Commit Graph

  • 183f1f689e Delete windows_input_capture_using_credential_ui_dll.test.yml tccontre 2022-09-01 13:19:55 +02:00
  • 22721a4554 Delete windows_phishing_recent_iso_exec_registry.test.yml tccontre 2022-09-01 13:19:45 +02:00
  • ce4f5e5ad3 Delete windows_remote_access_software_brc4_loaded_dll.test.yml tccontre 2022-09-01 13:19:35 +02:00
  • 954a9e9dd3 Delete windows_gather_victim_identity_sam_info.yml tccontre 2022-09-01 13:19:19 +02:00
  • 506732a62b brute-ratel-3 tccontre 2022-09-01 13:16:24 +02:00
  • 1557a528cf brute-ratel-2 tccontre 2022-08-31 10:12:55 +02:00
  • c8f038be5d Update windows_remote_access_software_brc4_loaded_dll.yml tccontre 2022-08-31 09:44:21 +02:00
  • 9e94c62a6a adding new detection mvelazco 2022-08-30 18:25:25 -04:00
  • 537c13d063 addedwords Rod Soto 2022-08-30 11:56:41 -07:00
  • 4d2c2028bc Update linux_persistence_and_privilege_escalation_risk_behavior.yml Michael Haag 2022-08-30 11:44:59 -06:00
  • 126049593e Updates Michael Haag 2022-08-30 11:21:46 -06:00
  • 927d46a74e adding new detection mvelazco 2022-08-30 13:07:41 -04:00
  • e90fa05a96 Update windows_remote_access_software_brc4_loaded_dll.yml tccontre 2022-08-30 17:49:16 +02:00
  • ec1a26ed46 Update windows_phishing_recent_iso_exec_registry.yml tccontre 2022-08-30 17:46:57 +02:00
  • d91a14c4d4 Update windows_hijack_execution_flow_version_dll_side_load.yml tccontre 2022-08-30 17:42:04 +02:00
  • 44bc5ac3da Update windows_ingress_tool_transfer_using_explorer.yml Michael Haag 2022-08-30 06:38:55 -06:00
  • e9484c657f Update ssa___windows_lolbin_binary_in_non_standard_path.yml Michael Haag 2022-08-30 06:31:00 -06:00
  • 8d6d137ba1 Update windows_remote_access_software_brc4_loaded_dll.yml tccontre 2022-08-30 13:11:24 +02:00
  • b401ed9d50 brute-ratel-2 tccontre 2022-08-30 13:08:04 +02:00
  • 4457d5d5f1 pushing analytic story mvelazco 2022-08-29 20:06:06 -04:00
  • 6e07f25d0b fixing lookup name typo mvelazco 2022-08-29 17:30:34 -04:00
  • 79f7f9c16e adding new detection mvelazco 2022-08-29 17:00:05 -04:00
  • 2adb6ca2ff updating docs and package bits [ci skip] research bot 2022-08-29 17:48:48 +00:00
  • d899525e04 draft yml gworkspace_1 patel-bhavin 2022-08-29 12:34:13 -05:00
  • 34c6bb1887 Rename windows_service_created_in_uncommon_service_path.test.yml to windows_service_created_with_suspicious_service_path.test.yml tccontre 2022-08-29 19:09:19 +02:00
  • c79cb8f97b Update windows_service_created_in_uncommon_service_path.test.yml tccontre 2022-08-29 19:05:32 +02:00
  • b59f8ecd34 Update and rename windows_service_created_in_uncommon_service_path.yml to windows_service_created_with_suspicious_service_path.yml tccontre 2022-08-29 19:04:50 +02:00
  • 0473b83ffb minor fixes mvelazco 2022-08-29 12:12:42 -04:00
  • 024337cf62 improving detections mvelazco 2022-08-29 11:46:57 -04:00
  • d9226071a7 Merge branch 'TR-2390_Additional_Azure_Detections' of github.com:splunk/security_content into TR-2390_Additional_Azure_Detections mvelazco 2022-08-29 11:24:02 -04:00
