ac129ddf7b
Fixed name of one detection. Fixed misnamed macros
...
in a handful of detections. Updated test information
for all detections since they originally pointed to a
single log file with multiple sources in it, leading to
it being parsed incorrectly.
2023-07-24 18:45:19 -07:00
a24d5c0c86
Update powershell_powershell_script_block_with_url_chain.yml
2023-07-24 18:17:08 -05:00
bc470a4774
Branch was auto-updated.
2023-07-24 14:12:40 -07:00
b133cf8888
Merge pull request #2778 from splunk/revert-2768-new_description_v1
...
Revert "20 description and how to implement"
2023-07-24 16:12:08 -05:00
09b20465f5
Branch was auto-updated.
2023-07-24 09:41:40 -07:00
ac79bf8eae
Branch was auto-updated.
2023-07-24 09:41:36 -07:00
5bb2b1962c
Merge pull request #2779 from splunk/o365_version_bump
...
Version bump
2023-07-24 11:41:15 -05:00
732c5c3631
Version bump
2023-07-24 10:07:26 -05:00
2113e862ce
Revert "20 description and how to implement"
2023-07-24 10:05:25 -05:00
18090208aa
Branch was auto-updated.
2023-07-21 15:29:59 -07:00
4222212c0b
Merge pull request #2776 from splunk/adc
...
Citrix Netscaler ADC CVE-2023-3519
2023-07-21 15:29:31 -07:00
449a12a1a7
Add ref link to story and detection.
...
Ref link is official documentation
and guidance from citirx.
2023-07-21 15:13:31 -07:00
05d32c6c3d
analytic + text update
2023-07-21 14:47:56 -07:00
ecb51ccc17
Create citrix_netscaler_adc_cve_2023_3519.yml
2023-07-20 16:57:57 -07:00
b32bac6d3a
Branch was auto-updated.
2023-07-18 10:39:09 -07:00
209a82d628
Merge pull request #2774 from splunk/spl_fix_dest
...
Risk objects require fields be present
2023-07-18 10:38:50 -07:00
af65cf63ab
Risk objects require fields be present
2023-07-18 12:10:59 -05:00
ce1250b64e
Branch was auto-updated.
2023-07-14 11:51:55 -07:00
906b267152
Merge pull request #2768 from splunk/new_description_v1
...
20 description and how to implement
2023-07-14 13:51:23 -05:00
ae164e946a
Update detect_prohibited_applications_spawning_cmd_exe.yml
2023-07-14 12:30:17 -06:00
32548ab410
Update bcdedit_command_back_to_normal_mode_boot.yml
2023-07-14 12:29:49 -06:00
bf41c25534
first 20 description and how to implment
2023-07-13 13:07:12 -05:00
bde7bd7a6c
Branch was auto-updated.
2023-07-13 09:35:18 -07:00
ad9a3aa25b
Merge pull request #2720 from splunk/recon_correlation
...
recon_correlation
2023-07-13 11:34:52 -05:00
50de0f575e
Branch was auto-updated.
2023-07-13 07:49:46 -07:00
f79ecca515
Branch was auto-updated.
2023-07-13 07:49:45 -07:00
4aa5e08b0c
Merge pull request #2721 from splunk/post_expoitation_correlation
...
post_expoitation_correlation
2023-07-13 09:49:08 -05:00
20e50557d4
Branch was auto-updated.
2023-07-13 07:47:34 -07:00
2387d7f6c1
Branch was auto-updated.
2023-07-13 07:47:33 -07:00
1413736e66
Branch was auto-updated.
2023-07-13 07:47:32 -07:00
deac608058
Merge pull request #2746 from splunk/additional_lookup_file_quoting_validation
...
Improve lookup file csv validation
2023-07-13 09:47:14 -05:00
7fb40505f8
Update windows_post_exploitation_risk_behavior.yml
2023-07-12 17:35:57 -05:00
e4ef2171a4
Update windows_common_abused_cmd_shell_risk_behavior.yml
2023-07-12 17:32:12 -05:00
1761687bf6
Update windows_common_abused_cmd_shell_risk_behavior.yml
2023-07-12 17:28:41 -05:00
7732ef6591
Branch was auto-updated.
2023-07-12 15:17:20 -07:00
2ac45c7807
Branch was auto-updated.
2023-07-12 15:17:19 -07:00
57375f7960
Branch was auto-updated.
2023-07-12 15:17:10 -07:00
af6c78ab98
Branch was auto-updated.
2023-07-12 15:17:09 -07:00
9f70e6b348
Merge pull request #2726 from splunk/win_modify_reg_correlation
...
win_modify_reg_correlation
2023-07-12 17:16:47 -05:00
adfc1e8f10
Update windows_modify_registry_risk_behavior.yml
2023-07-11 16:47:37 -05:00
689caaf2ac
Updated description
2023-07-11 16:46:13 -05:00
9b1a632b39
validation errors
2023-07-11 15:37:10 -05:00
869e908606
Branch was auto-updated.
2023-07-11 13:25:42 -07:00
f406010b37
Branch was auto-updated.
2023-07-11 13:25:30 -07:00
608eb182d7
Branch was auto-updated.
2023-07-11 13:25:28 -07:00
20315b3678
Branch was auto-updated.
2023-07-11 13:25:26 -07:00
f0d4d4bbad
Branch was auto-updated.
2023-07-11 13:25:23 -07:00
90f212bf9f
Merge pull request #2764 from splunk/moveitupdate
...
Update moveit_transfer_critical_vulnerability.yml
2023-07-11 15:24:25 -05:00
c929e46f89
Branch was auto-updated.
2023-07-11 13:23:55 -07:00
37b631dab9
Branch was auto-updated.
2023-07-11 13:23:53 -07:00
pyth0n1c