 Steven Dick
|
9448d2eff7
|
Update malicious_powershell_strings_20250113.csv
|
2025-01-31 08:00:13 -05:00 |
|
|
Steven Dick
|
500d3f05f1
|
Update malicious_powershell_strings_20250113.csv
|
2025-01-31 07:58:30 -05:00 |
|
|
Steven Dick
|
81e2d0ce3c
|
Update lookups/malicious_powershell_strings.yml
add case_sesnsitive tag
Co-authored-by: Nasreddine Bencherchali <monsteroffire2@gmail.com>
|
2025-01-31 07:29:21 -05:00 |
|
|
Steven Dick
|
a56ed86c2a
|
Update windows_powershell_script_block_with_malicious_string.yml
|
2025-01-13 12:11:25 -05:00 |
|
|
Steven Dick
|
c16c96c0c3
|
Update windows_powershell_process_with_malicious_string.yml
|
2025-01-13 12:10:47 -05:00 |
|
|
Steven Dick
|
35ec736492
|
Update windows_powershell_script_block_with_malicious_string.yml
|
2025-01-13 12:04:58 -05:00 |
|
|
Steven Dick
|
f51363bd21
|
Add files via upload
|
2025-01-13 11:53:27 -05:00 |
|
|
Steven Dick
|
47d4505e50
|
Add files via upload
|
2025-01-13 11:52:36 -05:00 |
|
|
Lou Stella
|
c0f0f9506d
|
Merge pull request #3274 from splunk/auto-ta-update-141
Automated Splunk TA Update 141
|
2025-01-10 09:03:16 -06:00 |
|
|
patel-bhavin
|
67de6175a9
|
Updated TAs
|
2025-01-10 06:57:41 +00:00 |
|
|
Bhavin Patel
|
ede80f4395
|
Merge pull request #3257 from nterl0k/nterl0k-t1219-rmm-update-2
Nterl0k - T1219 - RMM Detection for Registry locations.
|
2025-01-09 14:17:57 -08:00 |
|
|
Bhavin Patel
|
55d4936427
|
update token
|
2025-01-09 13:26:23 -08:00 |
|
|
Bhavin Patel
|
c01f87071e
|
Merge branch 'develop' into nterl0k-t1219-rmm-update-2
|
2025-01-09 13:10:22 -08:00 |
|
|
Lou Stella
|
d2592c5deb
|
Merge pull request #3270 from splunk/auto-ta-update-139
Automated Splunk TA Update 139
|
2025-01-09 13:42:36 -06:00 |
|
|
ljstella
|
1ce4f77a4c
|
update description
|
2025-01-09 12:02:56 -06:00 |
|
|
ljstella
|
4b28335f82
|
retrigger
|
2025-01-09 11:12:57 -06:00 |
|
|
ljstella
|
02afa4f4cb
|
Adding PSC
|
2025-01-09 11:08:49 -06:00 |
|
|
ljstella
|
5b8986469e
|
Removed parens that was killing app installs
|
2025-01-09 10:39:47 -06:00 |
|
|
ljstella
|
c591ef5ff7
|
Adding back two containers
|
2025-01-08 12:45:30 -06:00 |
|
|
ljstella
|
a9129bf5e3
|
Testing single container
|
2025-01-08 12:40:39 -06:00 |
|
|
Bhavin Patel
|
4c65798689
|
Merge branch 'develop' into nterl0k-t1219-rmm-update-2
|
2025-01-08 10:22:03 -08:00 |
|
|
Bhavin Patel
|
557fdeca89
|
Add manual_test flag
|
2025-01-08 10:21:40 -08:00 |
|
|
Bhavin Patel
|
607494bfb8
|
Branch was auto-updated.
