 Bhavin Patel
|
916e54d0ff
|
Merge pull request #429 from splunk/crl-1749ssh
CRL-1749 Cloud Stories
|
2020-04-17 10:36:24 -07:00 |
|
|
Bhavin Patel
|
dde27b94d0
|
Merge pull request #430 from splunk/first_okta_story
new files for okta story
|
2020-04-02 15:20:54 -07:00 |
|
|
bpatel
|
500a21e8cc
|
detection, spec and macroupdates
|
2020-04-02 13:39:29 -07:00 |
|
|
Rod Soto
|
542f78b716
|
fixedssh
|
2020-03-28 09:25:01 -04:00 |
|
|
bpatel
|
3d5891bb1e
|
adding macro and updating spl
|
2020-03-23 11:39:40 -07:00 |
|
|
Bhavin Patel
|
45ffbde816
|
Merge branch 'develop' into CRL-1746
|
2020-03-16 13:23:43 -07:00 |
|
|
rvaldez617
|
9363ded8d0
|
Merge pull request #385 from splunk/CRL-1733
CRL-1733: updating instructions for better clarification
|
2020-03-16 13:00:23 -06:00 |
|
|
Bhavin Patel
|
bd439c0a85
|
Merge pull request #402 from splunk/CRL-1744_macro_fixes
fixes for a couple broken macros
|
2020-03-16 10:18:29 -07:00 |
|
|
divious1
|
1e3299d3f0
|
updating macro name too
|
2020-03-11 20:36:49 -04:00 |
|
|
bpatel
|
7ee8310efb
|
macro ymls and detection update
|
2020-03-09 17:46:47 -07:00 |
|
|
Rico Valdez
|
573e8e3aa0
|
fixes for a couple broken macros
|
2020-03-04 14:31:37 -07:00 |
|
|
bpatel
|
5199a94b31
|
updating instructions for better clarification
|
2020-03-02 13:18:54 -08:00 |
|
|
Jose Enrique Hernandez
|
637fdf3c11
|
Merge pull request #372 from splunk/container_implantation
Container implantation
|
2020-02-27 15:31:47 -08:00 |
|
|
Rod Soto
|
187a00cd71
|
addedmacros
|
2020-02-27 17:09:50 -05:00 |
|
|
Patrick Bareiss
|
ef1b56f9ae
|
new credentia dumping detection
|
2020-02-21 09:03:15 +01:00 |
|
|
Bhavin Patel
|
6b2c9e4172
|
Merge pull request #327 from splunk/supicious_email_updates
updating boiler plate, detection not working out of box against T1193…
|
2020-02-07 10:35:35 -08:00 |
|
|
Bhavin Patel
|
556efc4a78
|
Merge pull request #325 from splunk/dns_query_updates
Update version info and macros
|
2020-02-07 10:33:05 -08:00 |
|
|
Bhavin Patel
|
98195728fc
|
Merge pull request #324 from splunk/first_time_seen_cmd_updates
update version info, add macros for first time seen cmd line detection
|
2020-02-07 10:07:18 -08:00 |
|
|
Bhavin Patel
|
0432161688
|
Merge pull request #326 from splunk/smb_detection_updates
update smb related content.
|
2020-02-07 10:05:44 -08:00 |
|
|
Bhavin Patel
|
9849b76aff
|
Merge branch 'develop' into first_time_seen_cmd_updates
|
2020-02-07 10:02:26 -08:00 |
|
|
bpatel
|
92768472e0
|
updating files as per Dons feedback
|
2020-02-04 09:15:39 -08:00 |
|
|
jzsplunk
|
c92d097eac
|
updating boiler plate, detection not working out of box against T1193 but this may be due to error loading lookup table for supicious file extensions.
|
2020-01-27 03:04:55 -08:00 |
|
|
jzsplunk
|
d4aa6bc9ea
|
update smb related content. The outbound_smb_connections detection works out of the box against attack ID T1110 when testing in the attack range.
