Commit Graph

  • 67adb94485 Update o365_email_send_attachments_excessive_volume.yml Steven Dick 2025-01-31 19:57:12 -05:00
  • 1c92567b17 Update o365_email_send_attachments_excessive_volume.yml Steven Dick 2025-01-31 19:51:39 -05:00
  • 02c5a24100 Update o365_email_transport_rule_changed.yml Steven Dick 2025-01-31 19:45:28 -05:00
  • 1701666ecc Update o365_email_send_and_hard_delete_suspicious_behavior.yml Steven Dick 2025-01-31 19:35:07 -05:00
  • 62273d573f Update o365_email_send_and_hard_delete_exfiltration_behavior.yml Steven Dick 2025-01-31 19:34:40 -05:00
  • dd8c9d991a Update o365_email_receive_and_hard_delete_takeover_behavior.yml Steven Dick 2025-01-31 19:34:18 -05:00
  • 1899156ae8 Update o365_email_send_attachments_excessive_volume.yml Steven Dick 2025-01-31 19:33:15 -05:00
  • cbb25155ab Update o365_email_send_and_hard_delete_exfiltration_behavior.yml Steven Dick 2025-01-31 19:31:31 -05:00
  • 49342b4094 Update o365_email_send_attachments_excessive_volume.yml Steven Dick 2025-01-31 19:28:06 -05:00
  • cc6443da9a Update o365_email_send_and_hard_delete_suspicious_behavior.yml Steven Dick 2025-01-31 19:27:39 -05:00
  • 0c80eff121 Update o365_email_send_and_hard_delete_exfiltration_behavior.yml Steven Dick 2025-01-31 19:27:18 -05:00
  • 81179ad574 Update o365_email_receive_and_hard_delete_takeover_behavior.yml Steven Dick 2025-01-31 19:26:47 -05:00
  • c94fe18c37 Update o365_email_password_and_payroll_compromise_behavior.yml Steven Dick 2025-01-31 19:26:15 -05:00
  • 663caa6ca2 Update o365_email_new_inbox_rule_created.yml Steven Dick 2025-01-31 19:25:22 -05:00
  • c900f262a1 Update o365_email_hard_delete_excessive_volume.yml Steven Dick 2025-01-31 19:24:57 -05:00
  • b1faa96a2f Merge branch 'deprecated_mapping' of https://github.com/splunk/security_content into deprecated_mapping pyth0n1c 2025-01-31 16:18:17 -08:00
  • 23211045ed Update o365_email_receive_and_hard_delete_takeover_behavior.yml Steven Dick 2025-01-31 19:18:14 -05:00
  • 14a41db645 Update o365_email_password_and_payroll_compromise_behavior.yml Steven Dick 2025-01-31 19:17:39 -05:00
  • 902bea9314 Update o365_email_new_inbox_rule_created.yml Steven Dick 2025-01-31 19:17:15 -05:00
  • 184c5b599c Update o365_email_send_attachments_excessive_volume.yml Steven Dick 2025-01-31 19:16:44 -05:00
  • 55f8c62037 Update o365_email_send_and_hard_delete_suspicious_behavior.yml Steven Dick 2025-01-31 19:14:54 -05:00
  • 729b47b8a7 Update o365_email_send_and_hard_delete_exfiltration_behavior.yml Steven Dick 2025-01-31 19:13:48 -05:00
  • 3181840600 Update o365_email_new_inbox_rule_created.yml Steven Dick 2025-01-31 19:12:42 -05:00
  • 90e8edf83f Update o365_email_hard_delete_excessive_volume.yml Steven Dick 2025-01-31 19:11:37 -05:00
  • 0db344513f add deprecation info into the detections themselves pyth0n1c 2025-01-31 16:00:48 -08:00
  • be839735e8 Merge branch 'develop' into deprecated_mapping pyth0n1c 2025-01-31 15:46:02 -08:00
  • 8cc8402c0a Merge branch 'develop' into nterl0k-t1567-o365-sus-file-exfil Bhavin Patel 2025-01-31 13:19:12 -08:00
  • 2d09f571ba Update o365_email_hard_delete_excessive_volume.yml Steven Dick 2025-01-31 15:27:08 -05:00
  • d82a5bde87 Update o365_email_send_attachments_excessive_volume.yml Steven Dick 2025-01-31 15:24:11 -05:00
  • 77a4406dd9 Update o365_email_send_and_hard_delete_suspicious_behavior.yml Steven Dick 2025-01-31 15:22:42 -05:00
  • 4f8d3afec7 Update o365_email_send_and_hard_delete_exfiltration_behavior.yml Steven Dick 2025-01-31 15:21:33 -05:00
