 Eric
|
e00a0b2ed1
|
fix dataset links for more detections. Note that one of the searches actually does not have a valid dataset - it pointed to one that does not exist. that dataset also did not exist in the git history for attack_data.
|
2025-04-01 13:08:15 -07:00 |
|
|
Eric
|
fc2be9e0b7
|
fix pass at attack data name fixes
|
2025-03-31 17:05:54 -07:00 |
|
|
Bhavin Patel
|
246f4856ef
|
Merge pull request #3423 from 0xC0FFEEEE/win_sus_service_fix
Windows Service Created with Suspicious Service Name fix
|
2025-03-28 13:34:30 -07:00 |
|
|
Bhavin Patel
|
3b6e62e913
|
Merge branch 'develop' into win_sus_service_fix
|
2025-03-28 13:17:43 -07:00 |
|
|
Bhavin Patel
|
bc2f378522
|
Merge pull request #3425 from splunk/rahul_feedback
SPL update - Detect Large Outbound ICMP Packets
|
2025-03-28 13:16:55 -07:00 |
|
|
Bhavin Patel
|
db0455a024
|
Merge branch 'develop' into win_sus_service_fix
|
2025-03-28 12:36:36 -07:00 |
|
|
Bhavin Patel
|
949e72062b
|
Merge branch 'develop' into rahul_feedback
|
2025-03-28 12:35:45 -07:00 |
|
|
Bhavin Patel
|
c21858bad4
|
Merge pull request #3419 from splunk/seaside
The Haag Identity: Operation Seashell Blizzard 🌊❄️
|
2025-03-28 12:32:53 -07:00 |
|
|
Bhavin Patel
|
9a1888835c
|
Merge branch 'develop' into rahul_feedback
|
2025-03-28 12:15:27 -07:00 |
|
|
Bhavin Patel
|
fb51ba8f28
|
Merge branch 'develop' into seaside
|
2025-03-28 12:10:09 -07:00 |
|
|
Bhavin Patel
|
ca2487eec2
|
Merge pull request #3432 from splunk/auto-ta-update-218
Automated Splunk TA Update 218
|
2025-03-28 12:09:37 -07:00 |
|
|
Bhavin Patel
|
a87a568a2a
|
Update seashell_blizzard.yml
|
2025-03-28 12:02:11 -07:00 |
|
|
Bhavin Patel
|
7519993300
|
Merge branch 'develop' into seaside
|
2025-03-28 12:01:27 -07:00 |
|
|
Bhavin Patel
|
c7d11e0852
|
udpating msg
|
2025-03-28 11:41:56 -07:00 |
|
|
Bhavin Patel
|
12356f996f
|
updating detection to previous
|
2025-03-28 11:39:59 -07:00 |
|
|
Bhavin Patel
|
135c3633d8
|
updating detection
|
2025-03-28 11:37:43 -07:00 |
|
|
Bhavin Patel
|
3f274b9b83
|
deprecate and add new
|
2025-03-28 11:32:34 -07:00 |
|
|
Bhavin Patel
|
1bbcf0b4ac
|
Merge branch 'develop' into auto-ta-update-218
|
2025-03-28 10:07:30 -07:00 |
|
|
Bhavin Patel
|
57a2e3c230
|
Merge pull request #3418 from splunk/vanhelsing
The Haag Has Landed: VanHelsing's Revenge
|
2025-03-28 10:06:49 -07:00 |
|
|
Bhavin Patel
|
770f4bfdf0
|
Merge branch 'develop' into auto-ta-update-218
|
2025-03-28 09:52:09 -07:00 |
|
|
Bhavin Patel
|
26c1b2eb30
|
Update linux_secure.yml
|
2025-03-28 09:51:59 -07:00 |
|
|
Bhavin Patel
|
7e1cc06c3c
|
Merge branch 'develop' into win_sus_service_fix
|
2025-03-28 09:50:36 -07:00 |
|
|
Bhavin Patel
|
4cf5b74a65
|
Update vanhelsing_ransomware.yml
|
2025-03-28 09:48:48 -07:00 |
|
|
Bhavin Patel
|
14bf638d06
|
Merge branch 'develop' into vanhelsing
|
2025-03-28 09:48:19 -07:00 |
|
|
Bhavin Patel
|
b4e78eb286
|
Merge branch 'develop' into rahul_feedback
|
2025-03-28 09:47:28 -07:00 |
