 Patrick Bareiss
|
d2e82224b0
|
Converted all objects to new spec
|
2020-04-29 13:01:45 +02:00 |
|
|
Bhavin Patel
|
916e54d0ff
|
Merge pull request #429 from splunk/crl-1749ssh
CRL-1749 Cloud Stories
|
2020-04-17 10:36:24 -07:00 |
|
|
bpatel
|
b53e674421
|
new link
|
2020-04-16 13:41:59 -07:00 |
|
|
bpatel
|
e46346f174
|
new link
|
2020-04-16 13:14:48 -07:00 |
|
|
bpatel
|
5fc984f4cc
|
adding new investigation manifest
|
2020-04-16 11:51:19 -07:00 |
|
|
bpatel
|
245f15912e
|
spl and manifest updates:
|
2020-04-15 15:54:34 -07:00 |
|
|
bpatel
|
330c7aaaf2
|
search name consistency
|
2020-04-15 11:44:39 -07:00 |
|
|
bpatel
|
2492d2ede5
|
deleting azure storry
|
2020-04-15 11:39:59 -07:00 |
|
|
Rod Soto
|
be16d2dd86
|
consolidated
|
2020-04-13 19:57:13 -04:00 |
|
|
bpatel
|
41bfc4c0c7
|
slim failure
|
2020-04-02 14:57:43 -07:00 |
|
|
Rico Valdez
|
ea97a7574d
|
updates to story manifest
|
2020-04-02 15:03:35 -06:00 |
|
|
Rico Valdez
|
26446e099f
|
some naming tweaks to detections, and detctions in stories. Need text for story
|
2020-04-02 13:36:55 -06:00 |
|
|
Rico Valdez
|
576debf5ec
|
new files for okta story
|
2020-04-02 12:31:22 -06:00 |
|
|
Rod Soto
|
542f78b716
|
fixedssh
|
2020-03-28 09:25:01 -04:00 |
|
|
divious1
|
820e13be36
|
removing another dead ref
|
2020-03-04 10:09:33 -05:00 |
|
|
divious1
|
13d05c85e7
|
removing deadlink
|
2020-03-04 10:07:28 -05:00 |
|
|
bpatel
|
7c53ce10bc
|
updated manifests
|
2020-03-02 10:25:28 -08:00 |
|
|
rvaldez617
|
826e8c1f1c
|
Update credential_dumping.yml
Bumped story version due to new search added by Patrick
|
2020-02-28 11:41:11 -07:00 |
|
|
Jose Enrique Hernandez
|
637fdf3c11
|
Merge pull request #372 from splunk/container_implantation
Container implantation
|
2020-02-27 15:31:47 -08:00 |
|
|
divious1
|
cfec1a0dad
|
fixing story error
|
2020-02-27 15:24:26 -08:00 |
|
|
divious1
|
b2c0c6593f
|
fixing references fix
|
2020-02-27 15:23:08 -08:00 |
|
|
Patrick Bareiss
|
42103847a8
|
bug fix
|
2020-02-27 15:20:46 -08:00 |
|
|
Patrick Bareiss
|
b7bb8f2159
|
Merge branch 'container_implantation' of https://github.com/splunk/security-content into container_implantation
|
2020-02-27 15:14:38 -08:00 |
|
|
Patrick Bareiss
|
43effcde02
|
bug fix
|
2020-02-27 15:14:24 -08:00 |
|
|
divious1
|
e3d6b11ac3
|
updating spec version
|
2020-02-27 14:43:00 -08:00 |
|
|
Rod Soto
|
9d12936e2d
|
fixedstory
|
2020-02-27 17:22:03 -05:00 |
|
|
Patrick Bareiss
|
ef1b56f9ae
|
new credentia dumping detection
|
2020-02-21 09:03:15 +01:00 |
|
|
Rod Soto
|
4aa2e28e80
|
fixedyml
|
2020-02-20 20:41:26 -05:00 |
|
|
Rod Soto
|
c2a2060c98
|
story_container
|
2020-02-20 18:17:54 -05:00 |
|
|
divious1
|
bdedd41b34
|
removing bad reference, dead link
|
2020-02-07 14:15:32 -05:00 |
|
|
Bhavin Patel
|
6b2c9e4172
|
