243 Commits

Author	SHA1	Message	Date
Lou Stella	24486a0d8d	Cleaned up macro	2022-05-02 15:08:10 -05:00
Lou Stella	6fe602533b	Removed detection	2022-05-02 14:30:43 -05:00
Rod Soto	a71f12b921	Merge branch 'TR-1828' of github.com:splunk/security_content into TR-1828	2022-04-29 10:18:39 -07:00
Rod Soto	c43dc89bbf	detectionsforlocalprivescpathtraversal	2022-04-29 10:17:14 -07:00
Lou Stella	c61f8670f8	CVE-2021-33845	2022-04-29 11:31:33 -05:00
Lou Stella	de6ccbbf9c	CVE-2022-27183	2022-04-27 12:44:48 -05:00
Lou Stella	b1cabaecb2	Added macro	2022-03-28 09:18:19 -05:00
P4T12ICK	8937a5fec7	MacOS detections	2022-03-04 16:35:30 +01:00
Lou Stella	95b7a634ac	DiskShadow + Story Scaffolding	2022-02-17 10:12:50 -06:00
Bhavin Patel	14c145c133	Merge pull request #1953 from splunk/potentially_malicious_code_on_commandline ... Potentially malicious code on commandline	2022-01-28 13:27:59 -08:00
Michael Hart	b80af6f151	Editing the macro to put the apply statement into the search query so that it's clear that MLTK is being used	2022-01-26 22:38:13 -05:00
patel-bhavin	45c4a7b600	remove files that are already merged	2022-01-26 13:51:51 -08:00
mhaag-spl	befe09f77c	Nirsoft Software	2022-01-24 15:07:20 -07:00
pyth0n1c	ad85b8b21b	Branch was auto-updated.	2022-01-24 10:51:04 -08:00
pyth0n1c	4c125f1dd6	Branch was auto-updated.	2022-01-24 10:51:03 -08:00
pyth0n1c	53ca345c06	Branch was auto-updated.	2022-01-24 10:40:46 -08:00
pyth0n1c	bbebfe7d07	Branch was auto-updated.	2022-01-24 10:40:41 -08:00
pyth0n1c	ac214bafa6	Branch was auto-updated.	2022-01-24 10:40:40 -08:00
mhaag-spl	5bfcf2eea3	InstallUtil and DotNet Assemblies	2022-01-20 14:34:04 -07:00
tccontre	1b510a0929	WhisperGateIsOpen	2022-01-20 15:11:12 +01:00
Michael Hart	b59380d324	Potentially malicious execution on command line	2022-01-19 20:02:42 -05:00
Rod Soto	c263ef4ac5	Merge branch 'nixpost' of github.com:splunk/security_content into nixpost	2022-01-12 07:47:54 -08:00
Rod Soto	5f71b501f2	addedmacros	2022-01-12 07:47:14 -08:00
mvelazco	19bd2fd736	updating sysmon macro	2021-12-13 18:00:14 -05:00
Michael Haag	2565ad2bbf	Update windows_shells.yml	2021-12-13 14:37:40 -07:00
mhaag-spl	71295432e3	Windows shells	2021-12-13 13:01:45 -07:00
mhaag-spl	f3b31c113b	java Shells	2021-12-13 11:54:59 -07:00
Michael Haag	b87061f794	rookie mistake	2021-11-30 05:34:29 -07:00
mhaag-spl	81e952185e	Rclone Haagrid	2021-11-29 15:55:38 -07:00
tccontre	ce6318c87b	more_ioc_detections	2021-11-19 12:01:45 +01:00
Bhavin Patel	19eb60a778	Branch was auto-updated.	2021-11-18 12:58:40 -08:00
tccontre	9fa410ac29	ioc_detections	2021-11-17 16:09:42 +01:00
mhaag-spl	878c0c775b	InstallUTIL 🍺	2021-11-12 13:05:19 -07:00
mhaag-spl	babbd47d81	Update wineventlog_task_scheduler.yml	2021-11-09 13:42:23 -07:00
Bhavin Patel	fc4cc81ad6	Branch was auto-updated.	2021-11-03 10:43:52 -07:00
patel-bhavin	0a9c396e08	search update	2021-11-02 18:03:21 -07:00
Bhavin Patel	cd5dac3ebf	Branch was auto-updated.	2021-10-28 11:18:42 -07:00
mhaag-spl	27521060d9	Update wineventlog_task_scheduler.yml	2021-10-21 12:07:26 -06:00
mhaag-spl	0772e6352b	taskscheduler hunting	2021-10-21 09:56:27 -06:00
mhaag-spl	f7112aca62	fixes	2021-10-20 07:08:14 -06:00
mhaag-spl	f8d6ce147d	Curling	2021-10-19 10:44:17 -06:00
mhaag-spl	9b8ff687ae	HaagRoast	2021-10-15 12:31:33 -06:00
tccontre	fb296c8508	privilege_escalation_persistence	2021-10-06 11:15:47 +02:00
tccontre	82633e151a	privilege_escalation_persistence	2021-10-05 11:56:48 +02:00
tccontre	993f0adb87	privilege_escalation_persistence	2021-09-29 10:42:05 +02:00
mhaag-spl	bd6a779b02	no longer need sysmon procdump - updated superior procdump	2021-09-16 12:06:20 -06:00
mhaag-spl	695bd7236c	hh, mshta, and psexec	2021-09-16 11:13:15 -06:00
Bhavin Patel	c560335cab	Branch was auto-updated.	2021-09-08 00:52:42 -07:00
P4T12ICK	a917acaf4c	updated detections	2021-09-06 14:49:19 +02:00
mhaag-spl	fa2b35c293	Merge branch 'develop' into The-Haag-of-The-Storm	2021-09-03 07:10:38 -06:00