admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
28,038 Commits 697 Branches 195 Tags
1e0096296b4133851bb79e09b2e31bf97c78dfae
Commit Graph

28038 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
P4T12ICK 1e0096296b bug fix 2026-03-26 07:52:19 +01:00
p4t12ick eb0cb46f71 Merge branch 'develop' into detections_improvement 2026-03-26 07:51:05 +01:00
P4T12ICK e556cac279 Improved detections based on telemetry. 2026-03-26 07:46:49 +01:00
Br3akp0int 697a77cd08 Add Tagging and Analytic Story for Void Manticore (#3959) 
---------

Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-03-23 17:19:07 +01:00
Lou Stella 0f08a8b884 Tweaking attack_data links (#3966) 
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-03-23 14:38:28 +01:00
Bhavin Patel 37c9344ca0 chore: bump contentctl.yml to 5.25.0 (#3968) 
Co-authored-by: research bot <research@splunk.com>
 2026-03-23 17:52:55 +05:30
Bhavin Patel 45134af4ea Updated TAs (#3965) 
Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
v5.24.0 		2026-03-19 00:13:23 +05:30
Lou Stella afccbee627 Changing parameter to hopefully fix TA "dependabot" (#3964) 
* Changing parameter to hopefully work

* typo

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-03-18 23:41:40 +05:30
Lou Stella c5506fa1f9 Merge pull request #3963 from splunk/bump_okta_ta 
bump okta ta to 5.0.1
 2026-03-18 12:57:29 -05:00
pyth0n1c fbf8bcbd40 bump okta ta. 5.0.0 was yanked from splunkbase 2026-03-18 10:42:14 -07:00
Bhavin Patel 709e57e129 Test- Integration failure fixes (#3960) 
* unit test

* testing second

* updating SPL

* prettyplz

* remove test
 2026-03-18 02:30:04 +05:30
Br3akp0int 27aeb7d95d Add BlankGrabber Stealer Related Analytics and Tagging (#3943) 
---------

Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-03-16 18:09:57 +01:00
Br3akp0int 9c7ef33e81 Fix Issue #3950 (#3957) 
---------

Co-authored-by: Bhavin Patel <bpatel@splunk.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-03-16 16:18:01 +01:00
Bhavin Patel 98ef843af8 Fix Windows AD Domain Replication ACL Addition (#3958) 
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-03-16 16:08:55 +01:00
Michael Haag 4aeba4c377 Add Lotus Blossom Related Analytics and Tagging (#3953) 
---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-03-16 15:47:02 +01:00
Bhavin Patel b3fed38275 Deprecate MLTK detections (#3922) 
---------

Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
Co-authored-by: Lou Stella <ljstella@gmail.com>
 2026-03-16 14:59:40 +01:00
Br3akp0int 3208147d4d Add Coverage For QuietVault (#3952) 
---------

Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-03-14 01:11:44 +01:00
Nasreddine Bencherchali 29113be7a7 Fix Broken Link, Versions and Pre-Commit (#3956) 
* fix links and versions

* more versions
 2026-03-13 19:17:15 +05:30
Andrei Banaru d1d4883e18 fix: replace src with src_user (#3955) 
Co-authored-by: Andrei Banaru <a.banaru@iaea.org>
 2026-03-13 17:29:46 +05:30
Emil a0059cf72c Adding dynamic information to static rba messages (#3951) 
* Adding dynamic information to static rba messages

* Updating rba message to bette represent what the detection triggers on

* Correcting syntax of rba message

* Updating version and date
 2026-03-13 11:27:18 +05:30
Br3akp0int de62304785 Add Analytic Story Tagging for Muddy Water (#3947) 
---------

Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
 2026-03-12 16:30:09 +00:00
Lou Stella 14a2a96f71 Merge pull request #3949 from splunk/dependabot/pre_commit/https-/github.com/pre-commit/pre-commit-hooks-6.0.0 
Bump https://github.com/pre-commit/pre-commit-hooks from v4.6.0 to 6.0.0
 2026-03-12 10:53:14 -05:00
Lou Stella 1e8aa4c728 Merge branch 'develop' into dependabot/pre_commit/https-/github.com/pre-commit/pre-commit-hooks-6.0.0 2026-03-12 10:51:02 -05:00
Nasreddine Bencherchali ed5884f607 More SD-WAN Content (#3944) 
* add more sd-wan content

* rename macro

* Update cisco_sd_wan_service_proxy_access.yml

* fix parsing

* Update cisco_sd_wan___arbitrary_file_overwrite_exploitation_activity.yml

* apply review suggestions
 2026-03-12 18:16:41 +05:30
ljstella f17bc8df6d Not every system has a python, but they should all have a python3 2026-03-11 10:39:42 -04:00
ljstella f0aadf7c81 Remove two hooks 2026-03-11 10:35:32 -04:00
dependabot[bot] 8231be2295 Bump https://github.com/pre-commit/pre-commit-hooks from v4.6.0 to 6.0.0 
Bumps [https://github.com/pre-commit/pre-commit-hooks](https://github.com/pre-commit/pre-commit-hooks) from v4.6.0 to 6.0.0.
- [Release notes](https://github.com/pre-commit/pre-commit-hooks/releases)
- [Changelog](https://github.com/pre-commit/pre-commit-hooks/blob/main/CHANGELOG.md)
- [Commits](https://github.com/pre-commit/pre-commit-hooks/compare/v4.6.0...v6.0.0)

