Commit Graph

  • 5921fc0679 fix Michael Haag 2023-10-01 10:25:32 -06:00
  • 63c248fe02 Update ws_ftp_remote_code_execution.yml Michael Haag 2023-10-01 10:23:12 -06:00
  • 85ec2974bb Create ws_ftp_remote_code_execution.yml Michael Haag 2023-10-01 10:18:46 -06:00
  • a3d1907490 fixes Michael Haag 2023-10-01 09:42:31 -06:00
  • 17ca5971d3 WS_FTP Michael Haag 2023-10-01 09:39:59 -06:00
  • 9b6c459a09 Branch was auto-updated. srv-rr-gh-researchbt 2023-09-29 15:21:20 -07:00
  • 24b8573f65 Merge pull request #2859 from splunk/obs_fix_25 Bhavin Patel 2023-09-29 15:21:01 -07:00
  • 31bc1a0820 Minor search fixes for observables pyth0n1c 2023-09-29 14:17:05 -07:00
  • 56abb40647 More observable fixes, including renaming fields in searchers. pyth0n1c 2023-09-29 13:19:47 -07:00
  • 64096b6e44 Edit parsing Gowthamaraj rajendran 2023-09-29 12:11:01 -07:00
  • 8cd1076f87 Update 50 detections Gowthamaraj rajendran 2023-09-29 11:57:39 -07:00
  • 54ce1f7f1d Merge branch 'release_v4.13.0' into obs_fix_25 Bhavin Patel 2023-09-28 17:47:52 -07:00
  • e38e0bacc3 Branch was auto-updated. srv-rr-gh-researchbt 2023-09-28 16:41:10 -07:00
  • 3d3631fba9 Merge pull request #2855 from splunk/sysmon_fix Bhavin Patel 2023-09-28 16:40:50 -07:00
  • f6dc49e1d3 add another filter so that we do not flag scripts running out of c: pyth0n1c 2023-09-28 16:18:50 -07:00
  • 732aec3f95 Delete detection and migrate logic and documentation to risky command lookup file. Update macro to point to new risky command csv. Fiox some opservables. pyth0n1c 2023-09-28 14:51:28 -07:00
  • f76dfe4277 Minor updates to improve notables and result rendering. pyth0n1c 2023-09-28 13:37:36 -07:00
  • 1813ce39ac Merge branch 'release_v4.13.0' into sysmon_fix sysmon_fix Bhavin Patel 2023-09-28 12:38:50 -07:00
  • f11bec3047 Branch was auto-updated. srv-rr-gh-researchbt 2023-09-28 12:27:36 -07:00
  • 83a2a59b34 Merge pull request #2858 from splunk/obs_fix_64 Bhavin Patel 2023-09-28 12:26:59 -07:00
  • e5a814e78e remove script block from message Bhavin Patel 2023-09-28 11:12:02 -07:00
  • 2270cac53c Update get_aduser_with_powershell_script_block.yml Bhavin Patel 2023-09-28 11:09:47 -07:00
  • 5bdfd1f170 Update get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml Bhavin Patel 2023-09-28 11:08:30 -07:00
  • 0d16ea4d80 Update adsisearcher_account_discovery.yml Bhavin Patel 2023-09-28 11:07:57 -07:00
  • 4ba5bcb670 Update windows_vulnerable_3cx_software.yml Bhavin Patel 2023-09-28 10:58:04 -07:00
  • f8988b7d80 Update cobalt_strike_named_pipes.yml Bhavin Patel 2023-09-28 10:53:01 -07:00
  • 92a6c6f694 Update dump_lsass_via_procdump_rename.yml Bhavin Patel 2023-09-28 10:52:21 -07:00
  • c8e0b96f46 Branch was auto-updated. srv-rr-gh-researchbt 2023-09-28 09:47:39 -07:00
  • 0a5302a7bb Branch was auto-updated. srv-rr-gh-researchbt 2023-09-28 09:47:38 -07:00
  • d57ee81d1d Branch was auto-updated. srv-rr-gh-researchbt 2023-09-28 09:47:36 -07:00
  • 31dda2ee54 Merge pull request #2853 from splunk/njrat2 Bhavin Patel 2023-09-28 09:47:16 -07:00
