20551 Commits

Author SHA1 Message Date
Bhavin Patel 00d091585e Merge pull request #2664 from splunk/SRS_AD_PrivEsc
Adding AD Privilege Escalation SRS Detections
v4.3.0
2023-05-26 11:52:56 -07:00
srv-rr-gh-researchbt 39315ca9e6 Branch was auto-updated. 2023-05-26 11:43:30 -07:00
Bhavin Patel 91b25de209 Merge pull request #2694 from splunk/volt_typhoon_2
volt_typhoon_2
2023-05-26 11:43:09 -07:00
srv-rr-gh-researchbt 4cad11bfa5 Branch was auto-updated. 2023-05-26 11:32:15 -07:00
srv-rr-gh-researchbt 102e48f023 Branch was auto-updated. 2023-05-26 11:31:59 -07:00
Bhavin Patel 93c0a5eaf6 Merge pull request #2693 from splunk/volt_typhoon
volt_typhoon
2023-05-26 11:31:31 -07:00
srv-rr-gh-researchbt 1cca18d837 Branch was auto-updated. 2023-05-26 11:29:15 -07:00
srv-rr-gh-researchbt 19d67b01a4 Branch was auto-updated. 2023-05-26 11:29:05 -07:00
srv-rr-gh-researchbt 416912e4e7 Branch was auto-updated. 2023-05-26 11:28:56 -07:00
Bhavin Patel 71524efcf6 Merge pull request #2691 from splunk/TR-3512
Missing condition in BA detection
2023-05-26 11:28:37 -07:00
Bhavin Patel d992b9012c Merge branch 'develop' into volt_typhoon 2023-05-25 18:03:04 -07:00
Bhavin Patel 435cf8c8eb Update volt_typhoon.yml
fix yml for app inspect
2023-05-25 18:01:02 -07:00
srv-rr-gh-researchbt 098cbf2eca Branch was auto-updated. 2023-05-25 17:58:24 -07:00
srv-rr-gh-researchbt 921e0e6aac Branch was auto-updated. 2023-05-25 17:58:20 -07:00
srv-rr-gh-researchbt cb736c8f28 Branch was auto-updated. 2023-05-25 17:58:16 -07:00
Bhavin Patel 6c63cee1a1 Merge pull request #2680 from splunk/exfiltration_references
Data exfil update
2023-05-25 17:57:58 -07:00
pyth0n1c caf380edb4 Update data_exfiltration.yml
Just adding a missing space in description field.
2023-05-25 16:17:47 -07:00
srv-rr-gh-researchbt 460a414849 Branch was auto-updated. 2023-05-25 14:37:16 -07:00
srv-rr-gh-researchbt 5312020e0f Branch was auto-updated. 2023-05-25 14:37:13 -07:00
srv-rr-gh-researchbt bd14701488 Branch was auto-updated. 2023-05-25 14:37:09 -07:00
srv-rr-gh-researchbt c879db0e3b Branch was auto-updated. 2023-05-25 14:37:07 -07:00
Bhavin Patel 07440777ce Merge pull request #2690 from splunk/TR2850_RBA_PrivEsc
Correlation rule for Priv Esc
2023-05-25 14:36:43 -07:00
srv-rr-gh-researchbt a6588bd8bf Branch was auto-updated. 2023-05-25 11:14:56 -07:00
srv-rr-gh-researchbt 255083de9f Branch was auto-updated. 2023-05-25 11:14:55 -07:00
srv-rr-gh-researchbt 48b567dd1e Branch was auto-updated. 2023-05-25 11:14:50 -07:00
srv-rr-gh-researchbt 6d5e4a4b14 Branch was auto-updated. 2023-05-25 11:14:49 -07:00
srv-rr-gh-researchbt 518422b945 Branch was auto-updated. 2023-05-25 11:14:45 -07:00
Bhavin Patel 164b94464e Merge pull request #2689 from splunk/iceid_dfir_coverage
iceid_dfir_coverage
2023-05-25 11:14:25 -07:00
Michael Haag 8d768f513f name fixes 2023-05-25 10:47:03 -06:00
tccontre ba7f909caa volt_typhoon_2 2023-05-25 16:02:03 +02:00
Michael Haag 4ed5741a8a Create windows_ldifde_directory_object_behavior.yml 2023-05-25 07:44:14 -06:00
tccontre 2aa964f688 volt_typhoon_2 2023-05-25 15:42:09 +02:00
tccontre b617a454fa Merge branch 'volt_typhoon' of github.com:splunk/security_content into volt_typhoon 2023-05-25 15:07:58 +02:00
tccontre 2c935bb402 volt_typhoon 2023-05-25 15:05:13 +02:00
Michael Haag b881799d7f Update suspicious_copy_on_system32.yml 2023-05-25 06:44:12 -06:00
Michael Haag 29985a3e6c password spray 2023-05-25 06:35:11 -06:00
Michael Haag 435764203d Update windows_dns_gather_network_info.yml 2023-05-25 06:08:14 -06:00
Michael Haag b9b847b9f6 Merge branch 'volt_typhoon' of https://github.com/splunk/security_content into volt_typhoon 2023-05-25 06:07:27 -06:00
Michael Haag ec897a5cbb more 2023-05-25 06:07:25 -06:00
tccontre c887050e65 Merge branch 'volt_typhoon' of github.com:splunk/security_content into volt_typhoon 2023-05-25 14:01:57 +02:00
tccontre b76d701acf volt_typhoon 2023-05-25 14:01:24 +02:00
Michael Haag 20c60fb589 1 more 2023-05-25 06:00:45 -06:00
Michael Haag 9d15cfbf7e few more 2023-05-25 05:59:55 -06:00
Michael Haag 4110afa0bc volts 2023-05-25 05:52:07 -06:00
tccontre aad413f44c volt_typhoon 2023-05-25 12:16:00 +02:00
Lou Stella 395923d3f8 Generated output 2023-05-24 17:54:15 -05:00
Lou Stella 0db1b8faf4 converted 2023-05-24 13:18:38 -05:00
Lou Stella 8bce0fb358 updated base rule 2023-05-24 13:02:14 -05:00
tccontre 03ad08635e iceid_dfir_coverage 2023-05-24 14:58:17 +02:00
tccontre 97307452a5 Update network_share_discovery_via_dir_command.yml 2023-05-24 10:50:56 +02:00