 divious1
|
820e13be36
|
removing another dead ref
|
2020-03-04 10:09:33 -05:00 |
|
|
divious1
|
13d05c85e7
|
removing deadlink
|
2020-03-04 10:07:28 -05:00 |
|
|
bpatel
|
7c53ce10bc
|
updated manifests
|
2020-03-02 10:25:28 -08:00 |
|
|
rvaldez617
|
826e8c1f1c
|
Update credential_dumping.yml
Bumped story version due to new search added by Patrick
|
2020-02-28 11:41:11 -07:00 |
|
|
Jose Enrique Hernandez
|
637fdf3c11
|
Merge pull request #372 from splunk/container_implantation
Container implantation
|
2020-02-27 15:31:47 -08:00 |
|
|
divious1
|
cfec1a0dad
|
fixing story error
|
2020-02-27 15:24:26 -08:00 |
|
|
divious1
|
b2c0c6593f
|
fixing references fix
|
2020-02-27 15:23:08 -08:00 |
|
|
Patrick Bareiss
|
42103847a8
|
bug fix
|
2020-02-27 15:20:46 -08:00 |
|
|
Patrick Bareiss
|
b7bb8f2159
|
Merge branch 'container_implantation' of https://github.com/splunk/security-content into container_implantation
|
2020-02-27 15:14:38 -08:00 |
|
|
Patrick Bareiss
|
43effcde02
|
bug fix
|
2020-02-27 15:14:24 -08:00 |
|
|
divious1
|
e3d6b11ac3
|
updating spec version
|
2020-02-27 14:43:00 -08:00 |
|
|
Rod Soto
|
9d12936e2d
|
fixedstory
|
2020-02-27 17:22:03 -05:00 |
|
|
Patrick Bareiss
|
ef1b56f9ae
|
new credentia dumping detection
|
2020-02-21 09:03:15 +01:00 |
|
|
Rod Soto
|
4aa2e28e80
|
fixedyml
|
2020-02-20 20:41:26 -05:00 |
|
|
Rod Soto
|
c2a2060c98
|
story_container
|
2020-02-20 18:17:54 -05:00 |
|
|
divious1
|
bdedd41b34
|
removing bad reference, dead link
|
2020-02-07 14:15:32 -05:00 |
|
|
Bhavin Patel
|
6b2c9e4172
|
Merge pull request #327 from splunk/supicious_email_updates
updating boiler plate, detection not working out of box against T1193…
|
2020-02-07 10:35:35 -08:00 |
|
|
bpatel
|
ff7a6fef59
|
update mod dates of stories:
|
2020-02-07 10:30:32 -08:00 |
|
|
Bhavin Patel
|
f682a22461
|
Merge branch 'develop' into CRL-1725_Processes.parent_process.Correction
|
2020-02-07 10:18:17 -08:00 |
|
|
Bhavin Patel
|
98195728fc
|
Merge pull request #324 from splunk/first_time_seen_cmd_updates
update version info, add macros for first time seen cmd line detection
|
2020-02-07 10:07:18 -08:00 |
|
|
Bhavin Patel
|
44761d1106
|
Merge pull request #348 from splunk/CRL-1723
CRL-1723 : corrected field name in SPL Filesystem.filepath [which doe…
|
2020-02-07 10:04:22 -08:00 |
|
|
Bhavin Patel
|
7d61248099
|
Merge branch 'develop' into CRL-1725_Processes.parent_process.Correction
|
2020-02-07 10:03:49 -08:00 |
|
|
Jose Enrique Hernandez
|
382d0d719d
|
Merge pull request #351 from splunk/issue_336
updating mod dates and version
|
2020-02-07 13:02:48 -05:00 |
|
|
Bhavin Patel
|
9849b76aff
|
Merge branch 'develop' into first_time_seen_cmd_updates
|
2020-02-07 10:02:26 -08:00 |
|
|
bpatel
|
f307274f95
|
story mod updates
|
2020-02-07 10:00:28 -08:00 |
|
|
bpatel
|
8b0f74c34d
|
updating mod dates and version
|
2020-02-04 09:21:52 -08:00 |
|
|
bpatel
|
92768472e0
|
updating files as per Dons feedback
|
2020-02-04 09:15:39 -08:00 |
|
|
Jason Brewer
|
e18a1402f4
|
CRL-1723 : corrected field name in SPL Filesystem.filepath [which does not exist] to Filesystem.file_path.
