Commit Graph

  • 75b2d71102 auditd_detection_updates Teoderick Contreras 2025-02-20 17:29:28 +01:00
  • 37f16f5913 auditd_detection_updates Teoderick Contreras 2025-02-20 17:25:44 +01:00
  • 1a7122010a MSCS Update ljstella 2025-02-20 08:34:47 -06:00
  • 23c36c358c auditd_detection_updates Teoderick Contreras 2025-02-20 14:20:12 +01:00
  • 9743a1b606 auditd_detection_updates Teoderick Contreras 2025-02-20 14:03:56 +01:00
  • 3490fc07e9 auditd_detection_updates Teoderick Contreras 2025-02-20 13:51:30 +01:00
  • 7f09aa976d auditd_detection_updates Teoderick Contreras 2025-02-20 13:36:03 +01:00
  • f6646f58c6 Merge branch 'splunk:develop' into nterl0k-t1053-suspicious-task-lookups Steven Dick 2025-02-20 07:00:51 -05:00
  • a22793f748 Updated TAs auto-ta-update-182 patel-bhavin 2025-02-20 06:57:50 +00:00
  • df4dbde293 Merge branch 'develop' into curl_proxy_fix ☕️ 2025-02-20 01:51:35 +00:00
  • e6711e779a updating spl research-bot 2025-02-19 17:05:54 -08:00
  • 405064ec97 Update windows_process_execution_in_temp_dir.yml Bhavin Patel 2025-02-19 16:31:14 -08:00
  • dc9561dec9 udpating from integration test research-bot 2025-02-19 16:29:22 -08:00
  • 7907bd82d8 remove lookup CSV that is not used pyth0n1c 2025-02-19 14:51:59 -08:00
  • fde93c6d32 convert csv lookup to kvstore lookup. Update references in description files as well. pyth0n1c 2025-02-19 14:50:53 -08:00
  • d0fe9a8cd1 add whitespace to regex 0xC0FFEEEE 2025-02-19 22:36:24 +00:00
  • 756956328f reduce fps through case sensitive matching 0xC0FFEEEE 2025-02-19 22:30:24 +00:00
  • 7e9f150474 add url toolbox requirement 0xC0FFEEEE 2025-02-19 22:17:11 +00:00
  • bdb79594e5 Merge branch 'develop' into 8_million_requests Bhavin Patel 2025-02-19 13:57:40 -08:00
  • fe46608339 Update windows_scheduled_task_with_suspicious_name.yml Steven Dick 2025-02-19 16:57:14 -05:00
  • 569d453b49 Update windows_scheduled_task_with_suspicious_command.yml Steven Dick 2025-02-19 16:55:30 -05:00
  • 32c10dea26 Merge pull request #3317 from nterl0k/nterl0k-t1569-windows-sus-services-lookup Bhavin Patel 2025-02-19 13:08:24 -08:00
  • ea641c5f97 Merge branch 'develop' into nterl0k-t1569-windows-sus-services-lookup Nasreddine Bencherchali 2025-02-19 22:05:45 +01:00
  • 6dd60e8e5f Merge branch 'develop' into susmailrule pyth0n1c 2025-02-19 12:53:03 -08:00
  • 82bdfb3956 Merge pull request #3333 from nterl0k/nterl0k-t1546-compattelrunnner-abuse Bhavin Patel 2025-02-19 12:49:50 -08:00
  • e5f870a913 Merge pull request #3348 from splunk/update-exchange-macro Bhavin Patel 2025-02-19 12:40:48 -08:00
  • 86c6bbb464 Merge branch 'develop' into nterl0k-t1546-compattelrunnner-abuse Bhavin Patel 2025-02-19 12:39:03 -08:00
  • f738531b89 Merge branch 'develop' into susmailrule Bhavin Patel 2025-02-19 12:34:08 -08:00
  • f9c28ccdb3 minor changes to ensure CI testing works Bhavin Patel 2025-02-19 12:33:51 -08:00
  • fb4a5ea9f4 Update windows_suspicious_services.csv Steven Dick 2025-02-19 15:29:33 -05:00
  • 8a3308895b Merge branch 'develop' into nterl0k-t1053-suspicious-task-lookups pyth0n1c 2025-02-19 12:19:22 -08:00
  • d2ca0de2d7 Merge branch 'develop' into update-exchange-macro Nasreddine Bencherchali 2025-02-19 21:16:59 +01:00
  • f9ab1d168d Merge branch 'develop' into nterl0k-t1114-sus-o365-email-actions pyth0n1c 2025-02-19 12:15:02 -08:00
  • 7966993376 Merge pull request #3277 from splunk/new-rules pyth0n1c 2025-02-19 12:12:05 -08:00
  • 7df0472037 update exchange macro Nasreddine Bencherchali 2025-02-19 21:11:52 +01:00
  • d0b24c6581 Merge branch 'develop' into 8_million_requests Bhavin Patel 2025-02-19 12:00:47 -08:00