  • 02976117ce improving detection mvelazco 2022-08-29 11:24:00 -04:00
  • 7947afeea6 updates to testing code for a new app patel-bhavin 2022-08-29 09:35:18 -05:00
  • 1d99d7ec4a Branch was auto-updated. pyth0n1c 2022-08-26 14:04:36 -07:00
  • 04715d7c08 Branch was auto-updated. pyth0n1c 2022-08-26 14:04:35 -07:00
  • ffa7d052b4 Branch was auto-updated. pyth0n1c 2022-08-26 14:04:33 -07:00
  • a816d47db7 Branch was auto-updated. pyth0n1c 2022-08-26 14:04:32 -07:00
  • 2dbcc2aa64 Merge pull request #2323 from splunk/eliminate_duplicate_python_requirements_files v3.48.0 Bhavin Patel 2022-08-26 16:04:11 -05:00
  • 92e2d97588 Update detection-testing.yml pyth0n1c 2022-08-26 13:52:30 -07:00
  • 8d611bb546 Update detection-testing.yml pyth0n1c 2022-08-26 13:50:57 -07:00
  • baeba5b319 Fixed pathing pyth0n1c 2022-08-26 13:34:37 -07:00
  • 305a672f51 Delete contentctl_python_platforms_test.yml pyth0n1c 2022-08-26 13:27:01 -07:00
  • e5962ef678 Update contentctl_python_platforms_test.yml pyth0n1c 2022-08-26 12:22:18 -07:00
  • c1be892bd1 Merge branch 'develop' into eliminate_duplicate_python_requirements_files pyth0n1c 2022-08-26 12:09:54 -07:00
  • e000e583ca Branch was auto-updated. pyth0n1c 2022-08-26 11:42:39 -07:00
  • 8046a7933e Branch was auto-updated. pyth0n1c 2022-08-26 11:42:38 -07:00
  • 4de4752350 Branch was auto-updated. pyth0n1c 2022-08-26 11:42:37 -07:00
  • 0d484e063f Branch was auto-updated. pyth0n1c 2022-08-26 11:42:37 -07:00
  • 9f2fa92efd Merge pull request #2336 from splunk/hijack Bhavin Patel 2022-08-26 13:42:17 -05:00
  • 22c7650bed Branch was auto-updated. pyth0n1c 2022-08-26 10:01:48 -07:00
  • 379e1b689a Branch was auto-updated. pyth0n1c 2022-08-26 10:01:46 -07:00
  • 8f2a3bd754 Branch was auto-updated. pyth0n1c 2022-08-26 10:01:45 -07:00
  • f00171c89c Branch was auto-updated. pyth0n1c 2022-08-26 10:01:43 -07:00
  • bd2d1515cb Branch was auto-updated. pyth0n1c 2022-08-26 10:01:42 -07:00
  • f9e770eaa5 Update log4shell_cve_2021_44228_exploitation.yml Michael Haag 2022-08-26 11:01:25 -06:00
  • 19b3efc01a Merge pull request #2321 from splunk/TR_2301 Bhavin Patel 2022-08-26 12:01:19 -05:00
  • b2941ca736 Update linux_persistence_and_privilege_escalation_risk_behavior.yml Michael Haag 2022-08-26 10:58:35 -06:00
  • c912c7c939 Update linux_persistence_and_privilege_escalation_risk_behavior.yml Michael Haag 2022-08-26 10:58:17 -06:00
  • ef15938261 Branch was auto-updated. pyth0n1c 2022-08-26 09:35:19 -07:00
  • 10d2966215 Branch was auto-updated. pyth0n1c 2022-08-26 09:35:18 -07:00
  • 2c685dd106 Branch was auto-updated. pyth0n1c 2022-08-26 09:35:17 -07:00
  • 5f6b780e0b Branch was auto-updated. pyth0n1c 2022-08-26 09:35:16 -07:00
  • 2bfc066411 Branch was auto-updated. pyth0n1c 2022-08-26 09:35:15 -07:00
  • 5d8cbb81ca Branch was auto-updated. pyth0n1c 2022-08-26 09:35:15 -07:00
  • a8097ab665 Merge pull request #2341 from splunk/fix-desc Bhavin Patel 2022-08-26 11:34:56 -05:00
  • e0f0d48784 minonr text updates patel-bhavin 2022-08-26 10:46:51 -05:00
