385bc45c5d
Update windows_phishing_recent_iso_exec_registry.yml
2022-09-05 10:56:24 +02:00
2dc78584a0
Update windows_phishing_recent_iso_exec_registry.yml
2022-09-05 10:56:01 +02:00
9894bf1583
Branch was auto-updated.
2022-09-02 19:15:34 -04:00
95e4eb048c
Merge pull request #2359 from splunk/fix_sourcetype_for_linux_kernel_module_detection
...
Update linux_kernel_module_enumeration.test.yml
Since this is such a small and simple fix, I have merged it myself without review.
Note that this was just an update to a test file, not a modification to the detection itself.
2022-09-02 19:15:12 -04:00
5c4d054652
Update linux_kernel_module_enumeration.test.yml
...
Changing sourcetype from linux_sysmon --> sysmon_linux
2022-09-02 18:50:48 -04:00
d764f48a29
Update windows_input_capture_using_credential_ui_dll.yml
2022-09-01 15:39:08 +02:00
8abf778411
Update windows_gather_victim_identity_sam_info.yml
2022-09-01 15:38:42 +02:00
1557a528cf
brute-ratel-2
2022-08-31 10:12:55 +02:00
c8f038be5d
Update windows_remote_access_software_brc4_loaded_dll.yml
2022-08-31 09:44:21 +02:00
126049593e
Updates
2022-08-30 11:21:46 -06:00
e90fa05a96
Update windows_remote_access_software_brc4_loaded_dll.yml
2022-08-30 17:49:16 +02:00
ec1a26ed46
Update windows_phishing_recent_iso_exec_registry.yml
2022-08-30 17:46:57 +02:00
d91a14c4d4
Update windows_hijack_execution_flow_version_dll_side_load.yml
2022-08-30 17:42:04 +02:00
8d6d137ba1
Update windows_remote_access_software_brc4_loaded_dll.yml
2022-08-30 13:11:24 +02:00
b401ed9d50
brute-ratel-2
2022-08-30 13:08:04 +02:00
2adb6ca2ff
updating docs and package bits [ci skip]
2022-08-29 17:48:48 +00:00
2dbcc2aa64
Merge pull request #2323 from splunk/eliminate_duplicate_python_requirements_files
...
Eliminate duplicate python requirements files
2022-08-26 16:04:11 -05:00
92e2d97588
Update detection-testing.yml
...
For a quotation mark
2022-08-26 13:52:30 -07:00
8d611bb546
Update detection-testing.yml
...
Updated to use pip cache
2022-08-26 13:50:57 -07:00
baeba5b319
Fixed pathing
...
Fixed pathing to venv and
requirements.txt files.
2022-08-26 13:34:37 -07:00
305a672f51
Delete contentctl_python_platforms_test.yml
...
Removed extra testing workflow. This logic will
be integrated into a separate repo at a later time.
2022-08-26 13:27:01 -07:00
e5962ef678
Update contentctl_python_platforms_test.yml
...
Reduce platforms we are testing
against for now until we can further
improve support.
2022-08-26 12:22:18 -07:00
c1be892bd1
Merge branch 'develop' into eliminate_duplicate_python_requirements_files
2022-08-26 12:09:54 -07:00
9f2fa92efd
Merge pull request #2336 from splunk/hijack
...
HijackThis
2022-08-26 13:42:17 -05:00
bd2d1515cb
Branch was auto-updated.
2022-08-26 10:01:42 -07:00
f9e770eaa5
Update log4shell_cve_2021_44228_exploitation.yml
2022-08-26 11:01:25 -06:00
19b3efc01a
Merge pull request #2321 from splunk/TR_2301
...
Add Linux Living off the land Privilege Escalation Detections
2022-08-26 12:01:19 -05:00
b2941ca736
Update linux_persistence_and_privilege_escalation_risk_behavior.yml
2022-08-26 10:58:35 -06:00
c912c7c939
Update linux_persistence_and_privilege_escalation_risk_behavior.yml
2022-08-26 10:58:17 -06:00
2bfc066411
Branch was auto-updated.
2022-08-26 09:35:15 -07:00
5d8cbb81ca
Branch was auto-updated.
2022-08-26 09:35:15 -07:00
a8097ab665
Merge pull request #2341 from splunk/fix-desc
...
fix-desc
2022-08-26 11:34:56 -05:00
e0f0d48784
minonr text updates
2022-08-26 10:46:51 -05:00
c560685650
Update windows_possible_credential_dumping.yml
2022-08-26 09:18:56 -06:00
346e7000e2
fix-desc
2022-08-26 15:39:48 +02:00
5ddf3c9cf7
Merge branch 'hijack' of https://github.com/splunk/security_content into hijack
2022-08-26 06:01:16 -06:00
c7aba6738e
Update windows_remote_access_software_hunt.yml
2022-08-26 06:01:15 -06:00
63c3744821
Branch was auto-updated.
2022-08-25 16:25:59 -07:00
a1d1297de9
Branch was auto-updated.
2022-08-25 16:25:56 -07:00
cfaf15a916
Merge pull request #2337 from splunk/100_percent_pass_rate
...
100 percent pass rate
2022-08-25 18:25:35 -05:00
474ea41291
Finishing updates authors, versions,
...
and dates on searches.
2022-08-25 15:09:13 -07:00
8b47ea7b36
Updating the author(s), versions, and
...
dates for searches in PR.
2022-08-25 15:08:46 -07:00
11eb0feac6
T1003.001 Update
2022-08-25 08:04:20 -06:00
0ae64ea317
Branch was auto-updated.
2022-08-23 13:05:57 -07:00
a2f1972d54
Branch was auto-updated.
2022-08-23 13:05:56 -07:00
4788d6c4e3
Branch was auto-updated.
2022-08-23 13:05:54 -07:00
0c0fc259b6
Merge pull request #2325 from splunk/Update_Azure_Account_Takeover
...
Update Azure AD Account Takeover Analytic Story
2022-08-23 15:05:18 -05:00
122dee07d2
Branch was auto-updated.
2022-08-23 13:02:42 -07:00
889cdf3bc5
Branch was auto-updated.
2022-08-23 13:02:39 -07:00
748e952751
Branch was auto-updated.
2022-08-23 13:02:38 -07:00
tccontre