Commit Graph

  • bf4daef2ca Update winevent_scheduled_task_created_within_public_path.yml tccontre 2023-04-14 10:38:20 +02:00
  • 357de299b3 Update powershell_loading_dotnet_into_memory_via_reflection.yml tccontre 2023-04-14 10:36:29 +02:00
  • 60ec2a1c2c Update powershell_fileless_script_contains_base64_encoded_content.yml tccontre 2023-04-14 10:35:54 +02:00
  • 53b7dc49e9 Update cmd_carry_out_string_command_parameter.yml tccontre 2023-04-14 10:34:44 +02:00
  • d460df3354 Update any_powershell_downloadstring.yml tccontre 2023-04-14 10:33:19 +02:00
  • 61d4414f2f fix up with 4.0 patel-bhavin 2023-04-13 11:30:14 -07:00
  • 5ebf3d6484 remove tests patel-bhavin 2023-04-13 11:19:19 -07:00
  • 19c67e3d85 fixup to match 4.0 patel-bhavin 2023-04-13 11:16:43 -07:00
  • 95a776160f Update sandworm_tools.yml Michael Haag 2023-04-13 12:15:47 -06:00
  • eebbe77081 Update windows_dns_gather_network_info.yml Michael Haag 2023-04-13 12:13:39 -06:00
  • e0b6575f57 Fixed parsing errors on how_to_implement Kelby Shelton 2023-04-13 12:57:48 -05:00
  • f42f8d28a7 Fixed names and ID Kelby Shelton 2023-04-13 12:42:29 -05:00
  • 435f535119 fixes Michael Haag 2023-04-13 11:40:53 -06:00
  • fa7ebebdb7 status Michael Haag 2023-04-13 11:29:07 -06:00
  • 2b51ca5ac8 Update powershell_loading_dotnet_into_memory_via_reflection.yml tccontre 2023-04-13 19:15:58 +02:00
  • df412ca5bb Update powershell_fileless_script_contains_base64_encoded_content.yml tccontre 2023-04-13 19:15:34 +02:00
  • 6533a9b79e Update cmd_carry_out_string_command_parameter.yml tccontre 2023-04-13 19:15:09 +02:00
  • 9dfc980e11 Update any_powershell_downloadstring.yml tccontre 2023-04-13 19:14:46 +02:00
  • d7003dd331 potential detection fix pyth0n1c 2023-04-13 10:10:22 -07:00
  • ec53456c95 update Michael Haag 2023-04-13 11:10:02 -06:00
  • 3faaaf2f0a updates Michael Haag 2023-04-13 11:07:18 -06:00
  • 52391f5615 Merge branch 'develop' into sandworm_data_destruction tccontre 2023-04-13 19:07:10 +02:00
  • c5bccb239b Merge branch 'develop' into winter_vivern_analytics tccontre 2023-04-13 19:02:00 +02:00
  • 5abe5b1618 splunk_attack_analyzer_playbook tccontre 2023-04-13 16:45:28 +02:00
  • 34e5a9662f crowdstrike_oauth_api_playbook_v2 tccontre 2023-04-13 16:38:22 +02:00
  • 3b4b43ea60 crowdstrike_oauth_api_playbook_v2 tccontre 2023-04-13 11:20:59 +02:00
  • e0b2eabfde Added Mission Control playbooks Kelby Shelton 2023-04-12 21:17:00 -05:00
  • d58e3eb05a Updating typo in filter macro pyth0n1c 2023-04-12 13:58:23 -07:00
  • c118fcf9f8 Scheduled task with pwsh onemorehaag Michael Haag 2023-04-12 13:22:54 -06:00
  • d98f1181cb Merge branch 'develop' into joinopolis Bhavin Patel 2023-04-12 11:42:10 -07:00
  • 7a0b99a4b0 Branch was auto-updated. srv-rr-gh-researchbt 2023-04-12 11:21:30 -07:00
  • f498d10d65 Branch was auto-updated. srv-rr-gh-researchbt 2023-04-12 11:21:28 -07:00
  • 6710e09236 Branch was auto-updated. srv-rr-gh-researchbt 2023-04-12 11:21:26 -07:00
  • e99b629107 Branch was auto-updated. srv-rr-gh-researchbt 2023-04-12 11:21:24 -07:00
  • 9e77296715 Branch was auto-updated. srv-rr-gh-researchbt 2023-04-12 11:21:23 -07:00
