Commit Graph

  • 0392bfe9c0 Update cisco_secure_application_alerts.yml Bhavin Patel 2025-02-13 11:48:16 -08:00
  • 690874895b Merge branch 'develop' into app_dynamics_alerts Bhavin Patel 2025-02-13 11:15:10 -08:00
  • bc334de270 Merge pull request #3283 from nterl0k/nterl0k-t1200-sysmon-usb-use-execution Bhavin Patel 2025-02-13 09:58:26 -08:00
  • 425daf1031 Merge branch 'develop' into nterl0k-t1200-sysmon-usb-use-execution Bhavin Patel 2025-02-13 09:26:11 -08:00
  • e9a9b6adea Merge pull request #3322 from nterl0k/nterl0k-rmm-lookup-update-20250210 Bhavin Patel 2025-02-13 09:01:31 -08:00
  • 39a5e611f4 Merge branch 'develop' into nterl0k-rmm-lookup-update-20250210 Bhavin Patel 2025-02-13 08:41:54 -08:00
  • e1b7aa4470 Merge branch 'develop' into nterl0k-t1200-sysmon-usb-use-execution Bhavin Patel 2025-02-13 08:24:33 -08:00
  • 0786bf242e Merge pull request #3331 from splunk/labeler-update Bhavin Patel 2025-02-13 08:23:41 -08:00
  • 057a3e4669 Add baselines to labeler ljstella 2025-02-13 09:26:43 -06:00
  • 831743d550 headless_bee tccontre 2025-02-13 14:06:29 +01:00
  • 59189f4945 headless_bee tccontre 2025-02-13 13:39:53 +01:00
  • fecfefee76 headless_bee tccontre 2025-02-13 13:12:40 +01:00
  • 2d336796fc headless_bee tccontre 2025-02-13 12:49:05 +01:00
  • bd04197010 headless_bee tccontre 2025-02-13 12:43:10 +01:00
  • 6f4026bc7d headless_bee tccontre 2025-02-13 12:41:02 +01:00
  • 07df5675dd headless_bee tccontre 2025-02-13 11:49:27 +01:00
  • 7ce610f1a4 headless_bee tccontre 2025-02-13 11:46:44 +01:00
  • d2c42356d8 Merge branch 'headless_bee' of github.com:splunk/security_content into headless_bee tccontre 2025-02-13 11:38:46 +01:00
  • 7a8678f19d headless_bee tccontre 2025-02-13 11:38:25 +01:00
  • f7ecf8da0a Merge branch 'develop' into headless_bee Br3akp0int 2025-02-13 11:34:37 +01:00
  • d7b400dcb0 headless_bee tccontre 2025-02-13 11:29:25 +01:00
  • 2e9d67042b Updated TAs auto-ta-update-175 patel-bhavin 2025-02-13 06:57:40 +00:00
  • e8c660f6a5 Merge pull request #3323 from splunk/remove_type_and_subtype Bhavin Patel 2025-02-12 16:12:42 -08:00
  • de03cdd631 Merge branch 'develop' into remove_type_and_subtype pyth0n1c 2025-02-12 16:09:20 -08:00
  • b968f68437 Merge branch 'develop' into nterl0k-t1200-sysmon-usb-use-execution Bhavin Patel 2025-02-12 16:05:31 -08:00
  • 02967574c4 Merge pull request #3329 from splunk/inspect_stacktype Bhavin Patel 2025-02-12 16:04:46 -08:00
  • 18fea98e80 Merge branch 'develop' into remove_type_and_subtype pyth0n1c 2025-02-12 16:04:25 -08:00
  • c124468ab7 Merge branch 'develop' into inspect_stacktype Bhavin Patel 2025-02-12 15:53:48 -08:00
  • 903bfe6de5 upating appinspect command research-bot 2025-02-12 15:41:03 -08:00
  • 74cc88f29a Merge branch 'develop' into nterl0k-rmm-lookup-update-20250210 Bhavin Patel 2025-02-12 15:36:34 -08:00
  • 172e1d5db5 first draft Jose Hernandez 2025-02-12 18:03:06 -05:00
  • 1d30f2f983 Merge branch 'develop' into nterl0k-t1200-sysmon-usb-use-execution Bhavin Patel 2025-02-12 12:42:45 -08:00
  • 3aef81e0e1 Merge pull request #3327 from splunk/slack_change Bhavin Patel 2025-02-12 12:41:32 -08:00
  • af6077f5f0 updating spl research-bot 2025-02-12 12:25:10 -08:00
  • c0a5ff84bd Merge branch 'develop' into slack_change Lou Stella 2025-02-12 12:33:14 -06:00
