 bpatel
|
fe8ff90e4e
|
updating how to implement and readme
|
2019-12-19 11:22:44 -08:00 |
|
|
briannablacet
|
4f0a6a0cb7
|
Error fixes
|
2019-12-18 11:12:23 -08:00 |
|
|
briannablacet
|
4e42f955ed
|
fixing broken sentences and dreams
|
2019-12-18 11:07:33 -08:00 |
|
|
briannablacet
|
7ced058b9b
|
Update creation_of_shadow_copy_with_wmic_and_powershell.yml
|
2019-12-18 11:04:12 -08:00 |
|
|
briannablacet
|
37be4b204d
|
moving words and letters into different places
|
2019-12-18 11:02:05 -08:00 |
|
|
briannablacet
|
91e3b25170
|
Ch-ch-changes...
|
2019-12-18 11:00:31 -08:00 |
|
|
briannablacet
|
d2569fe9af
|
Changes for grammar/punctuation
|
2019-12-18 10:53:48 -08:00 |
|
|
briannablacet
|
8d48f2c64b
|
changes for grammar/punctuation, etc.
|
2019-12-18 10:52:11 -08:00 |
|
|
Patrick Bareiss
|
7d5a025529
|
Fixed a bug in a search
|
2019-12-18 15:36:37 +01:00 |
|
|
Patrick Bareiss
|
9a6b6ac4fa
|
Worked on the feedback
|
2019-12-18 10:38:26 +01:00 |
|
|
Patrick Bareiss
|
be0fc0b66a
|
Worked on the feedback
|
2019-12-18 10:29:40 +01:00 |
|
|
Patrick Bareiss
|
4e8427cff4
|
Worked on the feedback
|
2019-12-18 10:23:55 +01:00 |
|
|
briannablacet
|
86f79b42b5
|
Changes for grammar, punctuation, spelling, etc
I would also like to request that you stop using the letter ß. It's like you're from Germany or something.
|
2019-12-17 18:53:11 -08:00 |
|
|
briannablacet
|
85fbd19099
|
Missed one
|
2019-12-17 18:44:03 -08:00 |
|
|
briannablacet
|
29e36546d5
|
Changes for punctuation, spelling, grammar, etc.
I was joking about the umlauts.
|
2019-12-17 18:39:27 -08:00 |
|
|
briannablacet
|
216260600b
|
Update attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml
|
2019-12-17 18:01:14 -08:00 |
|
|
briannablacet
|
407d1ef210
|
Changes for grammar, punctuation, spelling
Please stop using umlauts in the manifests.
|
2019-12-17 18:00:27 -08:00 |
|
|
briannablacet
|
1fbf041270
|
Reviewing grammar and wording
|
2019-12-17 16:43:16 -08:00 |
|
|
Patrick Bareiss
|
702195941a
|
New version of Credential Dumping Story
|
2019-12-17 19:05:51 +01:00 |
|
|
Patrick Bareiss
|
4c17d519fe
|
New version of Credential Dumping Story
|
2019-12-17 18:37:56 +01:00 |
|
|
Patrick Bareiss
|
7ac2c7b594
|
New version of Credential Dumping Story
|
2019-12-17 18:30:30 +01:00 |
|
|
Patrick Bareiss
|
3f03c5392c
|
New version of Credential Dumping Story
|
2019-12-17 18:08:09 +01:00 |
|
|
Patrick Bareiss
|
761812a675
|
WIP: Exception Handling test
|
2019-12-17 13:15:51 +01:00 |
|
|
Patrick Bareiss
|
2ed8b32696
|
Merged with develop
|
2019-12-17 09:13:43 +01:00 |
|
|
bpatel
|
8ae3ebdbf5
|
naming updates, jinja macros updates
|
2019-12-16 13:05:17 -08:00 |
|
|
Patrick Bareiss
|
28464d4f2c
|
WIP: liche check disabled
|
2019-12-16 14:00:46 +01:00 |
|
|
Patrick Bareiss
|
08d954e4ca
|
WIP: liche check disabled
|
2019-12-16 13:50:19 +01:00 |
|
|
Patrick Bareiss
|
de84f9822c
|
WIP: liche check disabled
|
2019-12-16 12:07:40 +01:00 |
|
|
Patrick Bareiss
|
08c9fa1580
|
merge with develop
|
2019-12-16 10:42:40 +01:00 |
|
|
Patrick Bareiss
|
c873fc8363
|
WIP: pre and post macros