  • fa1acf4761 Branch was auto-updated. srv-rr-gh-researchbt 2023-04-12 11:21:18 -07:00
  • ed43070887 Branch was auto-updated. srv-rr-gh-researchbt 2023-04-12 11:21:14 -07:00
  • 1d7817f8a8 Branch was auto-updated. srv-rr-gh-researchbt 2023-04-12 11:21:10 -07:00
  • 9316c8cc51 Branch was auto-updated. srv-rr-gh-researchbt 2023-04-12 11:21:01 -07:00
  • 5e12681fe4 Branch was auto-updated. srv-rr-gh-researchbt 2023-04-12 11:20:58 -07:00
  • 5bd844c800 Branch was auto-updated. srv-rr-gh-researchbt 2023-04-12 11:20:56 -07:00
  • 000a7bb6a7 Merge pull request #2499 from splunk/security_content_4_phase_2 Bhavin Patel 2023-04-12 11:20:29 -07:00
  • b0e5d8dda5 Moved dispatch to end of playbook name Kelby Shelton 2023-04-12 12:29:59 -05:00
  • 7dcf596f43 Branch was auto-updated. srv-rr-gh-researchbt 2023-04-12 10:22:46 -07:00
  • 62d4b46f8c Merge pull request #2616 from splunk/fix_some_experimental_and_deprecated_content Bhavin Patel 2023-04-12 10:22:28 -07:00
  • 67d09a1c52 Fixing some syntactic errors with a number of detections. pyth0n1c 2023-04-12 10:09:43 -07:00
  • 88c18bf941 Rename dynamic to dispatch Kelby Shelton 2023-04-12 09:37:33 -05:00
  • d0dd4475a2 Update VT playbooks P4T12ICK 2023-04-12 13:35:40 +02:00
  • 20b1db48de Add files via upload Steven Dick 2023-04-12 07:18:22 -04:00
  • e9dfbaef48 Update windows_dns_gather_network_info.yml tccontre 2023-04-12 12:29:08 +02:00
  • e0b697ab6e sandworm_data_destruction tccontre 2023-04-12 12:17:43 +02:00
  • 3754611943 Fix a number of experimental and deprecated detections so that they do not raise error when run out of the box. pyth0n1c 2023-04-11 16:27:40 -07:00
  • c0a7d2e42b Merge branch 'security_content_4_phase_2' into smoketest_all_detections pyth0n1c 2023-04-11 14:50:40 -07:00
  • 1156354fe3 run generate on all new changes patel-bhavin 2023-04-11 14:47:36 -07:00
  • 66eb63e06c Fixing how smoketest is passed to detection wrapper test_4.0 pyth0n1c 2023-04-11 12:49:49 -07:00
  • 94a7845f9c Add experimental support for smoketest. That means running all detections without replaying data or checking correctness. pyth0n1c 2023-04-11 12:48:49 -07:00
  • 26c5a30793 Merge pull request #2590 from splunk/test_4.0 Bhavin Patel 2023-04-11 12:41:37 -07:00
  • aba28cfbc3 Update active_setup_registry_autostart.yml Michael Haag 2023-04-11 11:28:37 -06:00
  • c55307a0e5 3 Michael Haag 2023-04-11 11:01:31 -06:00
  • 363799e85b Update disable_amsi_through_registry.yml Michael Haag 2023-04-11 10:59:15 -06:00
  • 2f5cfd1556 Update auto_admin_logon_registry_entry.yml Michael Haag 2023-04-11 10:07:10 -06:00
  • 97992ce077 Update detect_activity_related_to_pass_the_hash_attacks.yml Bhavin Patel 2023-04-11 08:54:40 -07:00
  • abe03adbb8 Added tooltips to filter blocks Lou Stella 2023-04-11 08:29:42 -05:00
  • 95da1c3b3f new anomaly detection patel-bhavin 2023-04-10 19:16:09 -07:00
  • c453ab592d new_datasync_detection patel-bhavin 2023-04-10 16:10:09 -07:00
  • 59340ad7f0 Identifier Activity Analysis Dispatch Lou Stella 2023-04-10 17:09:41 -05:00
