022c5be43e
Revert "updated AWS IAM to AWS Identity Access Manager (IAM) in all detections to fit mustang required naming"
...
This reverts commit 45c138d518
2021-06-25 15:03:55 -04:00
f262360d0a
updated CloudTrails to AWS CloudTrails
2021-06-25 14:50:50 -04:00
45c138d518
updated AWS IAM to AWS Identity Access Manager (IAM) in all detections to fit mustang required naming
2021-06-25 14:44:02 -04:00
09796e3f67
revil
2021-06-04 16:07:02 +02:00
2d61b8e675
updating docs and package bits [ci skip]
2021-05-24 17:47:29 +00:00
b411f2b1fc
CVE-2021-31166
2021-05-21 11:25:37 -06:00
e80bc45423
updating docs and package bits [ci skip]
2021-05-13 22:09:29 +00:00
90cae048e2
Merge branch 'darkside' of github.com:splunk/security_content into darkside
2021-05-13 14:22:16 -07:00
888aae21d3
moving to experimental
2021-05-13 14:22:07 -07:00
3790936f7a
Branch was auto-updated.
2021-04-22 18:19:49 +00:00
a8a69a97a5
renaming product to new name
2021-04-21 18:23:09 -04:00
dc319b6eda
Spearphishing Attachments detections
2021-04-21 10:16:49 -06:00
1ab256593f
Domain Trust Discovery
2021-03-31 13:24:32 -06:00
249fd0a549
Update Certutil
...
- Renamed "attempt to add certificate to untrusted store" to "Attempt to add untrusted certificate to certificate store"
New Detections:
- CertUtil Download With URLCache and Split Arguments
- CertUtil Download With VerifyCtl and Split Arguments
2021-03-24 15:15:47 -06:00
00965fbd34
Delete detect_exchange_web_shell.yml
2021-03-19 06:41:51 -06:00
4b27622a3f
updating docs and package bits [ci skip]
2021-03-12 17:32:09 +00:00
592e63779c
fixing merge conflicts
2021-03-12 11:43:55 -05:00
40e1f95e2d
fixed validation errors
2021-03-11 12:35:04 -08:00
2643be22ff
w3wp spawning shell
2021-03-11 12:34:21 -07:00
69d73f3dc1
unified messaging service spawning a shell
2021-03-11 12:12:52 -07:00
edaf9598f2
fixed merging issues
2021-03-11 19:03:54 +01:00
43644ff368
add required fields
2021-03-11 09:32:33 +01:00
6e826b4e68
add required fields and check
2021-03-11 09:11:48 +01:00
b15aaa55df
Moving non-passed to experimental and deprecating some
2021-03-10 13:27:00 -07:00
a6265b60df
Moving Tor Traffic to Experimental
2021-03-10 11:47:34 -07:00
c1c1d1733e
WIP
2021-03-10 15:22:14 +01:00
7c134dbb5d
WIP
2021-03-10 14:44:44 +01:00
851a46ed41
Updated name
2021-03-10 06:43:26 -07:00
90a385e941
Create detect_exchange_webshell.yml
2021-03-10 06:23:54 -07:00
51823d81d3
Sunburst malware renamed NOBELIUM Group
...
Renaming Sunburst Malware to NOBELIUM Group
2021-03-05 10:30:34 -07:00
746997c92c
updating docs and package bits [ci skip]
2021-03-04 20:11:07 +00:00
fcb9fa5340
W3WP Spawning shells
2021-03-04 06:38:00 -07:00
ac49f9ab9e
HAFNIUM and more updates
2021-03-03 14:10:11 -07:00
ecb82ec8ca
Fixes
2021-03-01 06:52:02 -07:00
d265e72e8d
Silver Sparrow
2021-03-01 06:23:51 -07:00
cd9d8bc3b1
Branch was auto-updated.
2021-02-22 17:32:52 +00:00
42ff71b2a2
normalized ids
2021-02-22 12:15:33 -05:00
d9b977a7a6
updating docs and package bits [ci skip]
2021-02-18 18:22:48 +00:00
7615d5ec81
fixing merge conflicts
2021-02-12 12:27:00 -05:00
b58843ca9f
added datamodels as an array
2021-02-10 22:35:58 -05:00
d0c9c92857
added datamodel field and made all objects also pretty via new tool called pretty_yaml.py
2021-02-10 22:11:24 -05:00
1ec15cf044
renamed on all detections
2021-02-08 10:18:16 -05:00
b68e05685e
modified type for detections
2021-02-05 14:35:49 -05:00
6c950af9d4
Merge branch 'develop' into TR-380_reuse_type
2021-02-04 21:24:00 -05:00
71d22f6c80
Merge branch 'develop' into TR-380_reuse_type
2021-02-04 21:16:12 -05:00
c7667b5740
fixing a error which was causing API to fail
2021-02-04 18:36:10 -05:00
e14fade976
adding product tag to all detections
2021-02-03 21:42:46 -05:00
623c8fee33
moved to experimental
2021-02-03 17:03:19 +01:00
055c9ec258
updated type to use batch or streaming instead of product name
2021-02-02 12:54:27 -05:00
4fb0488ac6
duplicating files and experimental
2021-01-28 17:35:25 -08:00
divious1