admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
16,959 Commits 697 Branches 195 Tags
149c19a6171c136155c1d72a2fcad2e681b60e21
Commit Graph

262 Commits

Author SHA1 Message Date
mvelazco 45ee82ff9e fixing macro 2022-07-12 10:26:48 -04:00
mvelazco ba163055eb adding 2 detections 2022-07-11 17:29:18 -04:00
mvelazco ca443d7b6a adding analytic story and new macro 2022-07-07 18:06:58 -04:00
pyth0n1c cc03d129c3 Branch was auto-updated. 2022-06-21 16:07:17 -07:00
pyth0n1c 25e4a180b1 Branch was auto-updated. 2022-06-21 14:46:28 -07:00
patel-bhavin a92a6f2546 map filter 2022-06-21 12:24:04 -07:00
mhaag-spl 9a25da4387 T1218.007 - MSIExec 2022-06-17 09:36:34 -06:00
pyth0n1c fea6debab2 Branch was auto-updated. 2022-06-09 11:50:11 -07:00
pyth0n1c 3fb342d4c4 Fixed improperly named macro. 
Renamed the macro in the tests
that use that macro. Added the
optional field, "custom_index"
to the test files which MUST
upload data into the _audit
index.  This branch doesn't
support custom_index yet,
but those changes will be merged
soon from another branch.
 2022-06-08 10:31:53 -07:00
pyth0n1c 1ac4d22e6c Branch was auto-updated. 2022-06-06 13:30:42 -07:00
pyth0n1c ba59c5716e Branch was auto-updated. 2022-06-06 13:30:40 -07:00
Lou Stella 607b7a1e37 Updated macro to not rely on field extraction 2022-06-06 14:55:56 -05:00
mvelazco 9941b8009d fixing issue with printservice macro 2022-06-01 13:13:24 -04:00
Rod Soto 522e569ced splkselfsigneddetection 2022-05-26 09:58:07 -07:00
Rod Soto 3f8d20e7b8 macrofix 2022-05-26 07:54:23 -07:00
Rod Soto 89ee09b0f0 fixedmacros 2022-05-26 07:50:10 -07:00
Rod Soto f29d6f9920 renamedsearch 2022-05-26 07:44:46 -07:00
Rod Soto b9d79c5ab1 changednameofdetection 2022-05-26 07:25:17 -07:00
Rod Soto 99d314eeea initialsearchskeleton 2022-05-24 17:29:15 -07:00
Lou Stella 24486a0d8d Cleaned up macro 2022-05-02 15:08:10 -05:00
Lou Stella 6fe602533b Removed detection 2022-05-02 14:30:43 -05:00
Rod Soto a71f12b921 Merge branch 'TR-1828' of github.com:splunk/security_content into TR-1828 2022-04-29 10:18:39 -07:00
Rod Soto c43dc89bbf detectionsforlocalprivescpathtraversal 2022-04-29 10:17:14 -07:00
Lou Stella c61f8670f8 CVE-2021-33845 2022-04-29 11:31:33 -05:00
Lou Stella de6ccbbf9c CVE-2022-27183 2022-04-27 12:44:48 -05:00
Lou Stella b1cabaecb2 Added macro 2022-03-28 09:18:19 -05:00
P4T12ICK 8937a5fec7 MacOS detections 2022-03-04 16:35:30 +01:00
Lou Stella 95b7a634ac DiskShadow + Story Scaffolding 2022-02-17 10:12:50 -06:00
Bhavin Patel 14c145c133 Merge pull request #1953 from splunk/potentially_malicious_code_on_commandline 
Potentially malicious code on commandline
 2022-01-28 13:27:59 -08:00
Michael Hart b80af6f151 Editing the macro to put the apply statement into the search query so that it's clear that MLTK is being used 2022-01-26 22:38:13 -05:00
patel-bhavin 45c4a7b600 remove files that are already merged 2022-01-26 13:51:51 -08:00
mhaag-spl befe09f77c Nirsoft Software 2022-01-24 15:07:20 -07:00
pyth0n1c ad85b8b21b Branch was auto-updated. 2022-01-24 10:51:04 -08:00
pyth0n1c 4c125f1dd6 Branch was auto-updated. 2022-01-24 10:51:03 -08:00
pyth0n1c 53ca345c06 Branch was auto-updated. 2022-01-24 10:40:46 -08:00
pyth0n1c bbebfe7d07 Branch was auto-updated. 2022-01-24 10:40:41 -08:00
pyth0n1c ac214bafa6 Branch was auto-updated. 2022-01-24 10:40:40 -08:00
mhaag-spl 5bfcf2eea3 InstallUtil and DotNet Assemblies 2022-01-20 14:34:04 -07:00
tccontre 1b510a0929 WhisperGateIsOpen 2022-01-20 15:11:12 +01:00
Michael Hart b59380d324 Potentially malicious execution on command line 2022-01-19 20:02:42 -05:00
Rod Soto c263ef4ac5 Merge branch 'nixpost' of github.com:splunk/security_content into nixpost 2022-01-12 07:47:54 -08:00
Rod Soto 5f71b501f2 addedmacros 2022-01-12 07:47:14 -08:00
mvelazco 19bd2fd736 updating sysmon macro 2021-12-13 18:00:14 -05:00
Michael Haag 2565ad2bbf Update windows_shells.yml 2021-12-13 14:37:40 -07:00
mhaag-spl 71295432e3 Windows shells 2021-12-13 13:01:45 -07:00
mhaag-spl f3b31c113b java Shells 2021-12-13 11:54:59 -07:00
Michael Haag b87061f794 rookie mistake 2021-11-30 05:34:29 -07:00
mhaag-spl 81e952185e Rclone Haagrid 2021-11-29 15:55:38 -07:00
tccontre ce6318c87b more_ioc_detections 2021-11-19 12:01:45 +01:00
Bhavin Patel 19eb60a778 Branch was auto-updated. 2021-11-18 12:58:40 -08:00