  • 529121c01d mend ljstella 2025-02-12 12:32:33 -06:00
  • 19242f51b9 Reword README ljstella 2025-02-12 12:31:34 -06:00
  • 0954e0c1a0 Slack link change ljstella 2025-02-12 12:08:17 -06:00
  • 370db3a337 Update and rename windows_detect_wpdbusenum_registry_key_modification.yml to windows_wpdbusenum_registry_key_modification.yml Steven Dick 2025-02-12 08:08:54 -05:00
  • 90865c04a3 Update and rename windows_detect_usbstor_registry_key_modification.yml to windows_usbstor_registry_key_modification.yml Steven Dick 2025-02-12 08:08:19 -05:00
  • 27c097d5de Update and rename windows_detect_process_executed_from_removable_media.yml to windows_process_executed_from_removable_media.yml Steven Dick 2025-02-12 08:07:45 -05:00
  • 68d85a24e6 Update windows_detect_process_executed_from_removable_media.yml Steven Dick 2025-02-12 08:03:17 -05:00
  • db1e11ae73 Merge branch 'develop' into headless_bee Br3akp0int 2025-02-12 10:25:58 +01:00
  • 2f02cb930f headless_bee tccontre 2025-02-12 10:21:24 +01:00
  • d0acc6c326 Updated TAs auto-ta-update-174 patel-bhavin 2025-02-12 06:57:44 +00:00
  • b9f5735bd3 Merge branch 'develop' into remove_type_and_subtype pyth0n1c 2025-02-11 15:38:08 -08:00
  • 5cabf43635 Merge pull request #3275 from splunk/rdp_brute Bhavin Patel 2025-02-11 10:27:04 -08:00
  • 471b49044f version Bhavin Patel 2025-02-11 10:05:52 -08:00
  • a7cc4a8602 Merge branch 'develop' into rdp_brute Bhavin Patel 2025-02-11 10:04:33 -08:00
  • 15d12b81ee Update detections/network/windows_remote_desktop_network_bruteforce_attempt.yml Bhavin Patel 2025-02-11 10:04:24 -08:00
  • 8e0c230a81 Update detections/deprecated/remote_desktop_network_bruteforce.yml Bhavin Patel 2025-02-11 10:03:58 -08:00
  • 59b99a0974 Merge pull request #3280 from nterl0k/nterl0k-t1114.003-o365-transport-rule-change Bhavin Patel 2025-02-11 08:59:31 -08:00
  • f3e0d875e0 Merge branch 'develop' into nterl0k-t1114.003-o365-transport-rule-change Bhavin Patel 2025-02-11 08:42:28 -08:00
  • 25af0925e6 rba message Bhavin Patel 2025-02-11 08:41:18 -08:00
  • 758d733c06 o365 detections output normalization Patrick Bareiss 2025-02-11 15:29:48 +01:00
  • ae9ab08eda Merge branch 'develop' into auto-ta-update-168 Lou Stella 2025-02-11 08:23:47 -06:00
  • a571f3d78a Updated TAs auto-ta-update-173 patel-bhavin 2025-02-11 06:57:59 +00:00
  • 56c4d19ea1 Merge pull request #3291 from splunk/analytics_enhancement Bhavin Patel 2025-02-10 14:22:26 -08:00
  • 0468dff0a3 Merge branch 'develop' into analytics_enhancement Bhavin Patel 2025-02-10 14:02:47 -08:00
  • 15ab58b798 updating descirption research-bot 2025-02-10 14:02:05 -08:00
  • 76ed6ac81c Update remote_access_software.csv Steven Dick 2025-02-10 16:12:12 -05:00
  • 45599e0b18 Clean up MITRE Tagging. When a type is defined, such as T1003, DO NOT allow a subtype such as T1003.001 to be defined. Remove the generic type T1003 and keep the subtype T1003.001. However, it is acceptable for a subtype to be defined or for a type to be defined separately. It is also okay for multiple subtypes to be defined. pyth0n1c 2025-02-10 12:28:22 -08:00
  • 93cf7893d5 Update and rename windows_bitLocker_suspicious_command_usage.yml to windows_bitlocker_suspicious_command_usage.yml Steven Dick 2025-02-10 11:18:07 -05:00
  • 2ccd4cd0e5 move where it goes dummy Steven Dick 2025-02-10 11:14:52 -05:00
