 divious1
|
e3d6b11ac3
|
updating spec version
|
2020-02-27 14:43:00 -08:00 |
|
|
Rod Soto
|
f460b5f354
|
addedmacros
|
2020-02-27 17:00:32 -05:00 |
|
|
divious1
|
1254634518
|
fixing pieces missing from manifests
|
2020-02-26 11:46:08 -08:00 |
|
|
Rod Soto
|
74019d05c1
|
fixeddatasourceerror
|
2020-02-25 14:08:29 -05:00 |
|
|
Rod Soto
|
ff33a680a4
|
fixed detections
|
2020-02-24 12:49:50 -05:00 |
|
|
Rod Soto
|
2e12da82b9
|
fixa
|
2020-02-21 12:14:50 -05:00 |
|
|
Rod Soto
|
4aa2e28e80
|
fixedyml
|
2020-02-20 20:41:26 -05:00 |
|
|
Rod Soto
|
c2a2060c98
|
story_container
|
2020-02-20 18:17:54 -05:00 |
|
|
divious1
|
6caea176a6
|
corrected a few bugs with the spec
|
2020-02-07 13:51:31 -05:00 |
|
|
Bhavin Patel
|
096234f417
|
Merge pull request #354 from splunk/fix_convert_bug_issue_343
fixes issue 343
|
2020-02-07 10:38:14 -08:00 |
|
|
Bhavin Patel
|
6b2c9e4172
|
Merge pull request #327 from splunk/supicious_email_updates
updating boiler plate, detection not working out of box against T1193…
|
2020-02-07 10:35:35 -08:00 |
|
|
Bhavin Patel
|
556efc4a78
|
Merge pull request #325 from splunk/dns_query_updates
Update version info and macros
|
2020-02-07 10:33:05 -08:00 |
|
|
divious1
|
3336663726
|
fixes issue 343
|
2020-02-07 13:32:56 -05:00 |
|
|
bpatel
|
6896cf9b58
|
removing incorrect mitre id
|
2020-02-07 10:27:21 -08:00 |
|
|
Bhavin Patel
|
f682a22461
|
Merge branch 'develop' into CRL-1725_Processes.parent_process.Correction
|
2020-02-07 10:18:17 -08:00 |
|
|
bpatel
|
1c97742fed
|
macros node
|
2020-02-07 10:17:14 -08:00 |
|
|
Bhavin Patel
|
98195728fc
|
Merge pull request #324 from splunk/first_time_seen_cmd_updates
update version info, add macros for first time seen cmd line detection
|
2020-02-07 10:07:18 -08:00 |
|
|
Bhavin Patel
|
0432161688
|
Merge pull request #326 from splunk/smb_detection_updates
update smb related content.
|
2020-02-07 10:05:44 -08:00 |
|
|
Bhavin Patel
|
44761d1106
|
Merge pull request #348 from splunk/CRL-1723
CRL-1723 : corrected field name in SPL Filesystem.filepath [which doe…
|
2020-02-07 10:04:22 -08:00 |
|
|
Bhavin Patel
|
7d61248099
|
Merge branch 'develop' into CRL-1725_Processes.parent_process.Correction
|
2020-02-07 10:03:49 -08:00 |
|
|
Bhavin Patel
|
9849b76aff
|
Merge branch 'develop' into first_time_seen_cmd_updates
|
2020-02-07 10:02:26 -08:00 |
|
|
rvaldez617
|
7d33b5c36c
|
Merge pull request #350 from splunk/issue_323
CRL-1721 - updating files as per Dons/Andrew Lee's feedback
|
2020-02-05 16:06:17 -07:00 |
|
|
bpatel
|
92768472e0
|
updating files as per Dons feedback
|
2020-02-04 09:15:39 -08:00 |
|
|
Jason Brewer
|
e18a1402f4
|
CRL-1723 : corrected field name in SPL Filesystem.filepath [which does not exist] to Filesystem.file_path.
|
2020-02-03 21:00:55 -08:00 |
|
|
Jason Brewer
|
346709b58f
|
CRL-1725 - Changed prohibited_apps_spawning_cmdprompt.yml to use parent_process_name as entity. Changed supress field to add user. Bumped detection version number and story version numbers on stories/suspicious_cmd_line_executions.yml and stories/suspicious_mshta_activities.yml.
