66 Commits

Author	SHA1	Message	Date
Eric	d9960562b8	Bump versions for every detection, since everything will have a different conf stanza due to added fields. Don't re-bump things that already had their version bumped after the last release - this is a check that now causes a contentctl inspect failure. Finally, update all of the versions to today since this is the last time that the contents of the stanza is different.	2025-05-02 14:10:46 -07:00
Patrick Bareiss	1c9debe9a6	update versions	2025-03-14 13:47:44 +01:00
Patrick Bareiss	b52bac9b19	output normalization endpoint	2025-02-14 12:40:57 +01:00
research-bot	a059e2db19	updating with rba	2025-01-21 16:16:40 -08:00
pyth0n1c	fdaa038eab	Finish removing extra fields, or renaming ... misnamed fields, in endpoint detections	2025-01-03 15:47:32 -08:00
tccontre	6fc84d916a	crypto_campaign	2024-12-17 11:33:34 +01:00
Lou Stella	88fd263606	Merge branch 'develop' into rba_migration	2024-11-22 08:36:33 -06:00
ljstella	189cc59547	endpoint: remove rba from hunting	2024-11-15 11:01:30 -06:00
Michael Haag	d75dc81630	vers up	2024-11-15 09:52:37 -07:00
ljstella	bc14854c55	endpoint: more typefixes	2024-11-15 10:36:13 -06:00
ljstella	c9186e0b7d	endpoint: lowercase rba types	2024-11-15 10:16:37 -06:00
ljstella	514123089d	endpoint detection score field rename	2024-11-15 09:49:53 -06:00
ljstella	f88eb16c6f	endpoint detection score fix	2024-11-15 09:34:59 -06:00
ljstella	92cc97a5a7	endpoint first pass	2024-11-14 15:44:51 -06:00
Nasreddine Bencherchali	99bb3994cd	tagging content and typo fixes	2024-11-14 20:01:29 +01:00
Michael Haag	317b01c532	Updates and moar	2024-11-13 13:51:21 -07:00
research-bot	7eafc7cd60	updating sysmon to XML	2024-11-01 13:40:43 -07:00
research-bot	d1c7e1b6e5	udpating sysmon source	2024-10-30 18:42:30 -07:00
Bhavin Patel	385ac7adc1	remove end hours	2024-10-23 17:52:24 -07:00
Bhavin Patel	e2bff20247	updating detections	2024-10-17 08:21:25 -07:00
Michael Haag	2057e0ab23	Update malicious_powershell_process___encoded_command.yml ... Fixed for #2982	2024-07-26 10:45:25 -06:00
Patrick	87108a5aac	Improved data sources	2024-07-17 14:41:50 +02:00
Patrick	9e0d8426c1	improved data source field	2024-07-16 14:06:31 +02:00
Bhavin Patel	22e5ea3f83	Release Branch - ESCU v4.34.0	2024-06-26 14:41:53 +00:00
Bhavin Patel	6c5446cfbc	Release Branch - ESCU v4.32.0	2024-05-22 16:47:39 +00:00
Bhavin Patel	b0eaed8f75	ESCU Release v4.31.0	2024-05-08 16:05:40 +00:00
Gowthamaraj rajendran	e06cfa133d	Edit how_to_implement for Endpoint.Processes	2023-09-15 10:58:38 -07:00
tccontre	aad413f44c	volt_typhoon	2023-05-25 12:16:00 +02:00
tccontre	5311028ec7	Update malicious_powershell_process___encoded_command.yml	2023-04-14 10:42:16 +02:00
tccontre	52391f5615	Merge branch 'develop' into sandworm_data_destruction	2023-04-13 19:07:10 +02:00
tccontre	e0b697ab6e	sandworm_data_destruction	2023-04-12 12:17:43 +02:00
P4T12ICK	78909f6429	merged with develop	2023-03-03 12:40:16 +01:00
P4T12ICK	fd0c8b349f	updated tags	2023-01-09 09:33:30 +01:00
P4T12ICK	5ae53c9368	Migrated all detections to v4	2023-01-03 13:42:10 +01:00
Michael Haag	c6db7b5415	CISA AA22-320A	2022-11-16 12:10:42 -07:00
tccontre	c96c6d03d3	qakbot_1	2022-10-18 11:57:58 +02:00
tccontre	2dd87d6d33	dcrat-analytics	2022-07-26 12:02:35 +02:00
Rod Soto	8298acf18e	powershelldetectionstaghermetic	2022-03-31 15:29:51 -07:00
P4T12ICK	e6c8254ede	Added automaticc generation of finding report	2022-03-14 12:12:48 +01:00
P4T12ICK	6f0ee68913	Refactored security content	2022-03-09 14:43:09 +01:00
Jose Enrique Hernandez	d78bb53baa	Revert "Refactored security content"	2022-03-04 15:13:04 -05:00
P4T12ICK	5fbff3630e	merged with develop	2022-02-07 14:55:34 +01:00
P4T12ICK	4fd8604b9a	removed SAAWS and automated_detection_testing flag	2022-01-27 09:50:45 +01:00
Michael Haag	9793232a8a	Added whispergate story	2022-01-24 11:27:35 -07:00
mhaag-spl	bbea800499	whisper1	2022-01-18 19:36:58 -07:00
research bot	a1afa0fa60	updating docs and package bits [ci skip]	2021-10-28 19:55:37 +00:00
mhaag-spl	eb39fe5937	Updated PowerShell and Exchange Web Shell	2021-10-05 09:50:13 -06:00
mhaag-spl	8ad7757739	Update malicious_powershell_process___encoded_command.yml	2021-09-22 14:45:46 -06:00
P4T12ICK	5e6e987fb7	resolved merge conflicts	2021-07-21 09:22:09 +02:00
research bot	44ea56053d	updating docs and package bits [ci skip]	2021-07-20 21:12:30 +00:00