|
|
Bhavin Patel
|
cb9655f299
|
Merge pull request #3424 from splunk/default_match_lookup
Removing default match from lookups
|
2025-03-28 09:47:15 -07:00 |
|
|
Bhavin Patel
|
e6cc21b27a
|
Merge branch 'develop' into rahul_feedback
|
2025-03-28 09:31:05 -07:00 |
|
|
Bhavin Patel
|
ae32bcbb9e
|
update dd
|
2025-03-28 09:30:52 -07:00 |
|
|
Lou Stella
|
70504b7e04
|
Merge branch 'develop' into default_match_lookup
|
2025-03-28 11:25:44 -05:00 |
|
|
Bhavin Patel
|
05e1b1b414
|
Merge branch 'develop' into win_sus_service_fix
|
2025-03-28 09:25:30 -07:00 |
|
|
patel-bhavin
|
b3be9906eb
|
Updated TAs
|
2025-03-28 06:58:23 +00:00 |
|
|
Bhavin Patel
|
c7083d9107
|
Merge branch 'develop' into vanhelsing
|
2025-03-27 17:54:24 -07:00 |
|
|
pyth0n1c
|
8d5975884c
|
Merge pull request #3430 from splunk/cisco_ai
bug in cisco detection
|
2025-03-27 14:52:57 -07:00 |
|
|
Bhavin Patel
|
c009a27c12
|
add back manual_test
|
2025-03-27 14:01:20 -07:00 |
|
|
Bhavin Patel
|
5ebfaeacdf
|
Merge branch 'develop' into win_sus_service_fix
|
2025-03-27 13:51:41 -07:00 |
|
|
Bhavin Patel
|
5000fe16cb
|
reverrt ctl
|
2025-03-27 13:41:17 -07:00 |
|
|
Bhavin Patel
|
cdd70a10aa
|
test with local data
|
2025-03-27 13:32:37 -07:00 |
|
|
Bhavin Patel
|
30ab1d81cb
|
Merge branch 'develop' into rahul_feedback
|
2025-03-27 08:56:01 -07:00 |
|
|
Bhavin Patel
|
1c949f6a6f
|
Merge pull request #3426 from splunk/cim_bug
Update CIM app title
|
2025-03-27 08:25:20 -07:00 |
|
|
P4T12ICK
|
b96e63d86e
|
Merge branch 'develop' into cim_bug
|
2025-03-27 07:25:51 +01:00 |
|
|
pyth0n1c
|
1d2d0352ed
|
Merge pull request #3428 from splunk/fix-bad-attack-data-link
Update living_off_the_land_detection.yml attack_data
|
2025-03-26 14:37:47 -07:00 |
|
|
pyth0n1c
|
17b1fd44c7
|
Update living_off_the_land_detection.yml attack_data
We did not catch this previously because it is a correlation search, so the links are not checked. I found this manually.
|
2025-03-26 14:08:52 -07:00 |
|
|
Bhavin Patel
|
13800a7ec1
|
Merge pull request #3412 from splunk/cisco_ai_defense
Cisco AI defense - Move to prod
|
2025-03-26 14:01:00 -07:00 |
|
|
Bhavin Patel
|
ea0b365690
|
Merge branch 'develop' into cisco_ai_defense
|
2025-03-26 13:44:06 -07:00 |
|
|
Lou Stella
|
dfa33b8589
|
Merge branch 'develop' into default_match_lookup
|
2025-03-26 15:31:10 -05:00 |
|
|
Bhavin Patel
|
eaf9ad89ea
|
Merge pull request #3408 from splunk/process-injection-detection-enhanced
0xC0FFEEEE - process injection into commonly abused processes
|
2025-03-26 13:29:55 -07:00 |
|
|
Bhavin Patel
|
88d699f518
|
Merge branch 'develop' into cisco_ai_defense
|
2025-03-26 12:40:28 -07:00 |
|
|
Bhavin Patel
|
377efcc0b0
|
updating name
|
2025-03-26 12:39:02 -07:00 |
|
|
Bhavin Patel
|
76ef391ac3
|
updating title to full name
|
2025-03-26 12:04:02 -07:00 |
|
|
Bhavin Patel
|
e7e5dcbc03
|
Merge branch 'develop' into process-injection-detection-enhanced
|
2025-03-26 11:05:22 -07:00 |
|