Merge pull request #327 from splunk/supicious_email_updates
updating boiler plate, detection not working out of box against T1193…
|
2020-02-07 10:35:35 -08:00 |
|
|
bpatel
|
ff7a6fef59
|
update mod dates of stories:
|
2020-02-07 10:30:32 -08:00 |
|
|
Bhavin Patel
|
f682a22461
|
Merge branch 'develop' into CRL-1725_Processes.parent_process.Correction
|
2020-02-07 10:18:17 -08:00 |
|
|
Bhavin Patel
|
98195728fc
|
Merge pull request #324 from splunk/first_time_seen_cmd_updates
update version info, add macros for first time seen cmd line detection
|
2020-02-07 10:07:18 -08:00 |
|
|
Bhavin Patel
|
44761d1106
|
Merge pull request #348 from splunk/CRL-1723
CRL-1723 : corrected field name in SPL Filesystem.filepath [which doe…
|
2020-02-07 10:04:22 -08:00 |
|
|
Bhavin Patel
|
7d61248099
|
Merge branch 'develop' into CRL-1725_Processes.parent_process.Correction
|
2020-02-07 10:03:49 -08:00 |
|
|
Jose Enrique Hernandez
|
382d0d719d
|
Merge pull request #351 from splunk/issue_336
updating mod dates and version
|
2020-02-07 13:02:48 -05:00 |
|
|
Bhavin Patel
|
9849b76aff
|
Merge branch 'develop' into first_time_seen_cmd_updates
|
2020-02-07 10:02:26 -08:00 |
|
|
bpatel
|
f307274f95
|
story mod updates
|
2020-02-07 10:00:28 -08:00 |
|
|
bpatel
|
8b0f74c34d
|
updating mod dates and version
|
2020-02-04 09:21:52 -08:00 |
|
|
bpatel
|
92768472e0
|
updating files as per Dons feedback
|
2020-02-04 09:15:39 -08:00 |
|
|
Jason Brewer
|
e18a1402f4
|
CRL-1723 : corrected field name in SPL Filesystem.filepath [which does not exist] to Filesystem.file_path.
|
2020-02-03 21:00:55 -08:00 |
|
|
Jason Brewer
|
346709b58f
|
CRL-1725 - Changed prohibited_apps_spawning_cmdprompt.yml to use parent_process_name as entity. Changed supress field to add user. Bumped detection version number and story version numbers on stories/suspicious_cmd_line_executions.yml and stories/suspicious_mshta_activities.yml.
|
2020-02-03 15:24:49 -08:00 |
|
|
Jason Brewer
|
c3b04375c9
|
CRL-1719 - Fixing reference to https://attack.mitre.org/wiki/Privilege_Escalation >>> https://attack.mitre.org/tactics/TA0004/
|
2020-01-22 12:17:24 -08:00 |
|
|
Jose Enrique Hernandez
|
c6a904b36f
|
Merge pull request #314 from splunk/CRL-1712_netsh_abuse
CRL-1712 Disabling Security Tools
|
2020-01-21 11:42:42 -08:00 |
|
|
bpatel
|
52f5a71060
|
new search unload sysmon filter
|
2020-01-14 15:27:57 -08:00 |
|
|
Patrick Bareiss
|
71241e566f
|
tested and updates searches for lateral movement story
|
2020-01-13 10:39:57 +01:00 |
|
|
Patrick Bareiss
|
4e8427cff4
|
Worked on the feedback
|
2019-12-18 10:23:55 +01:00 |
|
|
Patrick Bareiss
|
2ed8b32696
|
Merged with develop
|
2019-12-17 09:13:43 +01:00 |
|
|
divious1
|
1acf708bc3
|
updating bug with samsam docs
|
2019-12-16 10:21:04 -05:00 |
|