admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
23,152 Commits 697 Branches 195 Tags
7c756fcbd5d97098ffb50e12e52dffdd03c2165b
Commit Graph

23152 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
research bot 7c756fcbd5 Update dist/escu, dist/ssa, and dist/api folders with the latest content associated with this tag 2023-10-04 22:52:39 +00:00
Bhavin Patel 169c3af096 Merge pull request #2876 from splunk/njrat_spell 
NjRAT spell error
v4.13.0 		2023-10-04 15:26:16 -07:00
Bhavin Patel 07518ecaea updates 2023-10-04 15:22:26 -07:00
dependabot[bot] 21ab7dfcc2 Merge pull request #2875 from splunk/dependabot/pip/gitpython-3.1.35 2023-10-04 21:38:50 +00:00
srv-rr-gh-researchbt 033deb6c1c Branch was auto-updated. 2023-10-04 14:31:42 -07:00
research bot acaed15515 Update dist/escu, dist/ssa, and dist/api folders with the latest content associated with this tag 2023-10-04 21:31:21 +00:00
dependabot[bot] 46f1c2484c Bump gitpython from 3.1.33 to 3.1.35 
Bumps [gitpython](https://github.com/gitpython-developers/GitPython) from 3.1.33 to 3.1.35.
- [Release notes](https://github.com/gitpython-developers/GitPython/releases)
- [Changelog](https://github.com/gitpython-developers/GitPython/blob/main/CHANGES)
- [Commits](https://github.com/gitpython-developers/GitPython/compare/3.1.33...3.1.35)

---
updated-dependencies:
- dependency-name: gitpython
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-10-04 20:59:26 +00:00
dependabot[bot] 2c2e10e1db Merge pull request #2868 from splunk/dependabot/pip/pytest-7.4.2 2023-10-04 20:58:50 +00:00
dependabot[bot] 0ef217d698 Merge pull request #2867 from splunk/dependabot/pip/jsonschema-4.19.1 2023-10-04 20:58:29 +00:00
srv-rr-gh-researchbt a6d64b7e0d Branch was auto-updated. 2023-10-04 13:51:38 -07:00
srv-rr-gh-researchbt 8efa7b57b1 Branch was auto-updated. 2023-10-04 13:51:37 -07:00
Bhavin Patel f7dcab2ed4 Merge pull request #2862 from splunk/release_v4.13.0 
Release Branch 4.13.0
 2023-10-04 13:51:15 -07:00
pyth0n1c 9f5fdae162 Merge pull request #2873 from splunk/fix_duplicate_uuid 
Update uuid with new one
 2023-10-03 17:33:16 -07:00
pyth0n1c 3d21822873 Update uuid with new one 2023-10-03 17:31:15 -07:00
Bhavin Patel 393efa390f updating the lolbins to lowercase 2023-10-03 15:25:03 -07:00
Bhavin Patel fe821f3328 Merge pull request #2872 from splunk/add_process_path_to_detection 
add process_path to tstats output
 2023-10-03 15:21:46 -07:00
pyth0n1c ca2a81b55d add process_path to tstats output 2023-10-03 14:02:04 -07:00
Bhavin Patel b28e03b1c7 enrichment 2023-10-03 12:12:57 -07:00
Bhavin Patel 54fec22efc Merge pull request #2870 from splunk/new_ba_splv2_detection 
New BA detection with status : validation
 2023-10-03 12:06:39 -07:00
Bhavin Patel 8f6e67c614 adding new detection 2023-10-03 09:43:22 -07:00
pyth0n1c 87835aded9 Update dev_ssa version of detection as well. 2023-10-02 16:47:50 -07:00
pyth0n1c a23eb85f4f Removed printout from python code. Committed detection in dist with status validation. 2023-10-02 16:45:06 -07:00
pyth0n1c 95f836d4f6 Support for 'status: validation' to be used ONLY for BA Detections. If this is used with a non-ba detection, an exception will be generated. 2023-10-02 16:42:39 -07:00
Bhavin Patel fd7f9cfbf3 new_ssa_detection 2023-10-02 16:18:51 -07:00
Rod Soto 608438f223 Merge pull request #2860 from splunk/platform_security_20230919 
Platform security 20230919
 2023-10-02 14:13:37 -07:00
pyth0n1c d57b3f1fcf properly format times in risky command search 2023-10-02 12:56:00 -07:00
pyth0n1c 96c931eda9 use macro instead of using index and sourcetype directly. 2023-10-02 12:45:09 -07:00
pyth0n1c b16a497093 remove source= from search 2023-10-02 11:54:06 -07:00
pyth0n1c a00fce83db Update to new search after dynamic testing and refinement. 2023-10-02 11:49:57 -07:00
pyth0n1c aa366491e5 Merge branch 'platform_security_20230919' of https://github.com/splunk/security_content into platform_security_20230919 2023-10-02 11:37:32 -07:00
pyth0n1c de281dcdb6 First version of new detection for testing 2023-10-02 11:36:50 -07:00
srv-rr-gh-researchbt a51faed2c5 Branch was auto-updated. 2023-10-02 11:19:54 -07:00
Bhavin Patel 3223d8fef9 Merge pull request #2864 from splunk/ws_ftp 
WS_FTP
 2023-10-02 11:19:36 -07:00
pyth0n1c 588ef14f0c Added fillnull to improve detection accuracy for all logs. 2023-10-02 11:03:24 -07:00
srv-rr-gh-researchbt bc66334e86 Branch was auto-updated. 2023-10-02 09:12:48 -07:00
srv-rr-gh-researchbt ab5e3e2cf6 Branch was auto-updated. 2023-10-02 09:12:47 -07:00
Bhavin Patel 6af27bff01 Merge pull request #2865 from splunk/teamcity 
JetBrains TeamCity RCE
 2023-10-02 09:12:25 -07:00
Bhavin Patel f3540a2da7 Update message 2023-10-02 08:57:56 -07:00
Bhavin Patel ca1758dee7 adding Attacker obs 2023-10-02 08:55:43 -07:00
Bhavin Patel 34252303f2 Adding POST 2023-10-02 08:52:40 -07:00
dependabot[bot] 5e6fe3400b Bump pytest from 7.4.0 to 7.4.2 
Bumps [pytest](https://github.com/pytest-dev/pytest) from 7.4.0 to 7.4.2.
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/pytest-dev/pytest/compare/7.4.0...7.4.2)

