 Bhavin Patel
|
45ffbde816
|
Merge branch 'develop' into CRL-1746
|
2020-03-16 13:23:43 -07:00 |
|
|
bpatel
|
d7828c2c0d
|
version and date update
|
2020-03-16 12:56:56 -07:00 |
|
|
rvaldez617
|
bae56e409c
|
Merge pull request #387 from splunk/CRL-1735
CRL-1735: adding escape chars
|
2020-03-16 13:31:25 -06:00 |
|
|
rvaldez617
|
b20a771463
|
Merge pull request #389 from splunk/CRL-1739
CRL-1739: spl update to use parent_process_name
|
2020-03-16 13:26:35 -06:00 |
|
|
rvaldez617
|
27f1ea2b4f
|
Merge pull request #393 from splunk/CRL-1736
CRL-1736: search updated
|
2020-03-16 13:25:47 -06:00 |
|
|
rvaldez617
|
f36032d76e
|
updating version and mod_date
|
2020-03-16 13:20:02 -06:00 |
|
|
bpatel
|
a3d9771238
|
updating spl
|
2020-03-16 12:18:24 -07:00 |
|
|
rvaldez617
|
ae54845c31
|
Merge pull request #388 from splunk/CRL-1737
CRL-1737: removing status field from spl
|
2020-03-16 13:17:31 -06:00 |
|
|
rvaldez617
|
eefbae66a9
|
Merge pull request #386 from splunk/CRL-1734
CRL-1734: updating spl with escape chars and better output
|
2020-03-16 13:14:47 -06:00 |
|
|
rvaldez617
|
d624d4b563
|
Merge pull request #384 from splunk/CRL-1732
CRL-1732: removing status from spl
|
2020-03-16 13:11:19 -06:00 |
|
|
rvaldez617
|
f3963c97be
|
formatting, and version/mod_date update
|
2020-03-16 13:09:27 -06:00 |
|
|
rvaldez617
|
9363ded8d0
|
Merge pull request #385 from splunk/CRL-1733
CRL-1733: updating instructions for better clarification
|
2020-03-16 13:00:23 -06:00 |
|
|
rvaldez617
|
c6032a53c4
|
update version
|
2020-03-16 12:53:39 -06:00 |
|
|
rvaldez617
|
202524347f
|
Update modification date
|
2020-03-16 12:49:06 -06:00 |
|
|
rvaldez617
|
f4c808c0eb
|
Updated last modified date
|
2020-03-16 12:47:59 -06:00 |
|
|
rvaldez617
|
a3cd084690
|
bump version # for change
|
2020-03-16 12:42:48 -06:00 |
|
|
rvaldez617
|
e49bfdf9d2
|
Update outlook_writing_zip.yml
|
2020-03-16 12:41:25 -06:00 |
|
|
rvaldez617
|
35acd84242
|
Merge pull request #382 from splunk/CRL-1730
CRL-1730: adding dest to the search syntax
|
2020-03-16 12:33:52 -06:00 |
|
|
Bhavin Patel
|
5d8095a957
|
Merge pull request #396 from muralith-xilinx/patch-5
updating the file path for newer version of Windows
|
2020-03-16 10:19:01 -07:00 |
|
|
Bhavin Patel
|
bd439c0a85
|
Merge pull request #402 from splunk/CRL-1744_macro_fixes
fixes for a couple broken macros
|
2020-03-16 10:18:29 -07:00 |
|
|
divious1
|
10d8cbc842
|
fixing a mispelled macro
|
2020-03-11 20:30:39 -04:00 |
|
|
bpatel
|
7ee8310efb
|
macro ymls and detection update
|
2020-03-09 17:46:47 -07:00 |
|
|
bpatel
|
b4d760507c
|
macro key
|
2020-03-04 14:02:40 -08:00 |
|
|
Bhavin Patel
|
505eb2d70f
|
Merge branch 'develop' into patch-5
|
2020-03-03 15:17:04 -08:00 |
|
|
bpatel
|
d5f5dd2801
|
removing KC
|
2020-03-03 15:09:57 -08:00 |
|
|
Bhavin Patel
|
69f6ca6187
|
Merge pull request #395 from muralith-xilinx/patch-4
Changing .dll to .pst
|
2020-03-03 10:00:14 -08:00 |
|
|
muralith-xilinx
|
9b7d933b1a
|
updating the file path for newer version of Windows
Filesystem.file_path!="C:\\Users\\*\\AppData\\Local\\Microsoft\\Outlook*"
|
2020-03-03 15:24:56 +05:30 |
|
|
muralith-xilinx
|
55981463e4
|
Changing .dll to .pst
Changing .dll to .pst
|
2020-03-03 15:02:08 +05:30 |
|
|
muralith-xilinx
|
ec2bca0265
|
Create or delete windows shares using net.exe
We are proposing to use AND intead of OR, we have tested this in our environment.