  • 631ecd4122 updating sutffff Bhavin Patel 2023-09-27 15:51:03 -07:00
  • 0bde5c7afe Update windows_modify_registry_with_md5_reg_key_name.yml Bhavin Patel 2023-09-27 15:40:05 -07:00
  • c5e942e24a Update windows_disable_or_modify_tools_via_taskkill.yml Bhavin Patel 2023-09-27 15:38:24 -07:00
  • d0e387f41a Update windows_delete_or_modify_system_firewall.yml Bhavin Patel 2023-09-27 15:37:28 -07:00
  • 527a954099 Branch was auto-updated. srv-rr-gh-researchbt 2023-09-27 15:21:04 -07:00
  • b6b1fb16ee Branch was auto-updated. srv-rr-gh-researchbt 2023-09-27 15:21:03 -07:00
  • 434eb600d1 Branch was auto-updated. srv-rr-gh-researchbt 2023-09-27 15:21:02 -07:00
  • 8341c2dcc1 Branch was auto-updated. srv-rr-gh-researchbt 2023-09-27 15:21:01 -07:00
  • fefee99f51 Merge pull request #2849 from splunk/njrat Bhavin Patel 2023-09-27 15:20:41 -07:00
  • d3e104c3f3 Update windows_disable_or_modify_tools_via_taskkill.yml Bhavin Patel 2023-09-27 14:58:14 -07:00
  • 67b6e4749f Update windows_delete_or_modify_system_firewall.yml Bhavin Patel 2023-09-27 14:57:04 -07:00
  • 2076a91d12 adding dest Bhavin Patel 2023-09-27 14:56:11 -07:00
  • aa67babf28 Merge branch 'develop' into njrat Bhavin Patel 2023-09-27 14:35:11 -07:00
  • eab7f6fda5 Merge branch 'develop' into dlux_update Merging latest detections from develop into branch to continue to work on them dluxtron 2023-09-27 15:06:51 +10:00
  • 27f8e44fdd Branch was auto-updated. srv-rr-gh-researchbt 2023-09-26 15:47:49 -07:00
  • aa1e29b13f Branch was auto-updated. srv-rr-gh-researchbt 2023-09-26 15:47:47 -07:00
  • d200495988 Branch was auto-updated. srv-rr-gh-researchbt 2023-09-26 15:47:46 -07:00
  • c2d6569ad3 Merge pull request #2852 from splunk/ba_detections_spl2 Bhavin Patel 2023-09-26 15:47:29 -07:00
  • aeabc63198 Branch was auto-updated. srv-rr-gh-researchbt 2023-09-26 14:15:20 -07:00
  • 6e4bcc7dfb Branch was auto-updated. srv-rr-gh-researchbt 2023-09-26 14:15:19 -07:00
  • ad6c78ff41 Merge pull request #2854 from splunk/fix_obs_type Bhavin Patel 2023-09-26 14:15:01 -07:00
  • 5633fc811b Branch was auto-updated. srv-rr-gh-researchbt 2023-09-26 14:13:59 -07:00
  • dbc16464b4 Branch was auto-updated. srv-rr-gh-researchbt 2023-09-26 14:13:58 -07:00
  • 77c5c29d8e Branch was auto-updated. srv-rr-gh-researchbt 2023-09-26 14:13:57 -07:00
  • a40e33bd40 Merge pull request #2857 from splunk/tor_to_prod Bhavin Patel 2023-09-26 14:13:40 -07:00
  • c5718166cf Branch was auto-updated. srv-rr-gh-researchbt 2023-09-26 14:11:30 -07:00
  • 48d3117ba3 Branch was auto-updated. srv-rr-gh-researchbt 2023-09-26 14:11:29 -07:00
  • 25b67313fc Merge pull request #2856 from splunk/addlink Bhavin Patel 2023-09-26 14:11:12 -07:00
  • 9bfad7fead Branch was auto-updated. srv-rr-gh-researchbt 2023-09-26 14:10:25 -07:00
  • d0627846c7 Merge pull request #2861 from splunk/dga_pr_fix Bhavin Patel 2023-09-26 14:10:07 -07:00
  • b2d1f4f1ad minor change for creating PR Bhavin Patel 2023-09-26 14:03:04 -07:00
  • 46f183d8b7 Parse out fields for runshellscript search pyth0n1c 2023-09-26 09:19:50 -07:00
