 Bhavin Patel
|
ea9921d6ab
|
Branch was auto-updated.
|
2025-01-09 11:42:54 -08:00 |
|
|
Lou Stella
|
d2592c5deb
|
Merge pull request #3270 from splunk/auto-ta-update-139
Automated Splunk TA Update 139
|
2025-01-09 13:42:36 -06:00 |
|
|
ljstella
|
1ce4f77a4c
|
update description
|
2025-01-09 12:02:56 -06:00 |
|
|
ljstella
|
4b28335f82
|
retrigger
|
2025-01-09 11:12:57 -06:00 |
|
|
ljstella
|
02afa4f4cb
|
Adding PSC
|
2025-01-09 11:08:49 -06:00 |
|
|
ljstella
|
5b8986469e
|
Removed parens that was killing app installs
|
2025-01-09 10:39:47 -06:00 |
|
|
Nasreddine Bencherchali
|
f06f5cd618
|
rename rule and enhance metadata
|
2025-01-09 13:39:03 +01:00 |
|
|
ljstella
|
c591ef5ff7
|
Adding back two containers
|
2025-01-08 12:45:30 -06:00 |
|
|
ljstella
|
a9129bf5e3
|
Testing single container
|
2025-01-08 12:40:39 -06:00 |
|
|
Bhavin Patel
|
4ed661ab65
|
Branch was auto-updated.
|
2025-01-08 10:11:54 -08:00 |
|
|
Bhavin Patel
|
607494bfb8
|
Branch was auto-updated.
|
2025-01-08 10:11:52 -08:00 |
|
|
Bhavin Patel
|
be3ab3c6ed
|
Merge pull request #3255 from nterl0k/nterl0k-T1550-netexec-usage
Nterl0k - T1550 - NetExec Usage Detection
|
2025-01-08 10:11:36 -08:00 |
|
|
Bhavin Patel
|
5e58179a00
|
file name update
|
2025-01-08 10:09:48 -08:00 |
|
|
Nasreddine Bencherchali
|
a8c3540aa8
|
typo fixes and some logic update
|
2025-01-08 14:46:37 +01:00 |
|
|
patel-bhavin
|
7c7904265a
|
Updated TAs
|
2025-01-08 06:58:09 +00:00 |
|
|
Steven Dick
|
50fd37accd
|
Update windows_process_with_netexec_command_line_parameters.yml
Adding drilldowns
|
2025-01-07 15:49:16 -05:00 |
|
|
Nasreddine Bencherchali
|
e8f9c1ddd0
|
Merge branch 'develop' into nterl0k-T1550-netexec-usage
|
2025-01-07 17:45:50 +01:00 |
|
|
Nasreddine Bencherchali
|
662b542299
|
Apply suggestions from code review
|
2025-01-07 17:44:25 +01:00 |
|
|
Bhavin Patel
|
263db16960
|
author update
|
2025-01-06 14:42:03 -08:00 |
|
|
Bhavin Patel
|
35368173c0
|
observable type
|
2025-01-06 14:41:11 -08:00 |
|
|
Bhavin Patel
|
d69dcf35a4
|
Merge pull request #3253 from nterl0k/nterl0k-t1595-generic-scanner
Nterl0k - T1595 - Generic Scanning Behavior
|
2025-01-06 13:30:17 -08:00 |
|
|
Bhavin Patel
|
70f1a691fb
|
Merge branch 'develop' into nterl0k-t1595-generic-scanner
|
2025-01-06 13:02:19 -08:00 |
|
|
Bhavin Patel
|
f285ed257f
|
Merge pull request #3249 from splunk/web_xchange_shell
Update - Detect Exchange Web Shell
|
2025-01-06 12:29:37 -08:00 |
|
|
Steven Dick
|
c1d7d2cc75
|
Update windows_process_with_netexec_command_line_parameters.yml
|
2025-01-06 11:01:24 -05:00 |
|
|
Lou Stella
|
f1fca81df6
|
Merge branch 'develop' into nterl0k-t1595-generic-scanner
|
2025-01-06 09:04:07 -06:00 |
|
|
Bhavin Patel
|
aae586aaa4
|
Branch was auto-updated.
