690021590a
add MS windows
2022-06-24 14:30:58 -07:00
e92699f315
st
2022-06-24 14:27:27 -07:00
1272dc827a
Merge pull request #2251 from splunk/exec-the-msi
...
T1218.007 - MSIExec
2022-06-23 13:55:03 -07:00
056b07a686
remove detection
2022-06-23 11:09:07 -06:00
7ef25a98ec
updating docs and package bits [ci skip]
2022-06-22 17:56:19 +00:00
e53e9cf232
Branch was auto-updated.
2022-06-22 10:19:36 -07:00
cda681eb8b
Merge pull request #2260 from splunk/DetectionFixes
...
Detection fixes
2022-06-22 13:19:16 -04:00
0de66753a1
Branch was auto-updated.
2022-06-22 07:17:51 -07:00
52fa6467a9
Updated per customer feedback
2022-06-22 09:17:14 -05:00
54203d6858
Fixing detection to conform to new sysmon
...
behavior.
2022-06-21 17:21:30 -07:00
b73ea9e5ae
Added another custom_index to a test
...
file that was failing because it did not
have one.
2022-06-21 16:59:44 -07:00
ff0a57e526
Branch was auto-updated.
2022-06-21 16:45:18 -07:00
07a13ca16b
Merge pull request #2240 from splunk/more-defense-evasion
...
more-defense-evasion
2022-06-21 16:44:59 -07:00
8d04037125
Update windows_impair_defenses_disable_win_defender_auto_logging.yml
2022-06-21 16:28:05 -07:00
35908f5a30
Removed user from the stats call of this search
...
since it does not exist and the field userName
does exist. And it is likely to have captured
the same data.
2022-06-21 16:25:20 -07:00
cc03d129c3
Branch was auto-updated.
2022-06-21 16:07:17 -07:00
62ed8fe817
Branch was auto-updated.
2022-06-21 16:07:16 -07:00
471ee2b8a5
Merge pull request #2220 from splunk/inspired_2194
...
Dupliate: PR 2194
2022-06-21 19:06:53 -04:00
b5c79b6db8
Added a custom index for a detection test
...
that was created when custom_index
support did not yet exist.
2022-06-21 15:53:26 -07:00
88ce513e8e
Branch was auto-updated.
2022-06-21 15:47:24 -07:00
6e989d1e07
Branch was auto-updated.
2022-06-21 15:47:23 -07:00
349551a98f
Branch was auto-updated.
2022-06-21 15:47:21 -07:00
7f38d4e78e
Merge pull request #2252 from splunk/fixing_incorrect_story
...
fixing incorrect story pointer
2022-06-21 15:47:05 -07:00
7816778eae
Removed the field "user" from the stats
...
line. It does not appear to exist in the raw
data and is not pulled into any field(s).
However, there is a field called userName
which, presumably, represents the same data.
2022-06-21 15:45:00 -07:00
d671db062d
Branch was auto-updated.
2022-06-21 15:28:41 -07:00
b44da42de6
Branch was auto-updated.
2022-06-21 15:28:40 -07:00
6616463196
Branch was auto-updated.
2022-06-21 15:28:39 -07:00
6cbace8412
Branch was auto-updated.
2022-06-21 15:28:38 -07:00
e470e2b6d8
Merge pull request #2257 from splunk/2253_fix
...
Rundll32 LockWorkstation search
2022-06-21 18:28:11 -04:00
aa228e84be
hunting
2022-06-21 14:55:19 -07:00
d5d0868005
merge from develop
2022-06-21 14:53:25 -07:00
de30c530eb
Branch was auto-updated.
2022-06-21 14:46:29 -07:00
25e4a180b1
Branch was auto-updated.
2022-06-21 14:46:28 -07:00
88f26544e2
Branch was auto-updated.
2022-06-21 14:46:26 -07:00
c42c8acce2
Branch was auto-updated.
2022-06-21 14:46:22 -07:00
6fc1b95369
Merge pull request #2258 from splunk/properly_detected_failed_attack_data_downloads
...
Properly detected failed attack data downloads
2022-06-21 14:46:03 -07:00
26f6bbfc92
Adding the URL_TOOLBOX app to
...
the application baseline.
2022-06-21 14:29:11 -07:00
6554d4a42b
Moved ssa___ test file from the tests/network directory to the tests/experimental/endpoint directory because that's where the corresponding detection resides.
2022-06-21 13:59:50 -07:00
5762b4e373
Updated the app baseline as well as
...
the python code for generating the
default config. Also updated the
print behavior for when files are
downloaded.
App baseline is now current, and
files are hosted on S3, as
of 06/21/2022.
2022-06-21 13:53:26 -07:00
575cd80e01
Updated observable & asset_type
2022-06-21 15:17:25 -05:00
6b06ab718b
Fixing a link to a dataset that has been moved.
2022-06-21 13:13:50 -07:00
e681b766c2
Fixing field name
2022-06-21 14:59:48 -05:00
c98d7b6855
Fix an issue where trying to download a file from attack_data that returns a 404 fails too late in the process, giving a nondescriptive error message and resulting in a bad filename being included in the detection failure manifest.
2022-06-21 12:52:32 -07:00
85f4f107a3
Changed to anomaly
2022-06-21 14:45:43 -05:00
a92a6f2546
map filter
2022-06-21 12:24:04 -07:00
8ca9ac7b57
adding urltoolbox and spl updates
2022-06-21 12:05:52 -07:00
2ea683be87
Merge branch 'develop' into inspired_2194
2022-06-21 11:04:27 -07:00
53bc5dcda4
fixing incorrect story pointer
2022-06-20 16:33:35 -04:00
56394444ce
fix
2022-06-17 13:09:37 -06:00
2788e8e63c
path fix
2022-06-17 10:22:24 -06:00
patel-bhavin