Commit Graph

  • 31621ad399 Add files via upload Steven Dick 2025-01-08 14:57:50 -05:00
  • c591ef5ff7 Adding back two containers ljstella 2025-01-08 12:45:30 -06:00
  • a9129bf5e3 Testing single container ljstella 2025-01-08 12:40:39 -06:00
  • 4c65798689 Merge branch 'develop' into nterl0k-t1219-rmm-update-2 Bhavin Patel 2025-01-08 10:22:03 -08:00
  • 557fdeca89 Add manual_test flag Bhavin Patel 2025-01-08 10:21:40 -08:00
  • d883b5170a Branch was auto-updated. Bhavin Patel 2025-01-08 10:12:00 -08:00
  • 0e6251e06a Branch was auto-updated. Bhavin Patel 2025-01-08 10:11:59 -08:00
  • 0349709a56 Branch was auto-updated. Bhavin Patel 2025-01-08 10:11:57 -08:00
  • 4ed661ab65 Branch was auto-updated. Bhavin Patel 2025-01-08 10:11:54 -08:00
  • 62e5a6083f Branch was auto-updated. Bhavin Patel 2025-01-08 10:11:53 -08:00
  • c90858719d Branch was auto-updated. Bhavin Patel 2025-01-08 10:11:52 -08:00
  • 607494bfb8 Branch was auto-updated. Bhavin Patel 2025-01-08 10:11:52 -08:00
  • be3ab3c6ed Merge pull request #3255 from nterl0k/nterl0k-T1550-netexec-usage Bhavin Patel 2025-01-08 10:11:36 -08:00
  • 5e58179a00 file name update Bhavin Patel 2025-01-08 10:09:48 -08:00
  • dc3fdda537 new detection Patrick Bareiss 2025-01-08 17:05:24 +01:00
  • a8c3540aa8 typo fixes and some logic update Nasreddine Bencherchali 2025-01-08 14:46:37 +01:00
  • 197881f7fa bug fix Patrick Bareiss 2025-01-08 14:32:56 +01:00
  • 51ba4b9394 Update o365_excessive_os_vendors_authenticating_from_user.yml Steven Dick 2025-01-08 08:26:05 -05:00
  • 56f36dbbc7 Update o365_excessive_os_vendors_authenticating_from_user.yml Steven Dick 2025-01-08 08:21:49 -05:00
  • 104e187eb1 Update windows_system_remote_discovery_with_query.yml Steven Dick 2025-01-08 08:18:26 -05:00
  • 186061fa94 new detection Patrick Bareiss 2025-01-08 13:53:03 +01:00
  • 1e781875ac crypto_campaign tccontre 2025-01-08 11:12:15 +01:00
  • 4f75199c09 crypto_campaign tccontre 2025-01-08 10:58:40 +01:00
  • 7a46c66392 crypto_campaign tccontre 2025-01-08 10:41:44 +01:00
  • 185a5b8a10 crypto_campaign tccontre 2025-01-08 10:32:39 +01:00
  • 9153947933 crypto_campaign tccontre 2025-01-08 10:12:01 +01:00
  • 7c7904265a Updated TAs patel-bhavin 2025-01-08 06:58:09 +00:00
  • 3d8919f1c6 reverting macro change dluxtron 2025-01-08 15:11:19 +10:00
  • b97cf5714e udpating SPL research-bot 2025-01-07 13:14:24 -08:00
  • 07ec401653 Update o365_excessive_os_vendors_authenticating_from_user.yml Steven Dick 2025-01-07 16:02:16 -05:00
  • a5b77ca3a5 Update windows_system_remote_discovery_with_query.yml Steven Dick 2025-01-07 15:58:11 -05:00
  • 88ca4c4f07 Apply suggestions from code review Steven Dick 2025-01-07 15:54:22 -05:00
  • 24aae81793 Update detections/endpoint/windows_system_remote_discovery_with_query.yml Steven Dick 2025-01-07 15:53:10 -05:00
  • ec2cd5dd80 Update detections/endpoint/windows_system_remote_discovery_with_query.yml Steven Dick 2025-01-07 15:52:52 -05:00
  • 50fd37accd Update windows_process_with_netexec_command_line_parameters.yml Steven Dick 2025-01-07 15:49:16 -05:00
