c7c32f3045
update logic
2024-12-07 19:23:43 +01:00
8c0535b96d
Update certutil_download_with_urlcache_and_split_arguments.yml
...
It looks like the Processes.process=*urlcache* condition in the rule logic will override any (Processes.process=*urlcache* Processes.process=*split*) condition. I made a change as a suggestion, but you can check it out for the correct one.
2024-12-03 16:22:22 +03:00
4be3cf9e63
Merge pull request #3216 from splunk/add_more_win_tag
...
add_more_win_tag
2024-12-02 15:00:45 -08:00
2c19182820
Branch was auto-updated.
2024-12-02 14:18:42 -08:00
7ae38fe43e
Merge pull request #3211 from splunk/rdpland
...
Raiders of the Lost RDP: The Haag Crusade
2024-12-02 14:18:23 -08:00
78f0ef8afa
Branch was auto-updated.
2024-12-02 13:58:38 -08:00
9c15fd045a
Merge branch 'develop' into rdpland
2024-12-02 13:58:34 -08:00
b8ad19cb6f
Merge pull request #3220 from splunk/auto-ta-update-102
...
Automated Splunk TA Update 102
2024-12-02 13:58:20 -08:00
5276854ae8
Move data_source to middle of yml. Fix
...
minor typos or <update> still present
in drilldown.
2024-12-02 13:52:40 -08:00
4b3a3dffea
Make formatting easier to read
...
for example logs in auto-
updated data_sources
2024-12-02 13:23:36 -08:00
89401d3170
Updated TAs
2024-12-02 06:57:46 +00:00
1761f3dbe4
add_more_win_tag
2024-11-28 09:42:44 +01:00
34a60ce3cf
Update windows_rdp_file_execution.yml
2024-11-26 06:55:19 -07:00
245bd2ac03
Update detections/endpoint/windows_rdp_file_execution.yml
...
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com >
2024-11-25 15:48:05 -07:00
9084ddcff4
Update detections/endpoint/windows_rdp_file_execution.yml
...
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com >
2024-11-25 15:47:53 -07:00
3acd1f949a
Update detections/endpoint/windows_rdp_file_execution.yml
...
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com >
2024-11-25 15:47:44 -07:00
d80e5db350
Update windows_rdp_file_execution.yml
2024-11-25 12:07:39 -07:00
810a520721
Update windows_rdp_file_execution.yml
2024-11-25 12:05:41 -07:00
8f8a6bd3b4
Raiders of the Lost RDP: The Haag Crusade
2024-11-25 11:44:23 -07:00
046fbbfa0d
Merge pull request #3203 from splunk/lumma
...
Haaglumination
2024-11-20 12:17:59 -08:00
29e320f95f
registry
2024-11-20 12:16:58 -08:00
58c529961f
remove drilldowns for Hunting detection, remove empty CVE
2024-11-20 12:02:20 -08:00
94579d6cd8
fixor
2024-11-20 12:56:48 -07:00
2e85f45d96
date fix
2024-11-20 10:08:52 -07:00
70476e98fb
final tags
2024-11-20 10:05:19 -07:00
49d0dc66d5
Branch was auto-updated.
2024-11-19 16:24:45 -08:00
9f9f527ccb
Merge pull request #3209 from splunk/pxa_stealer
...
pxa_stealer
2024-11-19 16:24:27 -08:00
ca683cd326
Branch was auto-updated.
2024-11-19 15:00:43 -08:00
2c7c839df8
Branch was auto-updated.
2024-11-19 15:00:40 -08:00
2906695e75
Merge pull request #3185 from splunk/defender_alerts
...
Defender alerts
2024-11-19 15:00:22 -08:00
a5908bc965
Branch was auto-updated.
2024-11-19 14:41:39 -08:00
8d289168ff
Branch was auto-updated.
2024-11-19 14:41:38 -08:00
1014dacfcf
Branch was auto-updated.
2024-11-19 14:41:35 -08:00
d45a0788df
Merge pull request #3208 from splunk/short_life
...
Update- Short Lived Windows Accounts
2024-11-19 14:41:22 -08:00
f48468b383
improve grammer
2024-11-19 14:39:24 -08:00
6e51a1b438
Branch was auto-updated.
2024-11-19 14:18:42 -08:00
03d9a98fb1
Branch was auto-updated.
2024-11-19 14:18:41 -08:00
82f27eb082
Branch was auto-updated.
2024-11-19 14:18:40 -08:00
c5e2c7ef27
Branch was auto-updated.
2024-11-19 14:18:39 -08:00
a1d19f0a72
Merge pull request #3210 from splunk/okta_mismatch
...
Updating SPL - Okta Mismatch
2024-11-19 14:18:23 -08:00
7f109d5ecc
updating dataset link
2024-11-19 14:02:59 -08:00
f605a70b33
updating drilldown
2024-11-19 13:14:11 -08:00
18164e9370
updating to prod
2024-11-19 12:56:19 -08:00
1788541f29
updating detection after test
2024-11-19 12:24:48 -08:00
46d8a80645
updating observable
2024-11-18 14:03:47 -08:00
365f9393b5
updating message
2024-11-18 12:33:59 -08:00
13e950026a
updating manual message
2024-11-18 12:25:07 -08:00
21c91d5a12
adding manual test
2024-11-18 10:50:59 -08:00
23fde5c6ce
updating datasets
2024-11-18 10:03:18 -08:00
4470cd3282
pxa_stealer
2024-11-18 17:28:31 +01:00
Nasreddine Bencherchali