Commit Graph

  • 8ffb45d68b mbr_and_more tccontre 2022-02-23 15:43:24 +01:00
  • 743701d542 docgen ready P4T12ICK 2022-02-23 14:46:39 +01:00
  • cbb60f2e07 mbr_and_more tccontre 2022-02-23 14:18:07 +01:00
  • a35596dfa4 mbr_and_more tccontre 2022-02-23 11:32:05 +01:00
  • 671314a6db Just updated the timestamp, but not the version. Waiting on sysmon TA update for fix. JIRA_44473_Fixes pyth0n1c 2022-02-22 16:58:58 -08:00
  • 0b2dc423ca Updated Rundll32 with no Command Line Arguments with Network pyth0n1c 2022-02-22 16:56:17 -08:00
  • 74f3cee9e2 Fixed SearchProtocolHost with no Command Line with Network pyth0n1c 2022-02-22 16:54:08 -08:00
  • 3ed2b5a57b Updated the dates on the relevant detections, but did not change version. These detections have not changed, but this helps track pending fixes for the JIRA issue. pyth0n1c 2022-02-22 16:51:52 -08:00
  • f1661d8ad8 Update datamodels pyth0n1c 2022-02-22 16:48:41 -08:00
  • 8a43aa3033 Another fix for the Ports change pyth0n1c 2022-02-22 16:46:33 -08:00
  • 46e0f41d6f Modified detection to match new sysmon version pyth0n1c 2022-02-22 15:41:31 -08:00
  • 6a16348c64 Fixing previous commit - turned the macro into two sources instead of two sourcetypes SuggestedFixes pyth0n1c 2022-02-22 15:33:22 -08:00
  • c39991b4ac Updated the printservice macro with two sourcetypes instead of one source and one sourcetype pyth0n1c 2022-02-22 15:30:48 -08:00
  • decf489c9d Update DLLHost with no Command Line Arguments with Network pyth0n1c 2022-02-22 15:05:20 -08:00
  • 82ea20ae1d Field name changed from process_name to parent_process_name. This should be reviewed to ensure that the TA is parsing the events correctly and that this does not change the fundamental meaning of the detection. pyth0n1c 2022-02-22 15:00:29 -08:00
  • 5812cda4de Fixed Outbound Network Connection from Java Using Default Ports pyth0n1c 2022-02-22 14:54:34 -08:00
  • 37f0726c72 Adding in the YAML files for the lookups Michael Hart 2022-02-22 17:47:05 -05:00
  • e61f56eb05 Update ssa___windows_bitsadmin_download_file.yml mhaag-spl 2022-02-22 15:13:43 -07:00
  • dfb089db4e Update ssa___windows_certutil_decode_file.yml mhaag-spl 2022-02-22 14:58:49 -07:00
  • d7d9d58663 Branch was auto-updated. pyth0n1c 2022-02-22 10:28:02 -08:00
  • 133d1881ff Branch was auto-updated. pyth0n1c 2022-02-22 10:28:01 -08:00
  • 2f0002a746 Branch was auto-updated. pyth0n1c 2022-02-22 10:28:00 -08:00
  • 0522024276 Branch was auto-updated. pyth0n1c 2022-02-22 10:27:58 -08:00
  • 22acc44edb Branch was auto-updated. pyth0n1c 2022-02-22 10:27:57 -08:00
  • b6b6e38d26 Branch was auto-updated. pyth0n1c 2022-02-22 10:27:53 -08:00
  • fb9bdc0203 Branch was auto-updated. pyth0n1c 2022-02-22 10:27:51 -08:00
  • 2b44f6d007 Branch was auto-updated. pyth0n1c 2022-02-22 10:27:50 -08:00
  • e2a0daccfb Branch was auto-updated. pyth0n1c 2022-02-22 10:27:48 -08:00
  • 6d463a49ec Branch was auto-updated. pyth0n1c 2022-02-22 10:27:47 -08:00
  • c52900e041 Merge pull request #2035 from splunk/RemovingUnusedTAs pyth0n1c 2022-02-22 10:27:25 -08:00
