admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
13,612 Commits 697 Branches 195 Tags
vscode
Commit Graph

75 Commits

Author SHA1 Message Date
Bhavin Patel 14c145c133 Merge pull request #1953 from splunk/potentially_malicious_code_on_commandline 
Potentially malicious code on commandline
 2022-01-28 13:27:59 -08:00
patel-bhavin fe5db9e78e adding lookup files 2022-01-26 15:34:10 -08:00
Michael Haag 67e413d0e0 Update __mlspl_unusual_commandline_detection.yml 2022-01-26 11:26:25 -07:00
Michael Hart 39d7121dcd Updating mlmodel to 5.3.x specification as well as the test apparatus 2022-01-25 21:42:16 -05:00
mhaag-spl befe09f77c Nirsoft Software 2022-01-24 15:07:20 -07:00
Michael Hart e962bfb4bd Merge branch 'develop' of github.com:splunk/security_content into potentially_malicious_code_on_commandline 2022-01-21 19:26:39 -05:00
pyth0n1c ad2324d863 Branch was auto-updated. 2022-01-20 16:07:09 -08:00
patel-bhavin 6d13de615c duplicate 2022-01-20 15:50:28 -08:00
mhaag-spl 5bfcf2eea3 InstallUtil and DotNet Assemblies 2022-01-20 14:34:04 -07:00
Michael Hart 14db58ca19 Adding a yaml file to ensure that contentctl copies the mlmodel file to the right place 2022-01-20 08:32:39 -05:00
Michael Hart 82e6efb466 Adding in model lookup file 2022-01-19 20:04:16 -05:00
mhaag-spl ee3e77b45c DefaultAccount 2021-11-15 14:30:14 -07:00
P4T12ICK 45fd279a31 updated detections 2021-09-06 10:59:00 +02:00
P4T12ICK 99f0349e9f circle ci detecction 2021-09-02 10:42:01 +02:00
P4T12ICK 7f980b6a46 circle ci detecction 2021-09-01 17:54:38 +02:00
P4T12ICK bbf0a39460 new detection 2021-08-23 13:07:23 +02:00
P4T12ICK 9f6ec5febb new detection 2021-08-23 11:39:21 +02:00
P4T12ICK 622442cd3a new detection 2021-08-23 10:21:21 +02:00
P4T12ICK 749df59357 new detection 2021-08-23 10:17:40 +02:00
patel-bhavin c3db579480 lookup bug in generate 2021-07-13 11:52:17 -05:00
patel-bhavin 50bdf277c6 lookup definitions 2021-07-12 19:02:32 -05:00
patel-bhavin a0a57ab600 atttacker_tools_files 2021-07-12 18:54:24 -05:00
tccontre 69b11d3471 rttp4 2021-06-25 10:21:04 +02:00
Vatsal Jagani 838bbc4a58 JSWorm ransomware notes and extensions added. 2021-06-02 16:26:02 +05:30
mhaag-spl 2b5eb6fbc4 Masquerading - detections + analytic story 2021-04-26 13:38:52 -06:00
tcontreras 48120285ba clop_lookup_entry 2021-03-23 17:00:55 +01:00
divious1 6afaf49e44 fixing error reported by user 2021-02-16 09:45:00 -05:00
David Dorsey 88c9469541 More language clean up 2021-01-22 09:37:51 -06:00
David Dorsey 26050fae29 More language clean up 2021-01-22 09:34:33 -06:00
bpatel f5e653a552 duplicate PR 2021-01-21 11:27:24 -08:00
bpatel 1075e6b175 adding the lost lookup file 2020-12-15 18:30:54 -08:00
P4T12ICK 5fee68375f fix_bugs 2020-12-11 10:51:02 +01:00
bpatel dd647457c6 more app inspect 2020-12-08 15:14:11 -08:00
bpatel 25c7f33866 app inspect failures fixes 2020-12-08 14:56:39 -08:00
Ԝеѕ 0f2056149f add additional suspicious file extensions 
chm, vbe, additional media double ext exe's
 2020-11-18 16:19:11 -05:00
bpatel 8895ffddf7 updating macro fields 2020-11-16 17:22:29 -08:00
Bhavin Patel 3aa06e82b6 Merge branch 'develop' into mustang_beta 2020-11-10 09:59:18 -08:00
divious1 77af8684bc ryuk story and detections 2020-11-06 12:32:48 -05:00
bpatel 0cce001a42 merge with develop 2020-10-19 11:19:41 -07:00
wesinator 91a8cf9e08 add additional dynamic domains 
now-dns, other missing domains
 2020-10-13 12:44:52 -04:00
bpatel abac1c8b62 convert to kvstore and spl updates 2020-10-12 12:14:50 -07:00
bpatel 97ac9c5f62 spl updates and kvstore file 2020-10-12 11:49:37 -07:00
bpatel d237a2d984 lookup errors and consistency 2020-10-12 11:26:57 -07:00
bpatel b70138ed69 creating collections and search updates 2020-09-30 11:25:37 -07:00
David Dorsey 9763e75e02 Fixes 2020-09-23 00:07:54 -05:00
Rico Valdez 83015eba59 latest updates to create in new vendor_region 2020-09-09 16:26:25 -06:00
bpatel 10a5b76af7 merge with develop 2020-09-04 13:40:15 -07:00
David Dorsey cb5761a251 Added needed macros and lookups 2020-09-04 09:26:10 -05:00
Rico Valdez e8bf1d9e96 updates for mustang 2020-09-03 17:10:02 -06:00
David Dorsey b48b40ff76 Updated search for abnormally high cloud instances. Including 
verifying that enough data is there
 2020-08-25 22:28:59 -05:00