  • e80959df59 Update o365_email_new_inbox_rule_created.yml Steven Dick 2025-01-31 15:18:21 -05:00
  • e43b248cde Update o365_email_hard_delete_excessive_volume.yml Steven Dick 2025-01-31 15:15:55 -05:00
  • 977c6785ae Update o365_email_transport_rule_changed.yml Steven Dick 2025-01-31 15:01:55 -05:00
  • ffc64431b7 Update o365_email_transport_rule_changed.yml Steven Dick 2025-01-31 14:58:01 -05:00
  • f08def5b08 Merge pull request #3304 from splunk/auto-ta-update-162 Lou Stella 2025-01-31 13:16:35 -06:00
  • 4bd74d8606 Update o365_email_transport_rule_changed.yml Steven Dick 2025-01-31 12:08:20 -05:00
  • 3175bad685 Update windows_detect_wpdbusenum_registry_key_modification.yml Steven Dick 2025-01-31 12:02:59 -05:00
  • 3f78124ad0 Update windows_detect_usbstor_registry_key_modification.yml Steven Dick 2025-01-31 12:01:19 -05:00
  • 7d84fa2fcb Update windows_detect_process_executed_from_removable_media.yml Steven Dick 2025-01-31 11:59:24 -05:00
  • ef906974fd Update o365_email_send_attachments_excessive_volume.yml Steven Dick 2025-01-31 09:23:41 -05:00
  • fcca572681 Update o365_email_send_and_hard_delete_suspicious_behavior.yml Steven Dick 2025-01-31 09:21:53 -05:00
  • 518a7b8aea Update o365_email_send_and_hard_delete_exfiltration_behavior.yml Steven Dick 2025-01-31 09:19:48 -05:00
  • ae0ed6024e Update o365_email_receive_and_hard_delete_takeover_behavior.yml Steven Dick 2025-01-31 09:13:00 -05:00
  • f2218b3065 Update o365_email_password_and_payroll_compromise_behavior.yml Steven Dick 2025-01-31 09:05:45 -05:00
  • 4f52d3b01e Update o365_email_new_inbox_rule_created.yml Steven Dick 2025-01-31 08:59:58 -05:00
  • f91a3cc925 Update o365_email_hard_delete_excessive_volume.yml Steven Dick 2025-01-31 08:53:35 -05:00
  • ae1b755f2f Update o365_exfiltration_via_file_sync_download.yml Steven Dick 2025-01-31 08:51:10 -05:00
  • 0e8ac8a29d Update o365_exfiltration_via_file_download.yml Steven Dick 2025-01-31 08:50:45 -05:00
  • 842ee12115 Update o365_exfiltration_via_file_access.yml Steven Dick 2025-01-31 08:50:31 -05:00
  • a136609516 Update o365_exfiltration_via_file_sync_download.yml Steven Dick 2025-01-31 08:48:07 -05:00
  • 38c3f574a7 Update o365_exfiltration_via_file_download.yml Steven Dick 2025-01-31 08:47:03 -05:00
  • 7a00c05673 Update o365_exfiltration_via_file_access.yml Steven Dick 2025-01-31 08:45:35 -05:00
  • a96137fe35 Update windows_powershell_script_block_with_malicious_string.yml Steven Dick 2025-01-31 08:30:31 -05:00
  • 1b5b3ac3fa Update windows_powershell_process_with_malicious_string.yml Steven Dick 2025-01-31 08:29:53 -05:00
  • 9d1b5b0bf4 Update windows_powershell_script_block_with_malicious_string.yml Steven Dick 2025-01-31 08:26:12 -05:00
  • c612c9a7a1 Update windows_powershell_process_with_malicious_string.yml Steven Dick 2025-01-31 08:24:01 -05:00
  • 7712f517fd Update malicious_powershell_strings.yml Steven Dick 2025-01-31 08:16:31 -05:00
  • 3f442ade67 Update and rename malicious_powershell_strings_20250113.csv to malicious_powershell_strings.csv Steven Dick 2025-01-31 08:13:56 -05:00
  • 423f2f3a29 Update malicious_powershell_strings.yml Steven Dick 2025-01-31 08:13:36 -05:00
  • ea6f9005d0 Update malicious_powershell_strings.yml Steven Dick 2025-01-31 08:05:25 -05:00
  • c9000cce28 Update malicious_powershell_strings_20250113.csv Steven Dick 2025-01-31 08:02:07 -05:00
  • 9448d2eff7 Update malicious_powershell_strings_20250113.csv Steven Dick 2025-01-31 08:00:13 -05:00
  • 500d3f05f1 Update malicious_powershell_strings_20250113.csv Steven Dick 2025-01-31 07:58:30 -05:00