|
2025-01-03 15:11:34 -08:00 |
|
|
Lou Stella
|
6adf586d51
|
Merge pull request #3262 from splunk/auto-ta-update-133
|
2025-01-03 17:11:13 -06:00 |
|
|
ljstella
|
83b3111dab
|
Pin container to 9.3
|
2025-01-03 14:39:59 -06:00 |
|
|
Bhavin Patel
|
f5751ef693
|
Branch was auto-updated.
|
2025-01-03 11:56:53 -08:00 |
|
|
Bhavin Patel
|
5f771b6445
|
Branch was auto-updated.
|
2025-01-03 11:56:50 -08:00 |
|
|
Bhavin Patel
|
1ae042b1d3
|
Merge pull request #3247 from splunk/issue_3245
Remove index from macro
|
2025-01-03 11:56:36 -08:00 |
|
|
Bhavin Patel
|
9ee8526d74
|
update mitre
Removed T1423 since that id is for Mobile
|
2025-01-03 11:54:54 -08:00 |
|
|
Bhavin Patel
|
39842b9ed9
|
build error fixes
Updated the yaml file name and other meta data to ensure it builds succesfully
|
2025-01-03 11:50:49 -08:00 |
|
|
Bhavin Patel
|
a0e6f0fa7b
|
minor update to data_source
|
2025-01-03 11:38:15 -08:00 |
|
|
patel-bhavin
|
8d6d3b45bd
|
Updated TAs
|
2025-01-02 06:58:09 +00:00 |
|
|
Steven Dick
|
6e06a19329
|
Update windows_process_with_netexec_command_line_parameters.yml
|
2024-12-31 08:58:52 -05:00 |
|
|
Steven Dick
|
771f42392f
|
Update windows_process_with_netexec_command_line_parameters.yml
|
2024-12-31 08:51:56 -05:00 |
|
|
Steven Dick
|
2fcd0ecef1
|
Update windows_process_with_netexec_command_line_parameters.yml
Update detection logic to include "nxc.exe" for process_name or original_file_name as detection points as requested.
Reduce confidence as requested.
|
2024-12-30 16:55:10 -05:00 |
|
|
Steven Dick
|
a53cfeb955
|
Update detections/endpoint/windows_process_with_netexec_command_line_parameters.yml
Update detection description with recommendation
Co-authored-by: Nasreddine Bencherchali <monsteroffire2@gmail.com>
|
2024-12-30 16:41:28 -05:00 |
|
|
Nasreddine Bencherchali
|
4ad7bcce12
|
Merge branch 'develop' into issue_3245
|
2024-12-30 13:29:43 +01:00 |
|
|
Steven Dick
|
d4a2b3eaee
|
Add files via upload
|
2024-12-27 08:16:02 -05:00 |
|
|
Steven Dick
|
f1d2c7ddf9
|
Add files via upload
|
2024-12-26 12:23:09 -05:00 |
|
|
research-bot
|
73f13e43f3
|
version
|
2024-12-23 10:43:28 -08:00 |
|
|
research-bot
|
cf8036845f
|
updating search
|
2024-12-23 10:40:21 -08:00 |
|
|
Lou Stella
|
458bf0cc64
|
Merge pull request #3248 from splunk/auto-ta-update-121
|
2024-12-21 12:23:43 -06:00 |
|
|
patel-bhavin
|
31821099d7
|
Updated TAs
|
2024-12-21 06:57:52 +00:00 |
|
|
Nasreddine Bencherchali
|
d8434fbe3a
|
Merge branch 'develop' into issue_3245
|
2024-12-19 20:36:35 +01:00 |
|
|
research-bot
|
360a91ebbb
|
remove index
|
2024-12-18 13:32:03 -08:00 |
|
|
Bhavin Patel
|
bda72d8518
|
Merge pull request #3246 from splunk/xorddos
xorddos
|
2024-12-18 08:48:26 -08:00 |
|
|
tccontre
|
cd0fb26906
|
xorddos
|
2024-12-17 19:34:54 +01:00 |
|