admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
7,774 Commits 697 Branches 195 Tags
cbefed390bc0fa60cd50b2dadca10ff4bbff2a2b
Commit Graph

306 Commits

Author SHA1 Message Date
Michael Hart 990b3cd13a Fixing analytic story yaml 2021-06-09 16:10:03 -04:00
Michael Hart 7236281a42 Merge branch 'develop' of github.com:splunk/security_content into excessive_taskhost_process_detection 2021-06-09 14:24:41 -04:00
github-actions[bot] e547ad7395 Branch was auto-updated. 2021-06-08 19:00:26 +00:00
Michael Hart 69c1de8e5e Initial import of the detection and story for support 2021-06-08 10:01:32 -04:00
tccontre 09796e3f67 revil 2021-06-04 16:07:02 +02:00
mhaag-spl cc40bf658c SharpHound 2021-06-03 08:48:19 -06:00
Bhavin Patel ece4317cc9 Merge branch 'develop' into xmrig 2021-05-20 11:15:23 -07:00
tccontre e0e8d2b322 xmr_str 2021-05-20 10:56:00 +02:00
bpatel 7f4d032edd updating story name 2021-05-19 15:21:25 -07:00
Jose Enrique Hernandez 7dce7ba174 date of story is wrong 2021-05-19 16:26:40 -04:00
Michael Haag 9ace8fb3fd Update xmrig.yml 2021-05-19 10:05:12 -06:00
P4T12ICK da0d634f64 Merge branch 'develop' into xmrig 2021-05-18 10:06:05 +02:00
tcontreras d631a7e2f2 fail 2021-05-13 20:32:25 +02:00
github-actions[bot] 659766fc1e Branch was auto-updated. 2021-05-13 17:54:33 +00:00
bpatel 545951b315 narrative 2021-05-12 14:06:53 -07:00
bpatel 03444a29e9 test file 2021-05-12 13:50:03 -07:00
bpatel 542f229457 story_file 2021-05-12 12:37:33 -07:00
mvelazco d7391d4c11 detection metadata final fixes 2021-05-07 16:26:53 -04:00
tcontreras 5879a87e21 xmrig_ir 2021-05-07 13:38:12 +02:00
github-actions[bot] 8ff7ba5f8d Branch was auto-updated. 2021-05-04 08:38:29 +00:00
github-actions[bot] 468dd8bfaa Branch was auto-updated. 2021-04-27 17:56:18 +00:00
github-actions[bot] 84c4943005 Branch was auto-updated. 2021-04-27 17:56:07 +00:00
mhaag-spl 2b5eb6fbc4 Masquerading - detections + analytic story 2021-04-26 13:38:52 -06:00
tcontreras 765e2cc311 trickbot 2021-04-26 17:01:03 +02:00
github-actions[bot] 7b8d883b63 Branch was auto-updated. 2021-04-22 20:59:42 +00:00
github-actions[bot] 668a5c5b0f Branch was auto-updated. 2021-04-22 18:19:51 +00:00
github-actions[bot] 3790936f7a Branch was auto-updated. 2021-04-22 18:19:49 +00:00
divious1 a8a69a97a5 renaming product to new name 2021-04-21 18:23:09 -04:00
mvelazco 0ae6b31e32 Merge branch 'develop' into password_spraying_TR-515 2021-04-21 13:56:43 -07:00
mhaag-spl e040c8bc04 rename phishing payloads to spearphishing attachments 2021-04-21 10:04:40 -06:00
mvelazco a69c363313 Update active_directory_password_spraying.yml 
update description
 2021-04-19 14:54:00 -04:00
mvelazco 4cb46fcd21 Update active_directory_password_spraying.yml 
description update
 2021-04-16 10:48:18 -04:00
mvelazco 4fa6bd1c72 pushing initial password spraying content 
adding password spraying analytic story and the first detections
 2021-04-14 14:00:05 -04:00
bpatel ed42485954 minor 2021-04-05 13:20:45 -07:00
github-actions[bot] 553487eb5e Branch was auto-updated. 2021-04-02 16:46:05 +00:00
mhaag-spl 77d618a37b Found error - typo 2021-03-31 14:18:05 -06:00
mhaag-spl 1ab256593f Domain Trust Discovery 2021-03-31 13:24:32 -06:00
Michael Haag 602c51bae9 Merge branch 'develop' into mhaag 2021-03-30 14:58:52 -06:00
mhaag-spl da4bc60750 T1197 BITS Jobs 2021-03-30 14:49:44 -06:00
mvelazco c0b5249638 Merge remote-tracking branch 'origin/TR-532_escu_remove_ui' into TR-490_mustang_package 2021-03-29 17:17:53 -04:00
mvelazco c0b95aa075 adding package type support 
- Updates to generate.py introduce an extra parameter that defines the type of package to be created.

- Tagging analytics stories related to AWS/O365 detections.
 2021-03-29 16:27:20 -04:00
bpatel 4bff6612a9 trailing whitespace 2021-03-29 10:54:20 -07:00
github-actions[bot] e6d57ecba1 Branch was auto-updated. 2021-03-25 17:34:18 +00:00
mhaag-spl feeebf2fdd Analytic Story for certutil decode 2021-03-25 11:18:10 -06:00
mhaag-spl 106fc29c15 fix again 2021-03-25 07:08:05 -06:00
mhaag-spl c6664bcb7e Update ingress_tool_transfer.yml 2021-03-24 15:44:22 -06:00
mhaag-spl 249fd0a549 Update Certutil 
- Renamed "attempt to add certificate to untrusted store" to "Attempt to add untrusted certificate to certificate store"
New Detections:
- CertUtil Download With URLCache and Split Arguments
- CertUtil Download With VerifyCtl and Split Arguments
 2021-03-24 15:15:47 -06:00
bpatel 8d12500905 adding risk and product tags 2021-03-23 15:03:02 -07:00
github-actions[bot] 25a1febeb0 Branch was auto-updated. 2021-03-23 16:20:50 +00:00
Rod Soto 2fc6f1c4c9 fixeddateandfirstsearch 2021-03-17 10:22:40 -04:00