  • c1399ec1d0 Branch was auto-updated. pyth0n1c 2022-02-22 10:19:45 -08:00
  • 5b0f4ed979 Branch was auto-updated. pyth0n1c 2022-02-22 10:19:44 -08:00
  • b3577b359f Branch was auto-updated. pyth0n1c 2022-02-22 10:19:43 -08:00
  • 01bfa289e4 Branch was auto-updated. pyth0n1c 2022-02-22 10:19:41 -08:00
  • d41d990ba3 Branch was auto-updated. pyth0n1c 2022-02-22 10:19:40 -08:00
  • 9128e8d7ba Branch was auto-updated. pyth0n1c 2022-02-22 10:19:37 -08:00
  • 6ae83225af Branch was auto-updated. pyth0n1c 2022-02-22 10:19:36 -08:00
  • 1a7cd1ecb7 Branch was auto-updated. pyth0n1c 2022-02-22 10:19:35 -08:00
  • 7e9aa41ecc Branch was auto-updated. pyth0n1c 2022-02-22 10:19:35 -08:00
  • 6525def691 Branch was auto-updated. pyth0n1c 2022-02-22 10:19:32 -08:00
  • 9c9d1365ee Branch was auto-updated. pyth0n1c 2022-02-22 10:19:31 -08:00
  • 69ee70ed32 Merge branch 'TR_1550_Kerberos_Coverage_1' of github.com:splunk/security_content into TR_1550_Kerberos_Coverage_1 mvelazco 2022-02-22 13:19:15 -05:00
  • 78b79d31e7 adding new detection for T1558.004 mvelazco 2022-02-22 13:19:13 -05:00
  • 7b34eb2086 Merge pull request #2038 from splunk/tasktask pyth0n1c 2022-02-22 10:19:12 -08:00
  • ab11cd1c60 Update pull_request_template.md mhaag-spl 2022-02-22 10:59:25 -07:00
  • 1f3d15676b Update scheduled_task_deleted_or_created_via_cmd.yml mhaag-spl 2022-02-22 10:57:07 -07:00
  • 8f9561932d Update scheduled_task_deleted_or_created_via_cmd.yml mhaag-spl 2022-02-22 10:56:24 -07:00
  • bda23e1631 Merge branch 'refactored_security_content' of github.com:splunk/security_content into refactored_security_content P4T12ICK 2022-02-22 18:40:52 +01:00
  • 2cda47990b doc_gen ready P4T12ICK 2022-02-22 18:40:36 +01:00
  • d4b0125a51 handling case sensitivity Lou Stella 2022-02-22 08:43:26 -06:00
  • d3b8dcf0e0 mbr_and_more tccontre 2022-02-22 14:12:27 +01:00
  • 50f7e99150 mbr_and_more tccontre 2022-02-22 09:18:18 +01:00
  • 9e11acc4dc Branch was auto-updated. pyth0n1c 2022-02-21 02:11:46 -08:00
  • 20ac8fbfbf Branch was auto-updated. pyth0n1c 2022-02-21 02:11:44 -08:00
  • 7b9de3e110 Branch was auto-updated. pyth0n1c 2022-02-21 02:11:43 -08:00
  • de62011c2f Branch was auto-updated. pyth0n1c 2022-02-21 02:11:42 -08:00
  • 82e48dbeed Branch was auto-updated. pyth0n1c 2022-02-21 02:11:38 -08:00
  • 652c0fda80 Branch was auto-updated. pyth0n1c 2022-02-21 02:11:36 -08:00
  • ee76f0b129 Branch was auto-updated. pyth0n1c 2022-02-21 02:11:33 -08:00
  • 0a8a6130dd Branch was auto-updated. pyth0n1c 2022-02-21 02:11:32 -08:00
  • 2380e8c38a Branch was auto-updated. pyth0n1c 2022-02-21 02:11:31 -08:00
  • b613a1bb09 Branch was auto-updated. pyth0n1c 2022-02-21 02:11:29 -08:00
  • ce3ef8f2f4 Branch was auto-updated. pyth0n1c 2022-02-21 02:11:28 -08:00
  • cc63c0d635 Merge pull request #2012 from splunk/linux_lolbin_stage1 tccontre 2022-02-21 11:11:06 +01:00
  • 55687ef9b3 Branch was auto-updated. pyth0n1c 2022-02-18 15:32:31 -08:00
  • 16020ef7f2 Branch was auto-updated. pyth0n1c 2022-02-18 15:32:30 -08:00
  • 8e290dc3ba Branch was auto-updated. pyth0n1c 2022-02-18 15:32:29 -08:00