  • b60408eeba Update remote_access_software.yml Steven Dick 2025-02-10 11:06:56 -05:00
  • c79216ba57 Update remote_access_software.csv Steven Dick 2025-02-10 11:05:33 -05:00
  • 83a9bf0150 Add files via upload Steven Dick 2025-02-10 10:59:11 -05:00
  • b09110908d analytics_enhancement tccontre 2025-02-10 09:43:20 +01:00
  • 51ae906f15 analytics_enhancement tccontre 2025-02-10 09:39:53 +01:00
  • 67844bec4e analytics_enhancement tccontre 2025-02-10 09:36:32 +01:00
  • f7673585b5 Updated TAs auto-ta-update-172 patel-bhavin 2025-02-10 06:57:48 +00:00
  • de00c7322c Updated TAs auto-ta-update-171 patel-bhavin 2025-02-09 06:57:53 +00:00
  • 6a0ba75fed Updated TAs auto-ta-update-170 patel-bhavin 2025-02-08 06:57:37 +00:00
  • 1946c4eeae Update windows_service_created_with_suspicious_service_name.yml Steven Dick 2025-02-07 14:45:27 -05:00
  • 658c2e6a5e Update windows_service_created_with_suspicious_service_name.yml Steven Dick 2025-02-07 14:42:13 -05:00
  • e0bb7ec748 Update windows_suspicious_services.csv Steven Dick 2025-02-07 14:39:17 -05:00
  • 71f1b53016 Update windows_suspicious_services.csv Steven Dick 2025-02-07 14:38:57 -05:00
  • d82968a9ef Add files via upload Steven Dick 2025-02-07 14:27:33 -05:00
  • 80fee4b9b9 Add files via upload Steven Dick 2025-02-07 14:26:58 -05:00
  • 6fc70aa599 version bump research-bot 2025-02-07 11:13:01 -08:00
  • 1ee29f034a Merge branch 'develop' into data_source_improvements_2 research-bot 2025-02-07 11:05:38 -08:00
  • b007e91c6e Update winevent_scheduled_task_with_suspicious_command.yml Steven Dick 2025-02-07 14:01:48 -05:00
  • 70f0d68506 Update winevent_scheduled_task_with_suspicious_name.yml Steven Dick 2025-02-07 14:01:13 -05:00
  • bb6cd1f747 Add files via upload Steven Dick 2025-02-07 13:36:09 -05:00
  • b185a3c1a9 Add files via upload Steven Dick 2025-02-07 13:34:34 -05:00
  • 9dc252d5bb Merge pull request #3272 from nterl0k/nterl0k-t1213.002-sus-sharepoint-search Bhavin Patel 2025-02-07 10:32:38 -08:00
  • 5ee9bf7d69 Merge branch 'develop' into nterl0k-t1213.002-sus-sharepoint-search Bhavin Patel 2025-02-07 10:16:55 -08:00
  • e0d36949fc Merge branch 'develop' into data_source_improvements_2 Patrick Bareiss 2025-02-07 13:31:21 +01:00
  • 6c33dd0f6c headless_bee tccontre 2025-02-07 11:06:55 +01:00
  • 1ed454b5bc analytics_enhancement tccontre 2025-02-07 09:56:32 +01:00
  • 153871c33f analytics_enhancement tccontre 2025-02-07 09:53:03 +01:00
  • f33a18e9cf analytics_enhancement tccontre 2025-02-07 09:49:06 +01:00
  • d7494fb865 Azure AD detection output normalization Patrick Bareiss 2025-02-07 09:04:17 +01:00
  • 5b50fd8741 Merge branch 'develop' into output_normalization_azure_ad Patrick Bareiss 2025-02-07 08:45:05 +01:00
  • 869d5eeff0 data source output normalization Patrick Bareiss 2025-02-07 08:44:39 +01:00
  • f33c280007 Updated TAs auto-ta-update-169 patel-bhavin 2025-02-07 06:57:58 +00:00
  • 3eaad9a5cd Merge pull request #3312 from nterl0k/nterl0k-rmm-story-update-1 Bhavin Patel 2025-02-06 12:51:34 -08:00
  • abd24d63bc Update windows_security_and_backup_services_stop.yml Br3akp0int 2025-02-06 18:59:01 +01:00
  • 636e63d492 Update windows_driver_load_non_standard_path.yml Br3akp0int 2025-02-06 17:42:14 +01:00
  • f97787306f Update suspicious_driver_loaded_path.yml Br3akp0int 2025-02-06 17:02:59 +01:00