---
updated-dependencies:
- dependency-name: pytest
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-10-01 23:33:08 +00:00
dependabot[bot] 70af8f7ea6 Bump jsonschema from 4.19.0 to 4.19.1 
Bumps [jsonschema](https://github.com/python-jsonschema/jsonschema) from 4.19.0 to 4.19.1.
- [Release notes](https://github.com/python-jsonschema/jsonschema/releases)
- [Changelog](https://github.com/python-jsonschema/jsonschema/blob/main/CHANGELOG.rst)
- [Commits](https://github.com/python-jsonschema/jsonschema/compare/v4.19.0...v4.19.1)

---
updated-dependencies:
- dependency-name: jsonschema
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2023-10-01 23:33:03 +00:00
Michael Haag 36c15130f6 JetBrains TeamCity RCE 2023-10-01 10:59:09 -06:00
Michael Haag 5921fc0679 fix 2023-10-01 10:25:32 -06:00
Michael Haag 63c248fe02 Update ws_ftp_remote_code_execution.yml 2023-10-01 10:23:12 -06:00
Michael Haag 85ec2974bb Create ws_ftp_remote_code_execution.yml 2023-10-01 10:18:46 -06:00
Michael Haag a3d1907490 fixes 2023-10-01 09:42:31 -06:00
Michael Haag 17ca5971d3 WS_FTP 2023-10-01 09:39:59 -06:00
srv-rr-gh-researchbt 9b6c459a09 Branch was auto-updated. 2023-09-29 15:21:20 -07:00
Bhavin Patel 24b8573f65 Merge pull request #2859 from splunk/obs_fix_25 
Fix issues with observables
 2023-09-29 15:21:01 -07:00