|
2020-02-03 21:00:55 -08:00 |
|
|
Jason Brewer
|
346709b58f
|
CRL-1725 - Changed prohibited_apps_spawning_cmdprompt.yml to use parent_process_name as entity. Changed supress field to add user. Bumped detection version number and story version numbers on stories/suspicious_cmd_line_executions.yml and stories/suspicious_mshta_activities.yml.
|
2020-02-03 15:24:49 -08:00 |
|
|
Jason Brewer
|
c3b04375c9
|
CRL-1719 - Fixing reference to https://attack.mitre.org/wiki/Privilege_Escalation >>> https://attack.mitre.org/tactics/TA0004/
|
2020-01-22 12:17:24 -08:00 |
|
|
Jose Enrique Hernandez
|
c6a904b36f
|
Merge pull request #314 from splunk/CRL-1712_netsh_abuse
CRL-1712 Disabling Security Tools
|
2020-01-21 11:42:42 -08:00 |
|
|
bpatel
|
52f5a71060
|
new search unload sysmon filter
|
2020-01-14 15:27:57 -08:00 |
|
|
Patrick Bareiss
|
71241e566f
|
tested and updates searches for lateral movement story
|
2020-01-13 10:39:57 +01:00 |
|
|
Patrick Bareiss
|
4e8427cff4
|
Worked on the feedback
|
2019-12-18 10:23:55 +01:00 |
|
|
Patrick Bareiss
|
2ed8b32696
|
Merged with develop
|
2019-12-17 09:13:43 +01:00 |
|
|
divious1
|
1acf708bc3
|
updating bug with samsam docs
|
2019-12-16 10:21:04 -05:00 |
|
|
Patrick Bareiss
|
6c35f20a55
|
added investigations to detections
|
2019-12-12 16:44:26 +01:00 |
|
|
Patrick Bareiss
|
c1a9ba0852
|
added ctime macro to ESCU
|
2019-12-11 14:10:21 +01:00 |
|
|
Patrick Bareiss
|
ab2118a012
|
New version of analytics story credential dumping
|
2019-12-11 13:13:14 +01:00 |
|
|
Patrick Bareiss
|
44f1bb3efb
|
Merge branch 'develop' into CRL-1698_new_version_credential_dumping
|
2019-12-11 12:30:43 +01:00 |
|
|
Patrick Bareiss
|
46ac72ebf6
|
WIP: Credential Dumping Story
|
2019-12-11 12:29:41 +01:00 |
|
|
divious1
|
55f4361f4c
|
fixing broken links in stories
|
2019-12-09 19:59:39 -05:00 |
|
|
Jason Brewer
|
95f73c9039
|
CRL-1645 - New detection "Abnormally High AWS Instances Terminated by User - MLTK"
|
2019-11-25 18:06:33 -08:00 |
|
|
Jason Brewer
|
951d055cc3
|
CRL-1646 - adding Abnormally High AWS Instances Launched [mltk] to cloud_cryptomining story.
|
2019-11-25 17:01:20 -08:00 |
|
|
Jason Brewer
|
5a901801a0
|
CRL-1646 - Fixing newly broken reference.
|
2019-11-25 16:32:14 -08:00 |
|
|
Jason Brewer
|
38be9ebb26
|
CRL-1646 , CRL-1697 - Making minor tweaks to excessive run instance detections (using ARN vs username) added -MLTK to labels. Added reference for Cloud Compute Instance Created With Previously Unseen Image to cloud_cryptomining.yml.
|
2019-11-25 15:17:32 -08:00 |
|
|
divious1
|
63267cdc5f
|
fixing broken link
|
2019-11-18 13:30:26 -05:00 |
|
|
divious1
|
6196553fd3
|
fixing more broken links
|
2019-11-18 13:17:52 -05:00 |
|
|
divious1
|
75bb363f66
|
fixing broken link, regen docs
|
2019-11-18 13:12:05 -05:00 |
|
|
Jose Enrique Hernandez
|
a62c66b076
|
Merge pull request #251 from splunk/CRL-1401
Added email brand monitoring to suspicious email story
|
2019-11-06 17:56:57 -05:00 |
|