 divious1
|
6caea176a6
|
corrected a few bugs with the spec
|
2020-02-07 13:51:31 -05:00 |
|
|
Bhavin Patel
|
096234f417
|
Merge pull request #354 from splunk/fix_convert_bug_issue_343
fixes issue 343
|
2020-02-07 10:38:14 -08:00 |
|
|
Bhavin Patel
|
6b2c9e4172
|
Merge pull request #327 from splunk/supicious_email_updates
updating boiler plate, detection not working out of box against T1193…
|
2020-02-07 10:35:35 -08:00 |
|
|
Bhavin Patel
|
556efc4a78
|
Merge pull request #325 from splunk/dns_query_updates
Update version info and macros
|
2020-02-07 10:33:05 -08:00 |
|
|
divious1
|
3336663726
|
fixes issue 343
|
2020-02-07 13:32:56 -05:00 |
|
|
bpatel
|
6896cf9b58
|
removing incorrect mitre id
|
2020-02-07 10:27:21 -08:00 |
|
|
Bhavin Patel
|
f682a22461
|
Merge branch 'develop' into CRL-1725_Processes.parent_process.Correction
|
2020-02-07 10:18:17 -08:00 |
|
|
bpatel
|
1c97742fed
|
macros node
|
2020-02-07 10:17:14 -08:00 |
|
|
Bhavin Patel
|
98195728fc
|
Merge pull request #324 from splunk/first_time_seen_cmd_updates
update version info, add macros for first time seen cmd line detection
|
2020-02-07 10:07:18 -08:00 |
|
|
Bhavin Patel
|
0432161688
|
Merge pull request #326 from splunk/smb_detection_updates
update smb related content.
|
2020-02-07 10:05:44 -08:00 |
|
|
Bhavin Patel
|
44761d1106
|
Merge pull request #348 from splunk/CRL-1723
CRL-1723 : corrected field name in SPL Filesystem.filepath [which doe…
|
2020-02-07 10:04:22 -08:00 |
|
|
Bhavin Patel
|
7d61248099
|
Merge branch 'develop' into CRL-1725_Processes.parent_process.Correction
|
2020-02-07 10:03:49 -08:00 |
|
|
Bhavin Patel
|
9849b76aff
|
Merge branch 'develop' into first_time_seen_cmd_updates
|
2020-02-07 10:02:26 -08:00 |
|
|
rvaldez617
|
7d33b5c36c
|
Merge pull request #350 from splunk/issue_323
CRL-1721 - updating files as per Dons/Andrew Lee's feedback
|
2020-02-05 16:06:17 -07:00 |
|
|
bpatel
|
92768472e0
|
updating files as per Dons feedback
|
2020-02-04 09:15:39 -08:00 |
|
|
Jason Brewer
|
e18a1402f4
|
CRL-1723 : corrected field name in SPL Filesystem.filepath [which does not exist] to Filesystem.file_path.
|
2020-02-03 21:00:55 -08:00 |
|
|
Jason Brewer
|
346709b58f
|
CRL-1725 - Changed prohibited_apps_spawning_cmdprompt.yml to use parent_process_name as entity. Changed supress field to add user. Bumped detection version number and story version numbers on stories/suspicious_cmd_line_executions.yml and stories/suspicious_mshta_activities.yml.
|
2020-02-03 15:24:49 -08:00 |
|
|
divious1
|
2b6db17c99
|
fixing issue #343
|
2020-02-03 17:10:15 -05:00 |
|
|
jzsplunk
|
c92d097eac
|
updating boiler plate, detection not working out of box against T1193 but this may be due to error loading lookup table for supicious file extensions.
|
2020-01-27 03:04:55 -08:00 |
|
|
jzsplunk
|
d4aa6bc9ea
|
update smb related content. The outbound_smb_connections detection works out of the box against attack ID T1110 when testing in the attack range.