  • dac07f62d0 Update windows_compatibility_telemetry_tampering_through_registry.yml Nasreddine Bencherchali 2025-02-19 20:59:45 +01:00
  • fe00a4bbb3 Update windows_cisco_secure_endpoint_related_service_stopped.yml pyth0n1c 2025-02-19 11:52:46 -08:00
  • b19c6e67a6 Merge branch 'develop' into nterl0k-t1546-compattelrunnner-abuse Nasreddine Bencherchali 2025-02-19 20:48:28 +01:00
  • 5ff1deea69 Update windows_cisco_secure_endpoint_related_service_stopped.yml Nasreddine Bencherchali 2025-02-19 20:35:33 +01:00
  • 58a6e70e77 Merge branch 'develop' into new-rules pyth0n1c 2025-02-19 11:33:51 -08:00
  • 4f0bbc250f Update windows_cisco_secure_endpoint_related_service_stopped.yml Nasreddine Bencherchali 2025-02-19 20:32:52 +01:00
  • c47a2b85af Update windows_cisco_secure_endpoint_related_service_stopped.yml Nasreddine Bencherchali 2025-02-19 20:31:55 +01:00
  • e66e5e364c Update windows_compatibility_telemetry_tampering_through_registry.yml Steven Dick 2025-02-19 14:26:38 -05:00
  • 4d04bccb69 Update detections/endpoint/windows_compatibility_telemetry_tampering_through_registry.yml Steven Dick 2025-02-19 14:24:38 -05:00
  • 292fba5f7f Merge pull request #3347 from splunk/remove-uncomatible-ds Bhavin Patel 2025-02-19 11:17:51 -08:00
  • b68524f194 Merge branch 'develop' into remove-uncomatible-ds Bhavin Patel 2025-02-19 11:16:33 -08:00
  • 5182ac3282 Merge pull request #3298 from nterl0k/nterl0k-t1567-o365-sus-file-exfil Bhavin Patel 2025-02-19 11:10:14 -08:00
  • 7c402fab3d Merge branch 'develop' into nterl0k-t1567-o365-sus-file-exfil Bhavin Patel 2025-02-19 11:05:17 -08:00
  • b3c215afd5 Merge branch 'develop' into new-rules pyth0n1c 2025-02-19 10:47:03 -08:00
  • 11ca403c96 Merge pull request #3263 from zake1god/new-research-detection-endpoint Bhavin Patel 2025-02-19 10:44:44 -08:00
  • a7425f0d4f Update cisco_ai_defense_security_alerts.yml Bhavin Patel 2025-02-19 09:52:08 -08:00
  • 6f88528e28 Merge branch 'develop' into auditd_sourcetype_update auditd_sourcetype_update Bhavin Patel 2025-02-19 09:31:41 -08:00
  • f26afe837a Merge branch 'develop' into remove-uncomatible-ds Nasreddine Bencherchali 2025-02-19 17:47:57 +01:00
  • be9873d4a4 remove incompatible data sources Nasreddine Bencherchali 2025-02-19 17:46:22 +01:00
  • c919c43a3e Merge branch 'develop' into headless_bee Nasreddine Bencherchali 2025-02-19 17:40:37 +01:00
  • a75c0c67d8 Merge branch 'develop' into new-rules Nasreddine Bencherchali 2025-02-19 17:40:00 +01:00
  • 554d02d6b5 Merge branch 'develop' into new-research-detection-endpoint Nasreddine Bencherchali 2025-02-19 17:39:32 +01:00
  • dbede3bfec Merge pull request #3299 from splunk/tr-3997 Bhavin Patel 2025-02-19 08:31:27 -08:00
  • 3e93fb912d Merge branch 'develop' into new-research-detection-endpoint Nasreddine Bencherchali 2025-02-19 14:52:13 +01:00
  • de2162b94d update logic and analytic Nasreddine Bencherchali 2025-02-19 14:50:57 +01:00
  • 6a53921a8c Merge branch 'develop' into output_normalization_endpoint Patrick Bareiss 2025-02-19 12:09:16 +01:00
  • e0183d3cb0 output normalization endpoint Patrick Bareiss 2025-02-19 12:03:21 +01:00
  • 819fc49369 Merge branch 'develop' into new-rules Nasreddine Bencherchali 2025-02-19 11:30:21 +01:00
  • 659a9a8b32 remove overlapping tagging Nasreddine Bencherchali 2025-02-19 11:26:50 +01:00
  • 2ab27cd8c5 Update suspicious_event_log_service_behavior.yml Bhavin Patel 2025-02-05 14:16:15 -08:00
  • 6f1d3e6fa6 Create windows_audit_policy_disabled_via_legacy_auditpol.yml Nasreddine Bencherchali 2025-01-29 16:36:24 +01:00
