156 Commits

Author	SHA1	Message	Date
bpatel	4a840d4184	ericks detections from xmrig	2021-05-12 12:58:00 -07:00
Bhavin Patel	3aa6adebd6	Merge branch 'develop' into sh_test	2021-02-03 14:24:50 -08:00
P4T12ICK	7f8652b85b	bug fix	2021-02-03 15:44:56 +01:00
bpatel	4fb0488ac6	duplicating files and experimental	2021-01-28 17:35:25 -08:00
bpatel	ec76d28b60	rename	2021-01-26 19:28:03 -08:00
bpatel	edeaa89c7d	macros for all	2021-01-26 18:53:01 -08:00
David Dorsey	fd76342c94	Changed the language in some of the descriptions	2021-01-21 23:53:47 -06:00
P4T12ICK	58627b44f9	changes	2020-12-15 12:27:16 +01:00
P4T12ICK	5fee68375f	fix_bugs	2020-12-11 10:51:02 +01:00
bpatel	25c7f33866	app inspect failures fixes	2020-12-08 14:56:39 -08:00
bpatel	c156c18b6b	files not needed	2020-12-08 11:15:24 -08:00
Jose Enrique Hernandez	3c1cfbf4de	Merge branch 'develop' into develop	2020-11-18 13:30:38 -05:00
Bhavin Patel	398ee5f947	Merge pull request #843 from splunk/ransomwares3 ... Ransomwares3	2020-11-12 11:51:39 -08:00
Jose Enrique Hernandez	3e9513f4b8	Merge branch 'develop' into develop	2020-11-11 22:04:16 -05:00
Jose Enrique Hernandez	4acc8c3efb	Merge branch 'develop' into mbjerkeland-develop	2020-11-11 22:03:44 -05:00
Bhavin Patel	e185ca89ba	Merge branch 'develop' into ransomwares3	2020-11-11 16:36:34 -08:00
Bhavin Patel	3aa06e82b6	Merge branch 'develop' into mustang_beta	2020-11-10 09:59:18 -08:00
bpatel	64bd08b5ff	these macro files are not needed	2020-11-10 09:14:23 -08:00
P4T12ICK	1f3f1ae408	Merge branch 'develop' into mbjerkeland-develop	2020-11-10 09:24:55 +01:00
Shannon Davis	098aa9019a	mods	2020-11-06 11:08:38 +11:00
P4T12ICK	8a66f8e175	changed macro	2020-11-05 09:18:37 +01:00
Mikael Bjerkeland	17502e4722	Added various Network Infrastructure detections based on the MITRE Network Matrix	2020-10-28 23:14:06 +01:00
Mikael Bjerkeland	7e068a5267	Added detection for T1020.001, Traffic Duplication	2020-10-28 21:51:33 +01:00
Mikael Bjerkeland	d5c6d72361	.	2020-10-28 21:14:40 +01:00
Bhavin Patel	5e62272a68	Merge branch 'develop' into mustang_beta	2020-10-05 16:20:10 -07:00
jzsplunk	3c49885ad6	Merge branch 'develop' into TR-104-missing-input-filters	2020-10-02 08:01:15 -07:00
David Dorsey	e30924013c	single and double quote order issue	2020-09-23 17:32:52 -05:00
David Dorsey	42549c5776	Macro fixes	2020-09-23 17:22:02 -05:00
David Dorsey	b681f5faa4	macro fixes	2020-09-23 17:16:35 -05:00
David Dorsey	5fbc68936b	baseline update search fix with macros	2020-09-23 16:58:26 -05:00
Rico Valdez	359926e89b	text updates and a couple of fixes for mismatched macros	2020-09-23 14:44:00 -06:00
David Dorsey	65403cc027	Merge branch 'TR-41_aws_ec2_mods' of github.com:splunk/security-content into TR-41_aws_ec2_mods	2020-09-23 11:36:15 -05:00
David Dorsey	2d25205146	Fixes	2020-09-23 11:35:56 -05:00
Jose Enrique Hernandez	7bd6f5380e	Merge branch 'develop' into TR-41_aws_ec2_mods	2020-09-23 12:09:37 -04:00
David Dorsey	17eff649e7	Fixes	2020-09-21 23:23:57 -05:00
divious1	b78035c976	adding macros	2020-09-18 17:36:46 -04:00
jzsplunk	c33be23f10	[TR-104] add missing input filters.	2020-09-15 22:59:19 -07:00
David Dorsey	9b785919de	validate fixes	2020-09-10 21:22:34 -05:00
Rico Valdez	83015eba59	latest updates to create in new vendor_region	2020-09-09 16:26:25 -06:00
David Dorsey	fc99713981	Translated detections/detect_spike_in_security_group_activity.yml	2020-09-09 01:36:26 -05:00
David Dorsey	d588bbc8f6	Translated detect_spike_in_aws_api_activity.yml to use Change DM	2020-09-09 01:01:16 -05:00
bpatel	10a5b76af7	merge with develop	2020-09-04 13:40:15 -07:00
David Dorsey	7b098cf836	fixed validate issues	2020-09-04 13:13:22 -05:00
David Dorsey	dbfecd9e29	New analytic story for suspicious cloud user activities.	2020-09-04 10:30:47 -05:00
David Dorsey	cb5761a251	Added needed macros and lookups	2020-09-04 09:26:10 -05:00
Rico Valdez	e9939cbc98	new files for unblocked searches	2020-09-03 11:10:14 -06:00
Rico Valdez	f7498459c8	changes for mustang	2020-09-02 10:21:52 -06:00
Jose Enrique Hernandez	1c1ce46004	Merge branch 'develop' into mbjerkeland-develop	2020-08-24 01:04:40 -04:00
David Dorsey	80860d37f4	Created manifests for unseen city, region, and country and updated ... logic to reflect each case	2020-08-20 14:07:21 -05:00
David Dorsey	7de781c8f0	Manifest cleanup	2020-08-20 13:15:14 -05:00