---
updated-dependencies:
- dependency-name: https://github.com/pre-commit/pre-commit-hooks
  dependency-version: 6.0.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-03-11 14:29:04 +00:00
Lou Stella e8f5e6453a Adding pre-commit to dependabot (#3948) 2026-03-11 19:58:11 +05:30
Br3akp0int 3da4f7958a anomaly_standard_init_score (#3946) 
Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-03-10 14:19:08 +05:30
Br3akp0int 2e2f6fc649 ttp_standard_init_score (#3945) 
Co-authored-by: Teoderick Contreras <tcontreras@splunk.com>
 2026-03-10 14:10:37 +05:30
Emil b1425aadfa Split and tweak of linux_docker_privilege_escalation (#3929) 
* Splitting linux_docker_privilege_escalation into two detections, modifying the queries to more precisely trigger on the activity

* Adding back original author, removing trailing whitespace

* deprecate and update metadata

* Update linux_docker_shell_execution.yml

---------

Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-03-10 12:46:59 +05:30
Bhavin Patel 96a4df100d Automated Splunk TA Update 560 (#3938) 
* Updated TAs

* updating app name

* testing TA

* remove comments

---------

Co-authored-by: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com>
Co-authored-by: Lou Stella <ljstella@gmail.com>
 2026-03-06 12:26:52 +05:30
Lou Stella 22953496b2 Merge pull request #3937 from splunk/bump_contentctl_5.24.0 
Bump contentctl.yml to 5.24.0
 2026-03-05 12:14:22 -06:00
ljstella ba6f9b948d Bumping requirements.txt 2026-03-05 12:28:06 -05:00
ljstella 8f80f086b3 Actually remove the detection 2026-03-05 09:15:43 -05:00
ljstella 5440317966 Removed detection for v5.24.0 2026-03-05 09:12:44 -05:00
research bot 1eaa1a12d2 chore: bump contentctl.yml to 5.24.0 2026-03-04 19:11:57 +00:00
dependabot[bot] 261b5fee45 Bump aws-actions/configure-aws-credentials from 5 to 6 (#3933) 
Bumps [aws-actions/configure-aws-credentials](https://github.com/aws-actions/configure-aws-credentials) from 5 to 6.
- [Release notes](https://github.com/aws-actions/configure-aws-credentials/releases)
- [Changelog](https://github.com/aws-actions/configure-aws-credentials/blob/main/CHANGELOG.md)
- [Commits](https://github.com/aws-actions/configure-aws-credentials/compare/v5...v6)

---
updated-dependencies:
- dependency-name: aws-actions/configure-aws-credentials
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
Co-authored-by: Nasreddine Bencherchali <nasreddineb@splunk.com>
v5.23.0 		2026-03-03 20:47:16 +00:00
dependabot[bot] 2f600e1214 Bump actions/upload-artifact from 6 to 7 (#3932) 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6 to 7.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/v6...v7)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-version: '7'
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-03-03 20:46:02 +00:00
Bhavin Patel 7217019457 fix rba message (#3934) 2026-03-03 21:40:57 +01:00
Nasreddine Bencherchali f930b525ee Add New Analytics - February Batch (#3886) 
* add percent encoded curl exec

* Fix #3916

* Add other calc process names entries

* apply formatting

* add more color

* add cisco sd-wan stuff

* update tags

* Update cisco_sd_wan___low_frequency_rogue_peer.yml

* add ds and maps it

---------

Co-authored-by: Bhavin Patel <bhavin.j.patel91@gmail.com>
 2026-03-03 18:31:37 +05:30
pyth0n1c 34be5c0b0c normalize all legacy line endings (#3931) 2026-03-02 23:34:35 +01:00
pyth0n1c cb067903a3 Merge pull request #3930 from splunk/remove_extra_fields 
Remove EXTRA fields
 2026-03-02 13:39:11 -08:00
pyth0n1c 997eb76be6 Remove EXTRA fields that are not part 
of the models from yml files
 2026-03-02 12:28:07 -08:00
p4t12ick b6888c5e86 Merge pull request #3927 from splunk/ta_update_script 
bug fix: update dependencies Ci CD TA update script
 2026-02-26 15:14:38 +01:00
p4t12ick 773343a116 Merge branch 'develop' into ta_update_script 2026-02-26 15:10:58 +01:00
P4T12ICK 5ed4c94984 bug fix: update dependencies 2026-02-26 15:10:00 +01:00
p4t12ick eb01d70fc6 Merge pull request #3926 from splunk/ta_update_script 
Ta update script
 2026-02-26 15:07:08 +01:00
p4t12ick ee4d95617a Merge branch 'develop' into ta_update_script 2026-02-26 14:59:17 +01:00
P4T12ICK f367fb9c33 update dependencies 2026-02-26 13:41:54 +01:00