|
2025-01-08 10:11:52 -08:00 |
|
|
Bhavin Patel
|
be3ab3c6ed
|
Merge pull request #3255 from nterl0k/nterl0k-T1550-netexec-usage
Nterl0k - T1550 - NetExec Usage Detection
|
2025-01-08 10:11:36 -08:00 |
|
|
Bhavin Patel
|
5e58179a00
|
file name update
|
2025-01-08 10:09:48 -08:00 |
|
|
patel-bhavin
|
7c7904265a
|
Updated TAs
|
2025-01-08 06:58:09 +00:00 |
|
|
Steven Dick
|
50fd37accd
|
Update windows_process_with_netexec_command_line_parameters.yml
Adding drilldowns
|
2025-01-07 15:49:16 -05:00 |
|
|
Steven Dick
|
2627b4bea5
|
Update detect_remote_access_software_usage_registry.yml
add drilldowns
|
2025-01-07 15:39:12 -05:00 |
|
|
Nasreddine Bencherchali
|
e8f9c1ddd0
|
Merge branch 'develop' into nterl0k-T1550-netexec-usage
|
2025-01-07 17:45:50 +01:00 |
|
|
Nasreddine Bencherchali
|
662b542299
|
Apply suggestions from code review
|
2025-01-07 17:44:25 +01:00 |
|
|
Bhavin Patel
|
263db16960
|
author update
|
2025-01-06 14:42:03 -08:00 |
|
|
Bhavin Patel
|
35368173c0
|
observable type
|
2025-01-06 14:41:11 -08:00 |
|
|
Bhavin Patel
|
736bcb3660
|
Merge branch 'develop' into nterl0k-t1219-rmm-update-2
|
2025-01-06 14:31:00 -08:00 |
|
|
Steven Dick
|
36a79d6b99
|
Update detect_remote_access_software_usage_registry.yml
|
2025-01-06 17:21:02 -05:00 |
|
|
Steven Dick
|
ff408f240c
|
Update detect_remote_access_software_usage_registry.yml
|
2025-01-06 17:19:33 -05:00 |
|
|
Bhavin Patel
|
d69dcf35a4
|
Merge pull request #3253 from nterl0k/nterl0k-t1595-generic-scanner
Nterl0k - T1595 - Generic Scanning Behavior
|
2025-01-06 13:30:17 -08:00 |
|
|
Bhavin Patel
|
70f1a691fb
|
Merge branch 'develop' into nterl0k-t1595-generic-scanner
|
2025-01-06 13:02:19 -08:00 |
|
|
Bhavin Patel
|
f285ed257f
|
Merge pull request #3249 from splunk/web_xchange_shell
Update - Detect Exchange Web Shell
|
2025-01-06 12:29:37 -08:00 |
|
|
Steven Dick
|
c1d7d2cc75
|
Update windows_process_with_netexec_command_line_parameters.yml
|
2025-01-06 11:01:24 -05:00 |
|
|
Lou Stella
|
f1fca81df6
|
Merge branch 'develop' into nterl0k-t1595-generic-scanner
|
2025-01-06 09:04:07 -06:00 |
|
|
Bhavin Patel
|
aae586aaa4
|
Branch was auto-updated.
|
2025-01-03 15:11:34 -08:00 |
|
|
Lou Stella
|
6adf586d51
|
Merge pull request #3262 from splunk/auto-ta-update-133
|
2025-01-03 17:11:13 -06:00 |
|
|
ljstella
|
83b3111dab
|
Pin container to 9.3
|
2025-01-03 14:39:59 -06:00 |
|
|
Bhavin Patel
|
f5751ef693
|
Branch was auto-updated.
|
2025-01-03 11:56:53 -08:00 |
|
|
Bhavin Patel
|
5f771b6445
|
Branch was auto-updated.
|
2025-01-03 11:56:50 -08:00 |
|
|
Bhavin Patel
|
1ae042b1d3
|
Merge pull request #3247 from splunk/issue_3245
Remove index from macro
|
2025-01-03 11:56:36 -08:00 |
|
|
Bhavin Patel
|
9ee8526d74
|
update mitre
Removed T1423 since that id is for Mobile
|
2025-01-03 11:54:54 -08:00 |
|
|
Bhavin Patel
|
39842b9ed9
|
build error fixes
Updated the yaml file name and other meta data to ensure it builds succesfully
|
2025-01-03 11:50:49 -08:00 |
|
|
Bhavin Patel
|
a0e6f0fa7b
|
minor update to data_source
|
2025-01-03 11:38:15 -08:00 |
|
|
patel-bhavin
|
8d6d3b45bd
|
Updated TAs
|
2025-01-02 06:58:09 +00:00 |
|