|
2020-01-27 02:33:26 -08:00 |
|
|
jzsplunk
|
b762034a4b
|
update version info and macros, attack range freezing on testing detection against attack ID T1071 so query is untested against atomic red team test for now
|
2020-01-27 01:44:53 -08:00 |
|
|
jzsplunk
|
6406cfbc32
|
update version info, add macros for first time seen cmd line detection
|
2020-01-27 01:08:53 -08:00 |
|
|
bpatel
|
9e6becda1f
|
adding definitions
|
2020-01-23 13:31:43 -08:00 |
|
|
Jose Enrique Hernandez
|
2fd12b9155
|
Merge pull request #320 from splunk/don_young_bug
updating the manifest to reflect correct details
|
2020-01-22 17:26:54 -08:00 |
|
|
Bhavin Patel
|
dd5b1ee344
|
Merge pull request #319 from splunk/dns_hijack_story_update
CRL-1718 updated fields and added macros and lookup entries
|
2020-01-22 14:58:40 -08:00 |
|
|
divious1
|
0ba1b4c30d
|
fixing mispelling
|
2020-01-22 13:31:09 -08:00 |
|
|
Bhavin Patel
|
38b84113bf
|
Merge pull request #318 from splunk/CRL-1495-update_share_creation_and_deletion
CRL-1495 update share creation and deletion
|
2020-01-22 09:19:43 -08:00 |
|
|
Bhavin Patel
|
0cef2e73b1
|
Merge pull request #315 from splunk/CRL-1716-FixPowerShellObfusc
CRL-1716 - Fixing by clause to allow searching Processes.process for …
|
2020-01-22 09:18:42 -08:00 |
|
|
bpatel
|
5d6ef5ce60
|
renaming files
|
2020-01-22 09:14:51 -08:00 |
|
|
Jason Brewer
|
b62ce205b8
|
CRL-1716 - Updating per code review requests. Adding output macro file and reference within the detection search.
|
2020-01-22 08:26:16 -08:00 |
|
|
Jose Enrique Hernandez
|
bfa7317668
|
removing comments
|
2020-01-21 18:14:24 -08:00 |
|
|
bpatel
|
3bf8cf26de
|
updating the manifest to reflect correct details
|
2020-01-21 18:05:33 -08:00 |
|
|
Jose Enrique Hernandez
|
c6a904b36f
|
Merge pull request #314 from splunk/CRL-1712_netsh_abuse
CRL-1712 Disabling Security Tools
|
2020-01-21 11:42:42 -08:00 |
|
|
Jose Enrique Hernandez
|
11a1b68979
|
bumping version
|
2020-01-21 11:28:26 -08:00 |
|
|
jzsplunk
|
c007d41844
|
remove comments to get search working, clean up detection
|
2020-01-21 02:23:15 -08:00 |
|
|
jzsplunk
|
82d00df489
|
Drop comments to get search working, change file name to reflect generic case of detecting any type of share deletion or creation.
|
2020-01-21 02:07:30 -08:00 |
|
|
jzsplunk
|
6eed922214
|
testing commented search
|
2020-01-21 01:58:30 -08:00 |
|
|
divious1
|
0ac15cb563
|
updated fields and added macros and lookup entries
|
2020-01-19 21:37:45 -05:00 |
|
|
Jason Brewer
|
5383117f1c
|
CRL-1716 - Fixing by clause to allow searching Processes.process for obfuscation chars.
|
2020-01-17 16:48:27 -08:00 |
|
|
Jose Enrique Hernandez
|
6a4d42f582
|
Merge pull request #310 from splunk/CRL-1715
CRL-1715 updated search syntax, tested in attack_range
|
2020-01-16 15:36:19 -06:00 |
|
|
bpatel
|
69a35f1c16
|
macros
|
2020-01-14 15:40:45 -08:00 |
|
|
bpatel
|
52f5a71060
|
new search unload sysmon filter
|
2020-01-14 15:27:57 -08:00 |
|
|
bpatel
|
54c9bc9c38
|
updated search/metadata, tested in attack_range
|
2020-01-13 12:42:35 -08:00 |
|
|
Patrick Bareiss
|
4a0bf015e8
|
tested and updates searches for lateral movement story
|
2020-01-13 11:18:54 +01:00 |
|
|
Patrick Bareiss
|
71241e566f
|
tested and updates searches for lateral movement story
|
2020-01-13 10:39:57 +01:00 |
|
|
Patrick Bareiss
|
ce3b152832
|
WIP: testing lateral movement analytics story
|
2020-01-10 12:47:12 +01:00 |
|
|
divious1
|
f178e41e12
|
updated create hidden shares
|
2020-01-09 16:59:04 -05:00 |
|
|
divious1
|
0abf721c3f
|
introduced mitre technique id to detection spec
|
2020-01-06 13:31:43 -05:00 |
|
|
bpatel
|
fe8ff90e4e
|
updating how to implement and readme
|
2019-12-19 11:22:44 -08:00 |
|
|
briannablacet
|
4f0a6a0cb7
|
Error fixes
|
2019-12-18 11:12:23 -08:00 |
|