babd9df0d6
Update print_processor_registry_autostart.yml
...
risk message used a field where the datamodel prefix was still included. This meant that it failed the risk message substitution
2025-06-17 17:09:39 -07:00
64aac40e82
Remove deprecated detections in line with prepublished guidance
2025-06-17 12:44:39 -07:00
60656154e7
Merge branch 'develop' into updates-june
2025-06-17 11:54:36 -07:00
5ccd548758
Merge branch 'develop' into innoloader
2025-06-17 20:33:26 +02:00
cb45d9d030
quick fixes and updates
2025-06-17 20:32:55 +02:00
3f3763176b
Merge branch 'develop' into innoloader
2025-06-17 10:56:19 -07:00
437b5cf59c
Version bump
2025-06-17 09:14:07 -05:00
bded2e9379
Silly casing...
2025-06-17 09:09:53 -05:00
342b06c308
Swap detections to experimental as test data no longer matches expectations of TA
2025-06-17 09:08:59 -05:00
ff624b020a
change to supported sourcetype
2025-06-17 09:08:10 -05:00
e342920f37
Update windows_rundll32_webdav_with_network_connection.yml
2025-06-17 11:44:13 +02:00
4801780532
Merge branch 'develop' into updates-june
2025-06-17 11:15:26 +02:00
06d9ce5d6c
Merge branch 'develop' into fixing-issues-5.8
2025-06-17 11:15:23 +02:00
27575a878b
fix typos
2025-06-17 02:30:48 +02:00
c46c948ae4
more fixes
2025-06-17 02:20:37 +02:00
b0df2c1973
Update windows_files_and_dirs_access_rights_modification_via_icacls.yml
2025-06-17 01:42:32 +02:00
aeeb471de2
Update suspicious_copy_on_system32.yml
2025-06-17 01:38:33 +02:00
dba17e70d0
Update suspicious_copy_on_system32.yml
2025-06-17 01:35:02 +02:00
1d2e689e99
Update suspicious_copy_on_system32.yml
2025-06-17 01:28:45 +02:00
99d3d28654
multiple updates and fixes
2025-06-17 01:22:13 +02:00
6c5aa91dbf
more updates
2025-06-16 23:38:10 +02:00
feb9ec41b2
update to fix ci errors
2025-06-16 16:24:51 +02:00
25617e6770
Initial remote employment fraud detections.
2025-06-12 14:43:59 -04:00
8efe3b11d2
add manual_test tag
2025-06-10 21:25:21 +02:00
05df61c626
Update detect_outbound_smb_traffic.yml
2025-06-10 20:32:31 +02:00
8af7db1115
Update dllhost_with_no_command_line_arguments_with_network.yml
2025-06-10 20:24:33 +02:00
e27f42b81c
more output field fixes
2025-06-10 20:19:54 +02:00
e4c733a3b4
update output fields
2025-06-10 20:07:40 +02:00
a62ddcc7b5
add drilldowns to production analytics
2025-06-10 16:26:40 +02:00
a91c2aa7d9
Fix incorrect data sources
2025-06-10 16:04:59 +02:00
d985dc1105
upgrade detection with tests to production
2025-06-10 13:56:06 +02:00
0d361c83a0
Merge branch 'develop' into innoloader
2025-06-02 14:40:53 -07:00
4cfe72f575
Merge branch 'develop' into aws_to_ttp
2025-06-02 14:24:22 -07:00
a68ebe26f2
Merge branch 'develop' into innoloader
2025-06-02 14:20:58 -07:00
d3deda8e58
Merge branch 'develop' into aws_to_ttp
2025-06-02 13:41:34 -07:00
b849dd201a
Update windows_sensitive_registry_hive_dump_via_commandline.yml
...
Need extra backslash to escape registry path backslash in SPL
2025-06-02 13:30:46 -07:00
d11917e14d
Update o365_concurrent_sessions_from_different_ips.yml
2025-06-02 22:18:24 +02:00
168bf7e714
Update windows_sensitive_registry_hive_dump_via_commandline.yml
2025-06-02 22:12:47 +02:00
af3f49a4a1
Merge branch 'develop' into innoloader
2025-06-02 13:07:50 -07:00
3393446afb
Update internal_horizontal_port_scan_nmap_top_20.yml
...
Chatted with detection author about this update.
Changed risk_object from dest_zone to dest_ports to be more in line with other horizontal scanning detection AND give more meaningful risk object (dest_zone is less meaningful, even if populated)
2025-06-02 12:31:03 -07:00
838d40085e
innoloader
2025-06-02 12:38:34 +02:00
e7f59f1ffc
update risk object
2025-06-02 11:36:04 +02:00
f40aad92b5
Update protocols_passing_authentication_in_cleartext.yml
2025-06-02 10:34:26 +02:00
5f9fb78212
Merge branch 'develop' into ftd-cim-update
2025-06-02 10:30:52 +02:00
271fd75425
update analytics after review suggestions
2025-06-02 10:30:36 +02:00
19ae2fe24f
innoloader
2025-06-02 09:43:51 +02:00
5cde2f9d01
Update detect_remote_access_software_usage_traffic.yml
2025-05-30 15:19:09 +01:00
133e431bd3
Update detect_remote_access_software_usage_traffic.yml
...
Fix bug with user field
2025-05-30 14:51:56 +01:00
44e6f9a445
Update cisco_secure_firewall___remote_access_software_usage_traffic.yml
2025-05-28 19:35:38 +02:00
67c72b9035
add Cisco Secure Firewall - Remote Access Software Usage Traffic
2025-05-28 19:33:18 +02:00
pyth0n1c