|
2019-12-16 10:28:47 +01:00 |
|
|
Patrick Bareiss
|
6c35f20a55
|
added investigations to detections
|
2019-12-12 16:44:26 +01:00 |
|
|
bpatel
|
b379395c3b
|
fixing the files that didnt update the macros correctly
|
2019-12-11 15:39:14 -08:00 |
|
|
divious1
|
f8e3113412
|
added summariesonly and fixed ctime
|
2019-12-11 15:14:49 -05:00 |
|
|
divious1
|
f9bdf7e0e4
|
introduced security_content_ctime as a macro, renamed all our searches to use this new macro, removing ES dependecy
|
2019-12-11 14:59:03 -05:00 |
|
|
Patrick Bareiss
|
ab2118a012
|
New version of analytics story credential dumping
|
2019-12-11 13:13:14 +01:00 |
|
|
Patrick Bareiss
|
46ac72ebf6
|
WIP: Credential Dumping Story
|
2019-12-11 12:29:41 +01:00 |
|
|
Jason Brewer
|
95f73c9039
|
CRL-1645 - New detection "Abnormally High AWS Instances Terminated by User - MLTK"
|
2019-11-25 18:06:33 -08:00 |
|
|
jcbrewer5D6400
|
92078c2ec4
|
Merge pull request #261 from splunk/CRL-1646
CRL-1646 - Implemented : Update Detection for abnormally_high_instanc…
|
2019-11-25 17:10:04 -08:00 |
|
|
Jason Brewer
|
604e2ecc11
|
CRL-1646 - changing from user to src_user
|
2019-11-25 15:49:32 -08:00 |
|
|
Jason Brewer
|
38be9ebb26
|
CRL-1646 , CRL-1697 - Making minor tweaks to excessive run instance detections (using ARN vs username) added -MLTK to labels. Added reference for Cloud Compute Instance Created With Previously Unseen Image to cloud_cryptomining.yml.
|
2019-11-25 15:17:32 -08:00 |
|
|
David Dorsey
|
d33adf4423
|
Removed data sources from fraud searches that were not Splunk
Stream since the sourcetype in the search specifies Stream
|
2019-11-21 21:10:56 -06:00 |
|
|
Jason Brewer
|
37cdeab391
|
CRL-1646 - fixing stats.
|
2019-11-21 15:33:02 -08:00 |
|
|
Jason Brewer
|
3d1846cd2e
|
CRL-1646 - Updating to add input_filter macro to searches and to reference baseline search from detection search.
|
2019-11-21 14:01:14 -08:00 |
|
|
Jason Brewer
|
f21db84f76
|
CRL-1646 - Modifying search to see if my yml is wrong for a multiline object with pipes.
|
2019-11-20 15:50:39 -08:00 |
|
|
Jason Brewer
|
b3b4f4e892
|
CRL-1646 - Implemented : Update Detection for abnormally_high_instances_launched to use MLTK
|
2019-11-20 14:18:50 -08:00 |
|
|
Brianna
|
28e1d88f2c
|
Update remote_registry_modifications.yml
Changed "Change_Analysis" to "Endpoint" (in referring to the data model leveraged)
|
2019-11-14 12:43:37 -08:00 |
|
|
David Dorsey
|
5f30745b7c
|
Fixed issue in CRL-1387 where the check for executionpolicy bypass
was too broad.
Also, added investigation searches for file and registry activity
while I was here
|
2019-11-06 18:39:21 -08:00 |
|
|
Rico Valdez
|
4c37f3c55c
|
added connected=false to 3 searches using the transaction command.
|
2019-10-30 13:32:31 -06:00 |
|
|
Bhavin Patel
|
7e13f525d9
|
Merge pull request #234 from splunk/CRL-1637-updatesforasx
updates to generate and manifests to support ASX
|
2019-10-28 15:56:25 -07:00 |
|
|
Jose Enrique Hernandez
|
9abae5f4a3
|
Merge pull request #224 from splunk/cloud_cryptomining
Cloud cryptomining
|
2019-10-28 15:43:53 -04:00 |
|