c098cf80dd
Branch was auto-updated.
2022-09-14 09:33:58 -07:00
2d44cfd223
Merge pull request #2370 from splunk/brute-ratel-1
...
name changes
2022-09-14 11:33:32 -05:00
28c46988f3
name changes
2022-09-14 11:31:40 -05:00
c962a93822
Branch was auto-updated.
2022-09-14 09:24:42 -07:00
9e1fe81afe
Merge pull request #2340 from splunk/brute-ratel-1
...
brute-ratel-1
2022-09-14 11:23:59 -05:00
6ff76e699f
Branch was auto-updated.
2022-09-14 09:17:51 -07:00
1c586303ff
Branch was auto-updated.
2022-09-14 09:17:31 -07:00
3002e2e963
Merge pull request #2339 from splunk/TR-2390_Additional_Azure_Detections
...
Update Azure AD Account Takeover Analytic Story
2022-09-14 11:17:05 -05:00
71ff090c37
Update windows_process_injection_with_public_source_path.yml
2022-09-14 14:39:40 +02:00
4fe7e81c38
Branch was auto-updated.
2022-09-13 13:53:02 -07:00
f8d4b08af5
Branch was auto-updated.
2022-09-13 13:53:01 -07:00
8ed1be5c93
Branch was auto-updated.
2022-09-13 13:52:57 -07:00
940598b6c2
pass CI testing
2022-09-13 16:52:39 -04:00
4978fdfc07
Some fixes
2022-09-13 12:53:25 -06:00
754583e5f5
Branch was auto-updated.
2022-09-13 10:12:27 -07:00
c4f53b7ae4
Branch was auto-updated.
2022-09-13 10:12:26 -07:00
750e250fbb
Branch was auto-updated.
2022-09-13 10:12:18 -07:00
64908593d4
adds RBA to correlation rule titles
2022-09-13 13:11:51 -04:00
7208f63c96
Branch was auto-updated.
2022-09-06 14:07:51 -07:00
e807d51570
Branch was auto-updated.
2022-09-06 14:07:50 -07:00
d83cb15609
Branch was auto-updated.
2022-09-06 14:07:46 -07:00
ae92b16c0a
Merge pull request #2351 from splunk/fixdescriptionpt
...
addedwords
2022-09-06 14:07:21 -07:00
73e84a326d
fixedpathlog
2022-09-06 13:40:08 -07:00
4e393e9509
Update windows_defacement_modify_transcodedwallpaper_file.yml
2022-09-05 10:29:49 +02:00
85fc55b281
brute-rate-3
2022-09-05 10:26:55 +02:00
cca076f667
Branch was auto-updated.
2022-09-02 19:15:41 -04:00
3880a4f1cf
Branch was auto-updated.
2022-09-02 19:15:38 -04:00
e701306956
Branch was auto-updated.
2022-09-02 19:15:35 -04:00
7879f6b016
Branch was auto-updated.
2022-09-02 19:15:33 -04:00
95e4eb048c
Merge pull request #2359 from splunk/fix_sourcetype_for_linux_kernel_module_detection
...
Update linux_kernel_module_enumeration.test.yml
Since this is such a small and simple fix, I have merged it myself without review.
Note that this was just an update to a test file, not a modification to the detection itself.
2022-09-02 19:15:12 -04:00
5c4d054652
Update linux_kernel_module_enumeration.test.yml
...
Changing sourcetype from linux_sysmon --> sysmon_linux
2022-09-02 18:50:48 -04:00
e80c5c4e85
Update windows_access_token_manipulation_winlogon_duplicate_token_handle.yml
2022-09-01 18:06:44 +02:00
f68b07ff28
Merge branch 'brute-ratel-3' of github.com:splunk/security_content into brute-ratel-3
2022-09-01 16:42:45 +02:00
a482779b41
brute-ratel-3
2022-09-01 16:42:25 +02:00
324b58bf12
Update windows_service_deletion_in_registry.yml
2022-09-01 15:40:48 +02:00
25ec32f85d
Merge branch 'brute-ratel-3' of github.com:splunk/security_content into brute-ratel-3
2022-09-01 15:18:54 +02:00
c1491e38d1
brute-ratel-3
2022-09-01 15:18:30 +02:00
bfee7c9b0a
Delete windows_phishing_recent_iso_exec_registry.yml
2022-09-01 13:20:57 +02:00
d06f714dbb
Delete windows_input_capture_using_credential_ui_dll.yml
2022-09-01 13:20:48 +02:00
c1b7d97eb3
Delete windows_hijack_execution_flow_version_dll_side_load.yml
2022-09-01 13:20:39 +02:00
5bcc2edeeb
Delete windows_remote_access_software_brc4_loaded_dll.yml
2022-09-01 13:20:25 +02:00
a04fd01b34
Delete windows_gather_victim_identity_sam_info.test.yml
2022-09-01 13:20:14 +02:00
42cf9d4d02
Delete windows_hijack_execution_flow_version_dll_side_load.test.yml
2022-09-01 13:20:04 +02:00
183f1f689e
Delete windows_input_capture_using_credential_ui_dll.test.yml
2022-09-01 13:19:55 +02:00
22721a4554
Delete windows_phishing_recent_iso_exec_registry.test.yml
2022-09-01 13:19:45 +02:00
ce4f5e5ad3
Delete windows_remote_access_software_brc4_loaded_dll.test.yml
2022-09-01 13:19:35 +02:00
954a9e9dd3
Delete windows_gather_victim_identity_sam_info.yml
2022-09-01 13:19:19 +02:00
506732a62b
brute-ratel-3
2022-09-01 13:16:24 +02:00
1557a528cf
brute-ratel-2
2022-08-31 10:12:55 +02:00
c8f038be5d
Update windows_remote_access_software_brc4_loaded_dll.yml
2022-08-31 09:44:21 +02:00
pyth0n1c