  • cff00dd28a Branch was auto-updated. pyth0n1c 2022-02-18 15:32:28 -08:00
  • 6b41dbc431 Branch was auto-updated. pyth0n1c 2022-02-18 15:32:27 -08:00
  • 057da47d2d Branch was auto-updated. pyth0n1c 2022-02-18 15:32:25 -08:00
  • 08b5e5c516 Branch was auto-updated. pyth0n1c 2022-02-18 15:32:24 -08:00
  • a5084e384e Branch was auto-updated. pyth0n1c 2022-02-18 15:32:23 -08:00
  • 59d1365ceb Branch was auto-updated. pyth0n1c 2022-02-18 15:32:18 -08:00
  • fa311150cb Branch was auto-updated. pyth0n1c 2022-02-18 15:32:17 -08:00
  • f090badcd4 Branch was auto-updated. pyth0n1c 2022-02-18 15:32:16 -08:00
  • df824e79ac Branch was auto-updated. pyth0n1c 2022-02-18 15:32:15 -08:00
  • 9d4e22bf69 Merge pull request #2020 from splunk/UpdatingDetectionsForLatestApps pyth0n1c 2022-02-18 15:31:56 -08:00
  • c544488575 adding asp roasting detection T1558.004 mvelazco 2022-02-18 17:42:58 -05:00
  • ba97944d04 adding ldap detection d1vious 2022-02-18 17:39:23 -05:00
  • 8ae7ecb1ce Branch was auto-updated. pyth0n1c 2022-02-18 14:39:12 -08:00
  • 52e5dcc8b1 Branch was auto-updated. pyth0n1c 2022-02-18 14:39:11 -08:00
  • 27420cdb0c Branch was auto-updated. pyth0n1c 2022-02-18 14:39:07 -08:00
  • 12bdf8bd2d Branch was auto-updated. pyth0n1c 2022-02-18 14:39:06 -08:00
  • f582876fdd Branch was auto-updated. pyth0n1c 2022-02-18 14:39:05 -08:00
  • 3a00e27eb9 Branch was auto-updated. pyth0n1c 2022-02-18 14:39:03 -08:00
  • dd7bbe0442 Branch was auto-updated. pyth0n1c 2022-02-18 14:39:02 -08:00
  • b66df8d97b Branch was auto-updated. pyth0n1c 2022-02-18 14:39:01 -08:00
  • 5f2c8756e7 Branch was auto-updated. pyth0n1c 2022-02-18 14:38:59 -08:00
  • 0184f33556 Branch was auto-updated. pyth0n1c 2022-02-18 14:38:59 -08:00
  • f906d579d9 Branch was auto-updated. pyth0n1c 2022-02-18 14:38:58 -08:00
  • fe9fa2589b Branch was auto-updated. pyth0n1c 2022-02-18 14:38:57 -08:00
  • 68db6b1d16 Merge pull request #2036 from splunk/docgen_improvements pyth0n1c 2022-02-18 14:38:39 -08:00
  • 46e0bb0a01 Added a timeout to the CVESSEARCH_API enrichment in doc_gen. Sometimes, this was causing doc_gen to freeze. Now, when the API is not working or is extremely slow and a request takes longer than 10 seconds, a descriptive error will be thrown and the process will exit with 1 pyth0n1c 2022-02-18 14:19:57 -08:00
  • 09c54931af Memoizing/caching a call to CVESSEARCH_API_URL. Gives a SIGNIFICANT speedup in docgen. pyth0n1c 2022-02-18 13:36:09 -08:00
  • 9da1af7e8c minor changes for CIM fields and other metadata patel-bhavin 2022-02-18 11:51:32 -08:00
  • db3605c753 adding ssa detection d1vious 2022-02-18 14:26:17 -05:00
  • 9fc009a44d Removed: SPLUNK_SECURITY_ESSENTIALS SPLUNK_APP_FOR_AWS from default app baseline. They are not required for testing as they just provide some dashboards. pyth0n1c 2022-02-18 11:17:21 -08:00
  • 0338044721 Updating the date to today and bumping the version for updated searches associated with this PR. pyth0n1c 2022-02-18 10:57:49 -08:00
  • 4e32398655 Branch was auto-updated. pyth0n1c 2022-02-18 09:43:42 -08:00
  • 6fe0933639 Branch was auto-updated. pyth0n1c 2022-02-18 09:43:41 -08:00