|
2020-03-03 14:28:01 +05:30 |
|
|
bpatel
|
225af8df7a
|
search updated:
|
2020-03-02 17:39:56 -08:00 |
|
|
bpatel
|
c40a88ad66
|
spl update to use parent_process_name
|
2020-03-02 14:10:10 -08:00 |
|
|
bpatel
|
f3a0b8c982
|
removing status field from spl
|
2020-03-02 14:05:04 -08:00 |
|
|
bpatel
|
af223584d9
|
adding escape chars
|
2020-03-02 13:52:06 -08:00 |
|
|
bpatel
|
8c39a521c2
|
updating spl with escape and better output
|
2020-03-02 13:44:53 -08:00 |
|
|
bpatel
|
5199a94b31
|
updating instructions for better clarification
|
2020-03-02 13:18:54 -08:00 |
|
|
bpatel
|
30ff1dcca8
|
removing status from spl
|
2020-03-02 13:01:26 -08:00 |
|
|
bpatel
|
f70edf9183
|
adding dest to the search syntax
|
2020-03-02 12:42:26 -08:00 |
|
|
bpatel
|
7c53ce10bc
|
updated manifests
|
2020-03-02 10:25:28 -08:00 |
|
|
rvaldez617
|
240e15d67e
|
Update access_lsass_memory_for_dump_creation.yml
bumped version due to update to search
|
2020-02-28 11:40:27 -07:00 |
|
|
Jose Enrique Hernandez
|
637fdf3c11
|
Merge pull request #372 from splunk/container_implantation
Container implantation
|
2020-02-27 15:31:47 -08:00 |
|
|
divious1
|
cfec1a0dad
|
fixing story error
|
2020-02-27 15:24:26 -08:00 |
|
|
divious1
|
b2c0c6593f
|
fixing references fix
|
2020-02-27 15:23:08 -08:00 |
|
|
Patrick Bareiss
|
8e0a955a02
|
bug fix
|
2020-02-27 15:17:48 -08:00 |
|
|
divious1
|
e3d6b11ac3
|
updating spec version
|
2020-02-27 14:43:00 -08:00 |
|
|
Rod Soto
|
f460b5f354
|
addedmacros
|
2020-02-27 17:00:32 -05:00 |
|
|
divious1
|
1254634518
|
fixing pieces missing from manifests
|
2020-02-26 11:46:08 -08:00 |
|
|
Bhavin Patel
|
42d5aaac20
|
Merge pull request #368 from splunk/CRL-1740-Dump-LSASS-via-comsvcs-DLL
new credential dumping detection
|
2020-02-26 15:01:18 +05:30 |
|
|
muralith-xilinx
|
1b43224559
|
Update access_lsass_memory_for_dump_creation.yml
OR CallTrace=dbghelp.dll " added this dll to search for Windows 7 machines. reference pages https://blog.menasec.net/2019/02/threat-hunting-21-procdump-or-taskmgr.html
|
2020-02-26 12:19:59 +05:30 |
|
|
Rod Soto
|
74019d05c1
|
fixeddatasourceerror
|
2020-02-25 14:08:29 -05:00 |
|
|
Rod Soto
|
ff33a680a4
|
fixed detections
|
2020-02-24 12:49:50 -05:00 |
|