  • c560685650 Update windows_possible_credential_dumping.yml Michael Haag 2022-08-26 09:18:56 -06:00
  • 510ece0c70 Updates Michael Haag 2022-08-26 08:02:32 -06:00
  • 346e7000e2 fix-desc tccontre 2022-08-26 15:39:48 +02:00
  • 5ddf3c9cf7 Merge branch 'hijack' of https://github.com/splunk/security_content into hijack Michael Haag 2022-08-26 06:01:16 -06:00
  • c7aba6738e Update windows_remote_access_software_hunt.yml Michael Haag 2022-08-26 06:01:15 -06:00
  • c1ae64ed36 Update brute_ratel.yml tccontre 2022-08-26 12:10:46 +02:00
  • 17c6d7ff3b brute-ratel-1 tccontre 2022-08-26 12:07:53 +02:00
  • 044d38f3ac brute-ratel-1 tccontre 2022-08-26 12:06:24 +02:00
  • b24b66f054 brute-ratel-1 tccontre 2022-08-26 12:03:46 +02:00
  • 08cb1d8bf5 Branch was auto-updated. pyth0n1c 2022-08-25 16:26:00 -07:00
  • 63c3744821 Branch was auto-updated. pyth0n1c 2022-08-25 16:25:59 -07:00
  • 846867c7d4 Branch was auto-updated. pyth0n1c 2022-08-25 16:25:57 -07:00
  • a1d1297de9 Branch was auto-updated. pyth0n1c 2022-08-25 16:25:56 -07:00
  • a8c2a781be Branch was auto-updated. pyth0n1c 2022-08-25 16:25:55 -07:00
  • cfaf15a916 Merge pull request #2337 from splunk/100_percent_pass_rate Bhavin Patel 2022-08-25 18:25:35 -05:00
  • 474ea41291 Finishing updates authors, versions, and dates on searches. pyth0n1c 2022-08-25 15:09:13 -07:00
  • 8b47ea7b36 Updating the author(s), versions, and dates for searches in PR. pyth0n1c 2022-08-25 15:08:46 -07:00
  • 2a0c7a69d1 adding new detection mvelazco 2022-08-25 16:02:54 -04:00
  • c224e24b81 adding enrichment skeleton d1vious 2022-08-25 12:24:12 -04:00
  • 11eb0feac6 T1003.001 Update Michael Haag 2022-08-25 08:04:20 -06:00
  • 779ec07f0e adding description. updating dataset url mvelazco 2022-08-24 11:13:03 -04:00
  • f0926a5372 update detections mvelazco 2022-08-23 23:40:54 -04:00
  • 0a6592b9e2 adding new detection. fixing another mvelazco 2022-08-23 21:45:22 -04:00
  • 63398504c5 Merge branch 'TR-2361_Azure_AD_Persistence' of github.com:splunk/security_content into TR-2361_Azure_AD_Persistence mvelazco 2022-08-23 16:28:56 -04:00
  • 63f87f5a12 adding new detection mvelazco 2022-08-23 16:28:55 -04:00
  • 0ae64ea317 Branch was auto-updated. pyth0n1c 2022-08-23 13:05:57 -07:00
  • a2f1972d54 Branch was auto-updated. pyth0n1c 2022-08-23 13:05:56 -07:00
  • 4788d6c4e3 Branch was auto-updated. pyth0n1c 2022-08-23 13:05:54 -07:00
  • 84ca877947 Branch was auto-updated. pyth0n1c 2022-08-23 13:05:53 -07:00
  • a1b3e4c6f7 Branch was auto-updated. pyth0n1c 2022-08-23 13:05:52 -07:00
  • 0c0fc259b6 Merge pull request #2325 from splunk/Update_Azure_Account_Takeover Bhavin Patel 2022-08-23 15:05:18 -05:00
  • f8151c3eef Branch was auto-updated. pyth0n1c 2022-08-23 13:02:43 -07:00
  • 122dee07d2 Branch was auto-updated. pyth0n1c 2022-08-23 13:02:42 -07:00
  • 8af9f52177 Branch was auto-updated. pyth0n1c 2022-08-23 13:02:40 -07:00
  • 889cdf3bc5 Branch was auto-updated. pyth0n1c 2022-08-23 13:02:39 -07:00