 -04:00
Bhavin Patel e2bff20247 updating detections 2024-10-17 08:21:25 -07:00
pyth0n1c 92c3d3d1a4 Add drilldowns to the two searches that were missing them. Also fix field named 'eferences' to 'references' 2024-10-16 11:05:04 -04:00
Bhavin Patel 5396dcc6c8 Merge branch 'develop' into all_drilldowns 2024-10-15 16:27:29 -07:00
Bhavin Patel f0dfaebf39 updates per Lous feedback 2024-10-15 13:44:46 -07:00
Bhavin Patel 9c122bd7d8 Branch was auto-updated. 2024-10-10 14:34:54 -07:00
Bhavin Patel 4b785e3006 Branch was auto-updated. 2024-10-10 14:30:20 -07:00
Bhavin Patel 5f7bd18fb1 Branch was auto-updated. 2024-10-10 14:30:19 -07:00
Bhavin Patel a7847ab69c Branch was auto-updated. 2024-10-10 14:28:26 -07:00
Bhavin Patel 568c385a28 Branch was auto-updated. 2024-10-10 14:28:24 -07:00
Bhavin Patel 9b5b515ca5 Merge branch 'develop' into ad_find 2024-10-10 14:28:22 -07:00
Bhavin Patel e95c2d274f updating detection 2024-10-09 17:33:20 -07:00
Bhavin Patel 4702243b86 updating detection 2024-10-09 17:06:22 -07:00
Bhavin Patel ad27516532 updating 2024-10-09 16:05:43 -07:00
Bhavin Patel ee35624da0 updating 2024-10-09 16:05:40 -07:00
tccontre 7644997fda fix_change_file_owner_to_root 2024-10-09 10:15:20 +02:00
Bhavin Patel a3534c0eaf Update possible_lateral_movement_powershell_spawn.yml 2024-10-07 14:31:23 -07:00
Bhavin Patel 9544a896e7 data source 2024-10-07 14:30:37 -07:00
Michael Haag 55415915f0 updated today 2024-10-07 12:50:32 -06:00
Michael Haag e60c831b29 Update windows_identify_powershell_web_access_iis_pool.yml 
updated dataset
 2024-10-07 12:04:10 -06:00
Michael Haag 2d336d3af6 try again 2024-10-04 09:46:24 -06:00
Michael Haag 58f24d3680 try that 2024-10-04 09:35:04 -06:00