|
2020-02-03 15:24:49 -08:00 |
|
|
divious1
|
2b6db17c99
|
fixing issue #343
|
2020-02-03 17:10:15 -05:00 |
|
|
jzsplunk
|
c92d097eac
|
updating boiler plate, detection not working out of box against T1193 but this may be due to error loading lookup table for supicious file extensions.
|
2020-01-27 03:04:55 -08:00 |
|
|
jzsplunk
|
d4aa6bc9ea
|
update smb related content. The outbound_smb_connections detection works out of the box against attack ID T1110 when testing in the attack range.
|
2020-01-27 02:33:26 -08:00 |
|
|
jzsplunk
|
b762034a4b
|
update version info and macros, attack range freezing on testing detection against attack ID T1071 so query is untested against atomic red team test for now
|
2020-01-27 01:44:53 -08:00 |
|
|
jzsplunk
|
6406cfbc32
|
update version info, add macros for first time seen cmd line detection
|
2020-01-27 01:08:53 -08:00 |
|
|
bpatel
|
9e6becda1f
|
adding definitions
|
2020-01-23 13:31:43 -08:00 |
|
|
Jose Enrique Hernandez
|
2fd12b9155
|
Merge pull request #320 from splunk/don_young_bug
updating the manifest to reflect correct details
|
2020-01-22 17:26:54 -08:00 |
|
|
Bhavin Patel
|
dd5b1ee344
|
Merge pull request #319 from splunk/dns_hijack_story_update
CRL-1718 updated fields and added macros and lookup entries
|
2020-01-22 14:58:40 -08:00 |
|
|
divious1
|
0ba1b4c30d
|
fixing mispelling
|
2020-01-22 13:31:09 -08:00 |
|
|
Bhavin Patel
|
38b84113bf
|
Merge pull request #318 from splunk/CRL-1495-update_share_creation_and_deletion
CRL-1495 update share creation and deletion
|
2020-01-22 09:19:43 -08:00 |
|
|
Bhavin Patel
|
0cef2e73b1
|
Merge pull request #315 from splunk/CRL-1716-FixPowerShellObfusc
CRL-1716 - Fixing by clause to allow searching Processes.process for …
|
2020-01-22 09:18:42 -08:00 |
|
|
bpatel
|
5d6ef5ce60
|
renaming files
|
2020-01-22 09:14:51 -08:00 |
|
|
Jason Brewer
|
b62ce205b8
|
CRL-1716 - Updating per code review requests. Adding output macro file and reference within the detection search.
|
2020-01-22 08:26:16 -08:00 |
|
|
Jose Enrique Hernandez
|
bfa7317668
|
removing comments
|
2020-01-21 18:14:24 -08:00 |
|
|
bpatel
|
3bf8cf26de
|
updating the manifest to reflect correct details
|
2020-01-21 18:05:33 -08:00 |
|
|
Jose Enrique Hernandez
|
c6a904b36f
|
Merge pull request #314 from splunk/CRL-1712_netsh_abuse
CRL-1712 Disabling Security Tools
|
2020-01-21 11:42:42 -08:00 |
|
|
Jose Enrique Hernandez
|
11a1b68979
|
bumping version
|
2020-01-21 11:28:26 -08:00 |
|
|
jzsplunk
|
c007d41844
|
remove comments to get search working, clean up detection
|
2020-01-21 02:23:15 -08:00 |
|
|
jzsplunk
|
82d00df489
|
Drop comments to get search working, change file name to reflect generic case of detecting any type of share deletion or creation.
|
2020-01-21 02:07:30 -08:00 |
|
|
jzsplunk
|
6eed922214
|
testing commented search
|
2020-01-21 01:58:30 -08:00 |
|
|
divious1
|
0ac15cb563
|
updated fields and added macros and lookup entries
|
2020-01-19 21:37:45 -05:00 |
|
|
Jason Brewer
|
5383117f1c
|
CRL-1716 - Fixing by clause to allow searching Processes.process for obfuscation chars.
|
2020-01-17 16:48:27 -08:00 |
|
|
Jose Enrique Hernandez
|
6a4d42f582
|
Merge pull request #310 from splunk/CRL-1715
CRL-1715 updated search syntax, tested in attack_range
|
2020-01-16 15:36:19 -06:00 |
|
|
bpatel
|
69a35f1c16
|
macros
|
2020-01-14 15:40:45 -08:00 |
|
|
bpatel
|
52f5a71060
|
new search unload sysmon filter
|
2020-01-14 15:27:57 -08:00 |
|