  • 080e429c01 manual flag for 1 detection patel-bhavin 2023-04-10 11:20:41 -07:00
  • a1a9fb5b77 slack pth spl update patel-bhavin 2023-04-07 13:19:49 -05:00
  • 6d6e36333d new detection mvelazco 2023-04-06 17:43:38 -04:00
  • 4b940be07e Merge branch 'TR-2838_AD_PrivilegeEscalation' of github.com:splunk/security_content into TR-2838_AD_PrivilegeEscalation mvelazco 2023-04-06 13:42:00 -04:00
  • d4bb7bb397 adding new detection. mvelazco 2023-04-06 13:41:42 -04:00
  • fefd31fabc remove error patel-bhavin 2023-04-06 11:31:07 -05:00
  • 712d77a1c0 Revert "minor_update_saa_urlscan_playbook" revert-2597-minor_update_saa_urlscan_playbook P4T12ICK 2023-04-06 17:27:53 +02:00
  • 13a7570284 manual pass patel-bhavin 2023-04-06 09:41:08 -05:00
  • a0d72c15ad Branch was auto-updated. srv-rr-gh-researchbt 2023-04-06 07:38:45 -07:00
  • 301f928a04 Branch was auto-updated. srv-rr-gh-researchbt 2023-04-06 07:38:10 -07:00
  • 0bdc2969dd Branch was auto-updated. Oktahaagapus_part2 srv-rr-gh-researchbt 2023-04-06 07:38:09 -07:00
  • 39e40d5893 Branch was auto-updated. srv-rr-gh-researchbt 2023-04-06 07:38:08 -07:00
  • 0dffbef8b7 Branch was auto-updated. srv-rr-gh-researchbt 2023-04-06 07:38:07 -07:00
  • 7ad51e48b6 Branch was auto-updated. srv-rr-gh-researchbt 2023-04-06 07:38:06 -07:00
  • 214d8a155a Branch was auto-updated. srv-rr-gh-researchbt 2023-04-06 07:38:05 -07:00
  • 0bef6e0949 Branch was auto-updated. srv-rr-gh-researchbt 2023-04-06 07:38:04 -07:00
  • 2b13168989 Branch was auto-updated. srv-rr-gh-researchbt 2023-04-06 07:38:02 -07:00
  • e7e453159d Branch was auto-updated. srv-rr-gh-researchbt 2023-04-06 07:38:00 -07:00
  • 321b5f1fb4 Branch was auto-updated. srv-rr-gh-researchbt 2023-04-06 07:37:59 -07:00
  • 3dc64f2e2e Branch was auto-updated. srv-rr-gh-researchbt 2023-04-06 07:37:57 -07:00
  • ccb72dee8e Branch was auto-updated. srv-rr-gh-researchbt 2023-04-06 07:37:56 -07:00
  • 3158f6c589 Branch was auto-updated. srv-rr-gh-researchbt 2023-04-06 07:37:54 -07:00
  • 7648f1e514 Branch was auto-updated. srv-rr-gh-researchbt 2023-04-06 07:37:53 -07:00
  • e98775aa99 Merge pull request #2597 from splunk/minor_update_saa_urlscan_playbook P4T12ICK 2023-04-06 16:37:32 +02:00
  • 634ce1e664 Added tooltips + adjusted output fields Lou Stella 2023-04-05 12:55:11 -05:00
  • e42d14a282 Added tooltips & renamed observable field values Lou Stella 2023-04-05 12:46:54 -05:00
  • 770e037370 Updated with new query for file hashes Lou Stella 2023-04-05 12:35:36 -05:00
  • 3ee8c81ece minor_update_saa_urlscan_playbook minor_update_saa_urlscan_playbook tccontre 2023-04-05 19:19:19 +02:00
  • 5d6aeffbed crowdstrike_oauth_api_playbook_v2 tccontre 2023-04-05 19:16:44 +02:00
  • 07dbcad2a6 dispatch_dynamic_analysis tccontre 2023-04-05 19:15:13 +02:00
  • 942bfc88a9 Merge branch 'security_content_4_phase_2' into test_4.0 Bhavin Patel 2023-04-05 09:58:20 -05:00
  • e71ffb6b8c winter_vivern_analytics tccontre 2023-04-05 15:56:24 +02:00
  • 6c0b883df8 update reporting P4T12ICK 2023-04-05 14:53:09 +02:00
  • fcab1e7044 Merge branch 'develop' into security_content_4_phase_2 P4T12ICK 2023-04-05 14:52:58 +02:00