  • ae708a0649 fix: rename analytic to comply with tests Nasreddine Bencherchali 2025-01-29 15:33:30 +01:00
  • d66f4e00d9 Update windows_audit_policy_auditing_option_modified__registry.yml Nasreddine Bencherchali 2025-01-29 15:31:45 +01:00
  • 4e22f53684 feat: add 2 additional analytics related to auditing option modification Nasreddine Bencherchali 2025-01-29 15:28:45 +01:00
  • c952f7b1a0 fix: remove unnecessary tests Nasreddine Bencherchali 2025-01-29 11:49:47 +01:00
  • 6b6d45831d Update windows_event_logging_service_has_shutdown.yml Nasreddine Bencherchali 2025-01-29 01:15:59 +01:00
  • 9925f0d78c Update windows_audit_policy_tampering.yml Nasreddine Bencherchali 2025-01-29 01:03:47 +01:00
  • abfbe7a3c7 Update windows_event_logging_service_has_shutdown.yml Nasreddine Bencherchali 2025-01-29 00:48:57 +01:00
  • 1dfb2597c2 fix: update titles Nasreddine Bencherchali 2025-01-29 00:42:05 +01:00
  • 805d75c84d fix: deprecate 2b85aa3d-f5f6-4c2e-a081-a09f6e1c2e40 Nasreddine Bencherchali 2025-01-29 00:34:42 +01:00
  • ba36467ece feat: add new analytic story and analytic Nasreddine Bencherchali 2025-01-29 00:34:19 +01:00
  • c16e7a1a74 feat: add auditpol macro Nasreddine Bencherchali 2025-01-29 00:32:59 +01:00
  • dba521c8e8 feat: add new auditpol related analytics Nasreddine Bencherchali 2025-01-29 00:32:42 +01:00
  • 7570a68a13 update logic to account for built-in sfc rare edge case Nasreddine Bencherchali 2025-02-19 11:15:07 +01:00
  • be4fcbe48c Merge branch 'develop' into susmailrule 0xC0FFEEEE 2025-02-19 08:05:08 +00:00
  • b4783e0319 remove enabled_by_default 0xC0FFEEEE 2025-02-19 07:52:12 +00:00
  • b9965782cc Updated TAs auto-ta-update-181 patel-bhavin 2025-02-19 06:58:19 +00:00
  • f8fc280263 Merge branch 'develop' into nterl0k-t1114-sus-o365-email-actions Bhavin Patel 2025-02-18 17:44:35 -08:00
  • c2eb1a26c9 Merge pull request #3321 from nterl0k/nterl0k-t1486-bitlocker-sus-commands Bhavin Patel 2025-02-18 17:43:17 -08:00
  • 50c22c96c5 Merge branch 'develop' into nterl0k-t1486-bitlocker-sus-commands Bhavin Patel 2025-02-18 17:27:06 -08:00
  • 52327020f9 Merge branch 'develop' into nterl0k-t1567-o365-sus-file-exfil Bhavin Patel 2025-02-18 17:09:15 -08:00
  • 59789ba890 Merge branch 'develop' into 8_million_requests Bhavin Patel 2025-02-18 17:03:37 -08:00
  • 7f64fe36d6 Merge branch 'develop' into auditd_sourcetype_update Bhavin Patel 2025-02-18 17:02:13 -08:00
  • e11b63161c Merge pull request #3344 from splunk/fix_dashboard_dropdown_match Bhavin Patel 2025-02-18 16:36:57 -08:00
  • 3782565aa6 Merge branch 'develop' into fix_dashboard_dropdown_match pyth0n1c 2025-02-18 16:30:45 -08:00
  • 87a2970ca9 Merge pull request #3341 from splunk/fix_datasource_typos pyth0n1c 2025-02-18 16:29:51 -08:00
  • 2ae421d724 Merge branch 'develop' into fix_datasource_typos pyth0n1c 2025-02-18 16:24:39 -08:00
  • 558f898df4 Merge branch 'develop' into nterl0k-t1567-o365-sus-file-exfil Bhavin Patel 2025-02-18 15:46:31 -08:00
  • a33eccd846 wrong space Bhavin Patel 2025-02-18 15:34:23 -08:00
  • 41f65e0bc7 change match to two underscroes pyth0n1c 2025-02-18 15:26:17 -08:00
  • d09f666e28 Merge branch 'develop' into 8_million_requests Bhavin Patel 2025-02-18 15:16:54 -08:00
  • a761716ac7 Merge branch 'develop' into auditd_sourcetype_update Bhavin Patel 2025-02-18 15:02:40 -08:00
  • c382e4147a Merge branch 'develop' into new-rules Nasreddine Bencherchali 2025-02-18 23:57:37 +01:00
  • f909be7cce updating sourcetype, version and date research-bot 2025-02-18 14:41:27 -08:00