|
2020-01-27 02:33:26 -08:00 |
|
|
jzsplunk
|
b762034a4b
|
update version info and macros, attack range freezing on testing detection against attack ID T1071 so query is untested against atomic red team test for now
|
2020-01-27 01:44:53 -08:00 |
|
|
jzsplunk
|
6406cfbc32
|
update version info, add macros for first time seen cmd line detection
|
2020-01-27 01:08:53 -08:00 |
|
|
bpatel
|
9e6becda1f
|
adding definitions
|
2020-01-23 13:31:43 -08:00 |
|
|
Jose Enrique Hernandez
|
2fd12b9155
|
Merge pull request #320 from splunk/don_young_bug
updating the manifest to reflect correct details
|
2020-01-22 17:26:54 -08:00 |
|
|
Bhavin Patel
|
75485ef666
|
Merge pull request #316 from splunk/CRL-1717_addMacroDefinitionsWhereMissing
CRL-1717 - Added "search *" definitions to the macros without them… resolves #292
|
2020-01-22 14:59:44 -08:00 |
|
|
Bhavin Patel
|
dd5b1ee344
|
Merge pull request #319 from splunk/dns_hijack_story_update
CRL-1718 updated fields and added macros and lookup entries
|
2020-01-22 14:58:40 -08:00 |
|
|
Bhavin Patel
|
38b84113bf
|
Merge pull request #318 from splunk/CRL-1495-update_share_creation_and_deletion
CRL-1495 update share creation and deletion
|
2020-01-22 09:19:43 -08:00 |
|
|
Bhavin Patel
|
0cef2e73b1
|
Merge pull request #315 from splunk/CRL-1716-FixPowerShellObfusc
CRL-1716 - Fixing by clause to allow searching Processes.process for …
|
2020-01-22 09:18:42 -08:00 |
|
|
bpatel
|
5d6ef5ce60
|
renaming files
|
2020-01-22 09:14:51 -08:00 |
|
|
Jason Brewer
|
b85543e0b5
|
CRL-1717 - Addressing comments by removing unnecessary output_filter macros from investigation searches and removing references to those in the investigation definitions.
|
2020-01-22 08:40:30 -08:00 |
|
|
Jason Brewer
|
b62ce205b8
|
CRL-1716 - Updating per code review requests. Adding output macro file and reference within the detection search.
|
2020-01-22 08:26:16 -08:00 |
|
|
bpatel
|
14f54a12e8
|
removing incorrect macro file
|
2020-01-21 17:29:55 -08:00 |
|
|
Jose Enrique Hernandez
|
c6a904b36f
|
Merge pull request #314 from splunk/CRL-1712_netsh_abuse
CRL-1712 Disabling Security Tools
|
2020-01-21 11:42:42 -08:00 |
|
|
Jose Enrique Hernandez
|
7b976f25f7
|
Update investigate_user_activities_in_all_cloud_region_output_filter.yml
|
2020-01-21 11:34:38 -08:00 |
|
|
jzsplunk
|
6eed922214
|
testing commented search
|
2020-01-21 01:58:30 -08:00 |
|
|
divious1
|
0ac15cb563
|
updated fields and added macros and lookup entries
|
2020-01-19 21:37:45 -05:00 |
|
|
Jason Brewer
|
56e7182720
|
CRL-1717 - Added "search *" definitions to the macros without definitions.
|
2020-01-17 17:09:01 -08:00 |
|
|
bpatel
|
629badf7e7
|
macros file, still not liking this practice
|
2020-01-14 15:58:38 -08:00 |
|
|
Patrick Bareiss
|
4a0bf015e8
|
tested and updates searches for lateral movement story
|
2020-01-13 11:18:54 +01:00 |
|
|
Patrick Bareiss
|
ce3b152832
|
WIP: testing lateral movement analytics story
|
2020-01-10 12:47:12 +01:00 |
|
|
divious1
|
f178e41e12
|
updated create hidden shares
|
2020-01-09 16:59:04 -05:00 |
|
|
bpatel
|
652d7f3fd0
|
updating macros to use sourcetype
|
2019-12-18 17:49:09 -08:00 |
|
|
bpatel
|
2701ad2049
|
remove def key from macro yml
|
2019-12-18 16:15:51 -08:00 |
|
|
bpatel
|
142d74b174
|
remove def key from macro yml
|
2019-12-18 14:54:48 -08:00 |
|
|
bpatel
|
9afa020d06
|
empty defs
|
2019-12-18 14:48:24 -08:00 |
|
|
bpatel
|
151be9217b
|
removing index and keeping source
|
2019-12-18 14:21:36 -08:00 |
|
|
Patrick Bareiss
|
5c775ec15a
|
Worked on the feedback
|
2019-12-18 20:08:10 +01:00 |
|