admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
24,687 Commits 697 Branches 195 Tags
powershell_updates
Commit Graph

6407 Commits

Author SHA1 Message Date
research-bot 8f83eb6be9 updating powershell 2024-10-31 14:11:30 -07:00
research-bot d1c7e1b6e5 udpating sysmon source 2024-10-30 18:42:30 -07:00
research-bot cb2f92b445 udpating drilldowns 2024-10-29 11:23:42 -07:00
research-bot c537507793 remove wrong detection 2024-10-29 11:20:33 -07:00
research-bot 89e4b081b5 updating Victim 2024-10-29 11:07:40 -07:00
research-bot 3298d7ec67 log 2024-10-29 10:29:10 -07:00
research-bot 736a230590 updating conflicts 2024-10-29 10:13:23 -07:00
research-bot 7aa3ee6801 adding data source 2024-10-29 10:11:24 -07:00
research-bot 06fb9c4aa7 txt 2024-10-29 09:59:36 -07:00
research-bot dfe604d443 updating detection 2024-10-29 09:59:20 -07:00
Bhavin Patel c67f17a7ee comment 2024-10-24 16:38:30 -07:00
Bhavin Patel f32e110c5c updating score 2024-10-24 16:17:01 -07:00
Bhavin Patel 817f0fe0d2 updating the detection 2024-10-24 15:41:04 -07:00
Bhavin Patel 0bb378b19b updating drilldowns 2024-10-24 14:13:05 -07:00
Bhavin Patel 8b03f3d58f updating all detections with quotes 2024-10-24 14:08:37 -07:00
Bhavin Patel 7bc11be7dc updating drilldown_formatting 2024-10-23 18:25:39 -07:00
Bhavin Patel 385ac7adc1 remove end hours 2024-10-23 17:52:24 -07:00
Wouter Jansen 7878f7c49b Update version, date, and author field 2024-10-23 09:27:51 +02:00
Wouter Jansen 2a49fca09a Add missing wildcard to -type parameter 
The detection won't hit on e.g. "nslookup.exe -type=MX" without the leading wildcard
 2024-10-22 17:32:23 +02:00
Bhavin Patel e2bff20247 updating detections 2024-10-17 08:21:25 -07:00
pyth0n1c 92c3d3d1a4 Add drilldowns to the two searches that were missing them. Also fix field named 'eferences' to 'references' 2024-10-16 11:05:04 -04:00
Bhavin Patel 5396dcc6c8 Merge branch 'develop' into all_drilldowns 2024-10-15 16:27:29 -07:00
Bhavin Patel f0dfaebf39 updates per Lous feedback 2024-10-15 13:44:46 -07:00
Bhavin Patel 9c122bd7d8 Branch was auto-updated. 2024-10-10 14:34:54 -07:00
Bhavin Patel 4b785e3006 Branch was auto-updated. 2024-10-10 14:30:20 -07:00
Bhavin Patel 5f7bd18fb1 Branch was auto-updated. 2024-10-10 14:30:19 -07:00
Bhavin Patel a7847ab69c Branch was auto-updated. 2024-10-10 14:28:26 -07:00
Bhavin Patel 568c385a28 Branch was auto-updated. 2024-10-10 14:28:24 -07:00
Bhavin Patel 9b5b515ca5 Merge branch 'develop' into ad_find 2024-10-10 14:28:22 -07:00
Bhavin Patel e95c2d274f updating detection 2024-10-09 17:33:20 -07:00
Bhavin Patel 4702243b86 updating detection 2024-10-09 17:06:22 -07:00
Bhavin Patel ad27516532 updating 2024-10-09 16:05:43 -07:00
Bhavin Patel ee35624da0 updating 2024-10-09 16:05:40 -07:00
tccontre 7644997fda fix_change_file_owner_to_root 2024-10-09 10:15:20 +02:00
Bhavin Patel a3534c0eaf Update possible_lateral_movement_powershell_spawn.yml 2024-10-07 14:31:23 -07:00
Bhavin Patel 9544a896e7 data source 2024-10-07 14:30:37 -07:00
Michael Haag 55415915f0 updated today 2024-10-07 12:50:32 -06:00
Michael Haag e60c831b29 Update windows_identify_powershell_web_access_iis_pool.yml 
updated dataset
 2024-10-07 12:04:10 -06:00
Michael Haag 2d336d3af6 try again 2024-10-04 09:46:24 -06:00
Michael Haag 58f24d3680 try that 2024-10-04 09:35:04 -06:00
Bhavin Patel f7ee25c5a8 Branch was auto-updated. 2024-10-03 11:28:46 +05:30
Michael Haag d84019ce5a PSWA Updates 2024-09-30 10:35:12 -06:00
Bhavin Patel cf169b3de0 adding drilldowns to all 2024-09-30 22:04:57 +05:30
pyth0n1c d5fb6c520c update ymls so that they refer to the correct names 
of datasources. this was mostly removing spaces
to convert "Sysmon Event ID N" to
"Sysmon EventID N". Also fix some ymls
that used the field "data_sources" when
it should be "data_source"
 2024-09-26 14:48:44 -07:00
Bhavin Patel 33fe5bbcba Branch was auto-updated. 2024-09-25 22:53:31 +05:30
Bhavin Patel f373b62a86 Branch was auto-updated. 2024-09-25 22:43:29 +05:30
Bhavin Patel ec168c8c8b Merge branch 'develop' into valleyrat 2024-09-25 22:43:22 +05:30
pyth0n1c 8b675ad971 More detections have been updated. there are still a few with extra whitespace that must be taken care of 2024-09-24 17:04:43 -07:00
pyth0n1c 5b75e85ef8 second pass at fixing whitespace and related update fields 2024-09-24 16:53:25 -07:00
pyth0n1c b43bb4fb4e Fix dates, fields with spaces, and update verisons for many detections 2024-09-24 16:37:44 -07:00