  • 2627b4bea5 Update detect_remote_access_software_usage_registry.yml Steven Dick 2025-01-07 15:39:12 -05:00
  • b039994bae Update telegram_detected_access_suspicious_api_url.yml zake 2025-01-08 03:18:55 +07:00
  • e66bb09cf4 updating macro research-bot 2025-01-07 12:15:23 -08:00
  • c4d5915f22 updating risk research-bot 2025-01-07 12:14:10 -08:00
  • 4ef0485a33 Update telegram_detected_access_suspicious_api_url.yml zake 2025-01-08 03:13:50 +07:00
  • 602f4da978 Update telegram_detected_access_suspicious_api_url.yml zake 2025-01-08 03:11:09 +07:00
  • 5f473664d5 Update telegram_detected_access_suspicious_api_url.yml zake 2025-01-08 03:10:08 +07:00
  • fa6f09b059 fixing up yamls for testing research-bot 2025-01-07 11:58:59 -08:00
  • e8f9c1ddd0 Merge branch 'develop' into nterl0k-T1550-netexec-usage Nasreddine Bencherchali 2025-01-07 17:45:50 +01:00
  • 662b542299 Apply suggestions from code review Nasreddine Bencherchali 2025-01-07 17:44:25 +01:00
  • 18cf044020 Merge branch 'develop' into nterl0k-t1033-query-remote-usage Nasreddine Bencherchali 2025-01-07 17:36:55 +01:00
  • f49899a983 Merge branch 'develop' into rba_migration Lou Stella 2025-01-07 09:47:21 -06:00
  • 9fb7b90549 Stragglers migration ljstella 2025-01-07 09:45:30 -06:00
  • 0a1c14df72 fixing syntax & updating macro dluxtron 2025-01-07 16:51:06 +10:00
  • b33f7b034c Adding intune detections & updating dataset links dluxtron 2025-01-07 15:47:35 +10:00
  • 263db16960 author update Bhavin Patel 2025-01-06 14:42:03 -08:00
  • 35368173c0 observable type Bhavin Patel 2025-01-06 14:41:11 -08:00
  • 736bcb3660 Merge branch 'develop' into nterl0k-t1219-rmm-update-2 Bhavin Patel 2025-01-06 14:31:00 -08:00
  • 36a79d6b99 Update detect_remote_access_software_usage_registry.yml Steven Dick 2025-01-06 17:21:02 -05:00
  • ff408f240c Update detect_remote_access_software_usage_registry.yml Steven Dick 2025-01-06 17:19:33 -05:00
  • 4f8f4efb5e Branch was auto-updated. Bhavin Patel 2025-01-06 13:30:36 -08:00
  • 8e3c001b8b Branch was auto-updated. Bhavin Patel 2025-01-06 13:30:35 -08:00
  • 899e0f4178 Branch was auto-updated. Bhavin Patel 2025-01-06 13:30:34 -08:00
  • 8ed6caebac Branch was auto-updated. Bhavin Patel 2025-01-06 13:30:33 -08:00
  • d69dcf35a4 Merge pull request #3253 from nterl0k/nterl0k-t1595-generic-scanner Bhavin Patel 2025-01-06 13:30:17 -08:00
  • 70f1a691fb Merge branch 'develop' into nterl0k-t1595-generic-scanner Bhavin Patel 2025-01-06 13:02:19 -08:00
  • 09cb36056e Branch was auto-updated. Bhavin Patel 2025-01-06 12:29:56 -08:00
  • f1b4d1b21b Branch was auto-updated. Bhavin Patel 2025-01-06 12:29:55 -08:00
  • 3579b63a20 Branch was auto-updated. Bhavin Patel 2025-01-06 12:29:54 -08:00
  • 3024606391 Branch was auto-updated. Bhavin Patel 2025-01-06 12:29:52 -08:00
  • f285ed257f Merge pull request #3249 from splunk/web_xchange_shell Bhavin Patel 2025-01-06 12:29:37 -08:00
  • 6370f62c03 Initial upload Steven Dick 2025-01-06 13:55:15 -05:00
  • ff4a48009f Add files via upload Steven Dick 2025-01-06 11:08:54 -05:00