  • f37ada7cf9 fix search and notable pyth0n1c 2023-09-25 15:02:52 -07:00
  • f37be10450 Add timing to searches pyth0n1c 2023-09-25 14:39:21 -07:00
  • 2d7c9efdd5 Search improvements pyth0n1c 2023-09-25 13:27:58 -07:00
  • 2b7cb6bba8 Merge branch 'develop' into platform_security_20230919 pyth0n1c 2023-09-25 12:57:34 -07:00
  • 3743f161a8 DGA Performance fix Namratha Sreekanta 2023-09-25 12:55:51 -07:00
  • 648df38a1a njrat2 tccontre 2023-09-25 18:11:06 +02:00
  • 9c341bc954 njrat2 tccontre 2023-09-25 18:09:25 +02:00
  • 4e213c100d njrat2 tccontre 2023-09-25 18:05:49 +02:00
  • b3dc3476aa Fix a large number of searches with observable issues. Discuss with team before merging changes. pyth0n1c 2023-09-22 17:10:03 -07:00
  • e9b0b6fcdb update status to deprecated Bhavin Patel 2023-09-22 16:05:31 -07:00
  • dee08b262a minor fix Bhavin Patel 2023-09-22 15:59:07 -07:00
  • db49b5500d last one Bhavin Patel 2023-09-22 15:57:31 -07:00
  • 7cead8e956 second set of fixes Bhavin Patel 2023-09-22 15:47:54 -07:00
  • 9332e6a24c o365_obs_fix Bhavin Patel 2023-09-22 15:01:21 -07:00
  • aac3f3dec4 update story mvelazco 2023-09-22 13:50:05 -04:00
  • b84752b863 conflicts Bhavin Patel 2023-09-21 14:00:46 -07:00
  • 71e6ae8406 njrat2 tccontre 2023-09-21 10:56:06 +02:00
  • b00506bd95 Merge branch 'develop' into sysmon_fix Bhavin Patel 2023-09-20 16:22:08 -07:00
  • c09b037509 fixes Bhavin Patel 2023-09-20 15:45:48 -07:00
  • 427bcde333 Branch was auto-updated. srv-rr-gh-researchbt 2023-09-20 12:56:56 -07:00
  • 7dbf9d4024 Branch was auto-updated. srv-rr-gh-researchbt 2023-09-20 12:56:55 -07:00
  • 23079c08f1 Branch was auto-updated. srv-rr-gh-researchbt 2023-09-20 12:56:54 -07:00
  • d8579e1dd4 Branch was auto-updated. srv-rr-gh-researchbt 2023-09-20 12:56:53 -07:00
  • b2c3a59055 Branch was auto-updated. srv-rr-gh-researchbt 2023-09-20 12:56:52 -07:00
  • b13135bcac Branch was auto-updated. srv-rr-gh-researchbt 2023-09-20 12:56:51 -07:00
  • fc1a3668f7 Branch was auto-updated. srv-rr-gh-researchbt 2023-09-20 12:56:46 -07:00
  • 18dba29613 Branch was auto-updated. srv-rr-gh-researchbt 2023-09-20 12:56:45 -07:00
  • 273fdf3dfd Branch was auto-updated. srv-rr-gh-researchbt 2023-09-20 12:56:43 -07:00
  • 3a6638dbdd Update dist/escu, dist/ssa, and dist/api folders with the latest content associated with this tag saa-improvements research bot 2023-09-20 19:56:21 +00:00
  • 82b699b444 updating tor detection Bhavin Patel 2023-09-20 11:55:18 -07:00
  • 606baead35 Branch was auto-updated. srv-rr-gh-researchbt 2023-09-20 11:48:10 -07:00
  • caf3d75053 Branch was auto-updated. srv-rr-gh-researchbt 2023-09-20 11:48:07 -07:00
  • 9538d202dc Branch was auto-updated. srv-rr-gh-researchbt 2023-09-20 11:47:52 -07:00
  • 0c2e491051 Branch was auto-updated. srv-rr-gh-researchbt 2023-09-20 11:47:50 -07:00
  • 4e3980e94c Branch was auto-updated. srv-rr-gh-researchbt 2023-09-20 11:47:48 -07:00
  • dffbf1a9a4 Branch was auto-updated. srv-rr-gh-researchbt 2023-09-20 11:47:45 -07:00
  • d6fce2df06 Branch was auto-updated. srv-rr-gh-researchbt 2023-09-20 11:47:42 -07:00