e3bfb2da07
the final countdown
2025-07-06 02:57:39 +02:00
544645b87b
Update suspicious_ports_list.csv
2025-07-01 23:07:46 +02:00
75ec47e99a
add new detections, story and other cool things
2025-07-01 23:04:48 +02:00
f49bd318d9
update time 🚀
2025-06-30 13:55:55 +02:00
67c72b9035
add Cisco Secure Firewall - Remote Access Software Usage Traffic
2025-05-28 19:33:18 +02:00
78b11fa6a0
Update threat_snort_count.yml
2025-05-15 11:32:13 +02:00
559f472227
Rename threat_actor_snort_count.yml to threat_snort_count.yml
2025-05-15 11:31:59 +02:00
42da135696
Rename threat_actor_snort_count.csv to threat_snort_count.csv
2025-05-15 11:31:40 +02:00
8330f6bdf1
Apply suggestions from code review
2025-05-15 11:31:17 +02:00
e95c2d480d
updating code to use udpated names of lookup files
2025-05-14 13:50:22 -07:00
823652f4e2
lookup update
2025-05-13 17:41:13 -07:00
8f445c574a
updating lookup content and query
2025-05-13 13:57:44 -07:00
c1eef4cf0f
updating csv
2025-05-13 12:59:17 -07:00
0b0e5114ab
adding two lookups and updating query for test
2025-05-13 12:44:30 -07:00
29a64f2b56
change count to 4 based on dataset
2025-05-12 16:15:45 -07:00
933ff68b40
Merge branch 'develop' into snort_by_threat_actor
2025-05-12 15:36:31 -07:00
df33c55c9a
adding detection and lookup
2025-05-12 15:21:55 -07:00
629bc01aae
update output and nirsoft tools
2025-04-24 18:23:55 +02:00
614721e681
Merge branch 'develop' into remove_v5.4.0
2025-04-18 10:26:39 -07:00
8ca79f3f56
Merge branch 'develop' into cactus
2025-04-18 09:33:17 -06:00
0bdaf9647e
Merge branch 'develop' into remove_v5.4.0
2025-04-17 13:27:58 -07:00
96f7490cde
Merge branch 'develop' into remove_v5.4.0
2025-04-17 09:15:53 -07:00
d57b1686fd
Merge branch 'develop' into csftd_second_batch
2025-04-17 18:06:46 +02:00
0c57994c22
remove static lookup file
2025-04-16 16:00:49 -07:00
e1dc36ad07
revert wrong commit
2025-04-16 16:00:23 -07:00
b154c14045
remove static loookup
2025-04-16 15:52:45 -07:00
953c8d59da
Merge branch 'develop' into csftd_first_batch
2025-04-09 16:34:47 +02:00
e9caa0de7c
cisco secure firewall detections - second batch
2025-04-09 12:33:51 +02:00
889c08ebbf
chore: update lookup date and version
2025-04-04 11:32:45 -04:00
5f1d8f6b3f
fix: addtl remote_utility typo in remote_access_software.csv
2025-04-04 11:32:32 -04:00
66889be8a6
fix: remote_utility typo in remote_access_software.csv
2025-04-04 11:20:21 -04:00
53e3105db8
Merge branch 'develop' into csftd_first_batch
2025-04-03 20:59:14 +02:00
0f084c4fb7
update lookup name
2025-04-03 14:24:53 +02:00
f39a6d9a50
cisco secure firewall detections - first batch
2025-04-03 14:21:27 +02:00
0d831661a6
updating detections with conflicts
2025-04-02 11:41:46 -07:00
f8d1d71db9
Merge branch 'develop' into medusa_ransomware
2025-04-02 11:22:19 -07:00
7666d3793f
Merge branch 'develop' into cactus
2025-04-01 14:56:49 -06:00
b31f246793
medusa_ransomware
2025-04-01 12:54:03 +02:00
ada8585d6f
Merge branch 'develop' into rceattack
2025-03-31 12:05:21 -06:00
db0455a024
Merge branch 'develop' into win_sus_service_fix
2025-03-28 12:36:36 -07:00
7e1cc06c3c
Merge branch 'develop' into win_sus_service_fix
2025-03-28 09:50:36 -07:00
14bf638d06
Merge branch 'develop' into vanhelsing
2025-03-28 09:48:19 -07:00
60e4f3881c
Adding default match back to lookups where used
2025-03-26 13:03:42 -05:00
a0b45b8248
update lookup and revert back to where isnotnull
2025-03-26 16:01:17 +00:00
f491d2a512
Removing default match from lookups
2025-03-26 11:01:05 -05:00
dfd995e93f
Merge branch 'develop' into rceattack
2025-03-24 19:25:46 -06:00
e6b1c4d102
The Haag Has Landed: VanHelsing's Revenge
...
Added VanHelsing Ransomware analytic story and associated it with relevant detections. Updated 7 existing detections to include VanHelsing Ransomware in their analytic stories:
- detect_renamed_psexec.yml
- detect_psexec_with_accepteula_flag.yml
- executable_file_written_in_administrative_smb_share.yml
- deleting_shadow_copies.yml
- delete_shadowcopy_with_powershell.yml
- detect_copy_of_shadowcopy_with_script_block_logging.yml
- resize_shadowstorage_volume.yml
- Updated ransomware extensions
The story provides comprehensive coverage of this new ransomware-as-a-service threat, focusing on its key TTPs including shadow copy deletion, process hollowing, and encryption behaviors.
2025-03-24 13:43:51 -06:00
0bde0e2bf8
Merge branch 'develop' into cactus
2025-03-20 11:15:34 -06:00
5e8e6cbdf8
Update ransomware_extensions_lookup.yml
2025-03-19 09:57:31 -06:00
58aca7db99
Update the deprecation_info.csv file, manually generated with a version of contentctl that has not yet been merged or released in main branch.
2025-03-18 15:41:21 -07:00
Nasreddine Bencherchali