  • c1d7d2cc75 Update windows_process_with_netexec_command_line_parameters.yml Steven Dick 2025-01-06 11:01:24 -05:00
  • f1fca81df6 Merge branch 'develop' into nterl0k-t1595-generic-scanner Lou Stella 2025-01-06 09:04:07 -06:00
  • cba33c32df Uploading new detections dluxtron 2025-01-06 16:35:41 +10:00
  • 0454541c41 Uploading new detections dluxtron 2025-01-06 16:19:32 +10:00
  • d7629feab8 Merge branch 'develop' into new-research-detection-endpoint zake 2025-01-04 11:21:35 +07:00
  • 3b8e769213 progress on input/output lookup cleanup after new validations introduced pyth0n1c 2025-01-03 16:35:39 -08:00
  • fdaa038eab Finish removing extra fields, or renaming misnamed fields, in endpoint detections pyth0n1c 2025-01-03 15:47:32 -08:00
  • d1442c2805 remove update_timestamps, confidence, impact, related_fields, and risk_score from detections pyth0n1c 2025-01-03 15:25:52 -08:00
  • aae586aaa4 Branch was auto-updated. Bhavin Patel 2025-01-03 15:11:34 -08:00
  • acbe468f81 Branch was auto-updated. Bhavin Patel 2025-01-03 15:11:33 -08:00
  • 00b1344f3b Branch was auto-updated. Bhavin Patel 2025-01-03 15:11:32 -08:00
  • 7100a2430e Branch was auto-updated. Bhavin Patel 2025-01-03 15:11:31 -08:00
  • 75af1eaca4 Branch was auto-updated. Bhavin Patel 2025-01-03 15:11:30 -08:00
  • 6adf586d51 Merge pull request #3262 from splunk/auto-ta-update-133 Lou Stella 2025-01-03 17:11:13 -06:00
  • 0706bfd139 Merge branch 'rba_migration' into strict_yml_from_rba pyth0n1c 2025-01-03 14:06:33 -08:00
  • 8b4ca42df0 remove collection for all kvstores. this will just come from the name. also ensure the each kvstore begins with _key. pyth0n1c 2025-01-03 13:58:18 -08:00
  • 83b3111dab Pin container to 9.3 ljstella 2025-01-03 14:39:59 -06:00
  • 8fe3875385 Branch was auto-updated. Bhavin Patel 2025-01-03 11:56:56 -08:00
  • 78343c069b Branch was auto-updated. Bhavin Patel 2025-01-03 11:56:55 -08:00
  • 6987fdc2fa Branch was auto-updated. Bhavin Patel 2025-01-03 11:56:54 -08:00
  • f5751ef693 Branch was auto-updated. Bhavin Patel 2025-01-03 11:56:53 -08:00
  • 9c8a0198b9 Branch was auto-updated. Bhavin Patel 2025-01-03 11:56:53 -08:00
  • 5f771b6445 Branch was auto-updated. Bhavin Patel 2025-01-03 11:56:50 -08:00
  • 1ae042b1d3 Merge pull request #3247 from splunk/issue_3245 Bhavin Patel 2025-01-03 11:56:36 -08:00
  • 9ee8526d74 update mitre Bhavin Patel 2025-01-03 11:54:54 -08:00
  • 39842b9ed9 build error fixes Bhavin Patel 2025-01-03 11:50:49 -08:00
  • a0e6f0fa7b minor update to data_source Bhavin Patel 2025-01-03 11:38:15 -08:00
  • c1b0b646de remove extra fields from baselines and investigations pyth0n1c 2025-01-03 11:37:10 -08:00
  • 79f11c342f removes types from stories pyth0n1c 2025-01-03 11:24:07 -08:00
  • f4b67704be finish lookup cleanup pyth0n1c 2025-01-03 11:05:52 -08:00
  • 29b2332652 more cleanup of lookups to follow new format. this involved renaming some CSVs to remove the dates from them or force their naming schema to match the corresponding YML name for CSV detections pyth0n1c 2025-01-03 10:27:49 -08:00
  • 4e0f2acbba Updated TAs auto-ta-update-134 patel-bhavin 2025-01-03 06:57:53 +00:00