  • 81e2d0ce3c Update lookups/malicious_powershell_strings.yml Steven Dick 2025-01-31 07:29:21 -05:00
  • 163c84013b Update security_services_lookup.yml Nasreddine Bencherchali 2025-01-31 12:22:29 +01:00
  • cc90411ace Updated TAs patel-bhavin 2025-01-31 06:57:58 +00:00
  • 6d07ef85f5 update: lookups with additional data Nasreddine Bencherchali 2025-01-30 20:33:48 +01:00
  • a6c06d03c5 update: windows event log macros Nasreddine Bencherchali 2025-01-30 20:32:27 +01:00
  • 7712cd9df9 Merge pull request #3302 from splunk/playbook_fix v5.0.0 Bhavin Patel 2025-01-30 09:02:12 -08:00
  • 7d265c8efa Renaming file again, maybe this won't break ljstella 2025-01-30 09:15:53 -06:00
  • 41eb861904 Renaming again for a new reason ljstella 2025-01-30 09:04:37 -06:00
  • 857590e1f0 Renamed files and updated playbook field so site functions ljstella 2025-01-30 08:57:48 -06:00
  • d163881252 output normalization for AWS cloudtrail logs Patrick Bareiss 2025-01-30 14:01:28 +01:00
  • f7565834e9 analytics_enhancement tccontre 2025-01-30 10:53:52 +01:00
  • c50dbd4b46 Merge branch 'develop' into new-rules Nasreddine Bencherchali 2025-01-29 12:29:03 +01:00
  • 86fcf40b2e Update windows_cisco_secure_endpoint_related_service_stopped.yml Nasreddine Bencherchali 2025-01-29 12:08:03 +01:00
  • 73163148f6 Merge pull request #3300 from splunk/5.0_fixes Nasreddine Bencherchali 2025-01-29 11:04:04 +01:00
  • bd608b061f Update windows_sensitive_registry_hive_dump_via_commandline.yml Bhavin Patel 2025-01-28 18:24:23 -08:00
  • 1a16ff5f29 remove falcon data research-bot 2025-01-28 18:12:48 -08:00
  • 18a70bf7b8 Update windows_cisco_secure_endpoint_related_service_stopped.yml Nasreddine Bencherchali 2025-01-29 01:29:55 +01:00
  • 9f6736a672 Update security_solution_tampering.yml Nasreddine Bencherchali 2025-01-29 01:22:48 +01:00
  • 7db799854b Merge branch 'develop' into new-rules Nasreddine Bencherchali 2025-01-29 01:04:13 +01:00
  • be99b0ff83 fix: add missing rba object Nasreddine Bencherchali 2025-01-29 01:01:32 +01:00
  • bef252afde Update o365_exfiltration_via_file_sync_download.yml Steven Dick 2025-01-28 16:03:29 -05:00
  • 2f99dd1121 Update o365_exfiltration_via_file_download.yml Steven Dick 2025-01-28 16:03:10 -05:00
  • 2fdbb800e2 Update o365_exfiltration_via_file_access.yml Steven Dick 2025-01-28 16:02:55 -05:00
  • 039ef36865 Update o365_exfiltration_via_file_access.yml Steven Dick 2025-01-28 15:59:01 -05:00
  • 8297766f25 Update o365_exfiltration_via_file_download.yml Steven Dick 2025-01-28 15:58:44 -05:00
  • e29b0b3f01 Update o365_exfiltration_via_file_sync_download.yml Steven Dick 2025-01-28 15:58:20 -05:00
  • f74a15dcd7 Add files via upload Steven Dick 2025-01-28 15:51:23 -05:00
  • f2247bc251 adding a file research-bot 2025-01-28 10:42:27 -08:00
  • 884ba1412b adding a mapping yaml research-bot 2025-01-28 10:42:10 -08:00
  • ed605383ca Merge pull request #3284 from tapishj-splunk/talos Lou Stella 2025-01-28 12:02:37 -06:00
  • 4e88794a21 Adding d3fend technique tag ljstella 2025-01-28 11:40:33 -06:00
  • a143d1daee Merge branch 'develop' into talos Lou Stella 2025-01-28 11:36:00 -06:00
  • 3a034ddca6 Merge pull request #3296 from splunk/updated_nexus_activity Bhavin Patel 2025-01-28 08:33:17 -08:00
  • 8835efdbb4 adding status research-bot 2025-01-27 19:15:49 -08:00
  • bfac0b364b Merge branch 'develop' into updated_nexus_activity Bhavin Patel 2025-01-27 15:21:25 -08:00
  • 8b0413c669 Merge pull request #3295 from splunk/final_deprecation_changes Bhavin Patel 2025-01-27 14:47:02 -08:00