Repository navigation

Analytic Updates - 01262021 - #1107

Merged

patel-bhavin merged 101 commits into

developfrom

msbuild

Jan 27, 2021

Merged

Analytic Updates - 01262021#1107
patel-bhavin merged 101 commits into
developfrom
msbuild

Commits on Jan 15, 2021
- T1127.001 MSbuild
  mhaag-spl
  committed
  0eba487
- Revert "T1127.001 MSbuild"
  mhaag-spl
  committed
  e27ad13
- Revert "Revert "T1127.001 MSbuild""
  mhaag-spl
  committed
  9617d4d
Commits on Jan 18, 2021
- Revert "Revert "Revert "T1127.001 MSbuild"""
  mhaag-spl
  committed
  fd5e4ad
- Revert "Revert "Revert "Revert "T1127.001 MSbuild""""
  mhaag-spl
  committed
  08488e0
- MSBuild
  mhaag-spl
  committed
  2e9bd74
- ID Collision
  mhaag-spl
  committed
  7414436
- Update suspicious_msbuild_netconn.yml
  mhaag-spl
  committed
  bcf56fa
- MSHTA
  mhaag-spl
  committed
  28827c7
- MSBuild Story
  mhaag-spl
  committed
  dbf7e12
- Update trusted_developer_utilities_proxy_execution_msbuild.yml
  mhaag-spl
  committed
  7d6017a
- Msbuild Story name and analytics fix
  mhaag-spl
  committed
  c964e52
- Branch was auto-updated.
  github-actions[bot]
  authored
  439e41c
- Branch was auto-updated.
  github-actions[bot]
  authored
  f3efa92
- Branch was auto-updated.
  github-actions[bot]
  authored
  93bee4b
- Branch was auto-updated.
  github-actions[bot]
  authored
  e485b54
- Branch was auto-updated.
  github-actions[bot]
  authored
  d6fa6a6
Commits on Jan 19, 2021
- Timestamp
  mhaag-spl
  committed
  3fa5c37
- Branch was auto-updated.
  github-actions[bot]
  authored
  b5655d4
- Removing netconn
  mhaag-spl
  committed
  cdb6d03
- Update suspicious_msbuild_rename.yml
  mhaag-spl
  committed
  65b4f28
- Update suspicious_msbuild_rename.yml
  mhaag-spl
  committed
  420bc3f
- URL Fixes
  mhaag-spl
  committed
  44a9d0b
- Added detection testing service results inDetect wmiprvse spawn msbuild
  root
  committed
  ad1564c
- Added detection testing service results inDetect moved msbuild execution
  root
  committed
  f26d176
- Added detection testing service results inDetect renamed msbuild execution
  root
  committed
  b355147
- Merge branch 'msbuild' of https://github.com/splunk/security-content into msbuild
  Detection Testing Service
  committed
  778c81b
- Microsoft Workflow Compiler
  mhaag-spl
  committed
  d6a9bf5
- Merge branch 'msbuild' of https://github.com/splunk/security-content into msbuild
  mhaag-spl
  committed
  8f5f82c
- Update trusted_developer_utilities_proxy_execution.yml
  mhaag-spl
  committed
  9514ec2
- Added detection testing service results inDetect microsoft.workflow.compiler.exe rename
  root
  committed
  5a22ce5
- Added detection testing service results inDetect microsoft.workflow.compiler.exe usage
  root
  committed
  edd77b7
- Merge branch 'msbuild' of https://github.com/splunk/security-content into msbuild
  Detection Testing Service
  committed
  55d2921
- Merge branch 'develop' into msbuild
  MHaggis
  authored
  bf919b3
Commits on Jan 20, 2021
- rundll32 inline hta
  mhaag-spl
  committed
  ed6e404
- Added detection testing service results inDetect rundll32 executing hta with inline protocols
  root
  committed
  267b33b
- Update detect_rundll32_inline_hta_execution.yml
  mhaag-spl
  committed
  4299138
- MSHTA
  mhaag-spl
  committed
  1d11230
- Added detection testing service results inDetect mshta url in command line
  root
  committed
  db1265a
- rename mshta inline hta execution
  mhaag-spl
  committed
  5b0ff63
- Merge branch 'msbuild' of https://github.com/splunk/security-content into msbuild
  mhaag-spl
  committed
  5e516b4
- Update detect_mshta_inline_hta_execution.yml
  mhaag-spl
  committed
  dfc9ac8
- Update detect_mshta_inline_hta_execution.yml
  mhaag-spl
  committed
  676a511
- Update detect_mshta_inline_hta_execution.yml
  mhaag-spl
  committed
  9205419
- mshta renamed
  mhaag-spl
  committed
  c3197d0
- Update detect_mshta_renamed.yml
  mhaag-spl
  committed
  492c70d
- Merge branch 'develop' into msbuild
  MHaggis
  authored
  b29378f
- Suspicious mshta spawn
  mhaag-spl
  committed
  03ac6e1
- ID changes
  mhaag-spl
  committed
  f3d274c
- renamed testing
  mhaag-spl
  committed
  b60d75a
- Added detection testing service results inDetect mshta spawn
  root
  committed
  6697920
Commits on Jan 21, 2021
- MSBuild story update
  mhaag-spl
  committed
  802d15b
- Branch was auto-updated.
  github-actions[bot]
  authored
  e874b32
- Update trusted_developer_utilities_proxy_execution_msbuild.yml
  mhaag-spl
  committed
  9dc0988
- Merge branch 'msbuild' of https://github.com/splunk/security-content into msbuild
  mhaag-spl
  committed
  eea72fd
- Update trusted_developer_utilities_proxy_execution_msbuild.yml
  mhaag-spl
  committed
  2e5c1bf
- Update trusted_developer_utilities_proxy_execution_msbuild.yml
  mhaag-spl
  committed
  50be407
- Update trusted_developer_utilities_proxy_execution_msbuild.yml
  mhaag-spl
  committed
  2d0e9bb
- Update trusted_developer_utilities_proxy_execution_msbuild.yml
  mhaag-spl
  committed
  5271462
- Update trusted_developer_utilities_proxy_execution_msbuild.yml
  mhaag-spl
  committed
  56031c3
- Update trusted_developer_utilities_proxy_execution_msbuild.yml
  mhaag-spl
  committed
  306b65a
- Update trusted_developer_utilities_proxy_execution_msbuild.yml
  mhaag-spl
  committed
  9f54914
- Update trusted_developer_utilities_proxy_execution_msbuild.yml
  mhaag-spl
  committed
  77e720a
- Update trusted_developer_utilities_proxy_execution_msbuild.yml
  mhaag-spl
  committed
  d84f20a
- Update trusted_developer_utilities_proxy_execution_msbuild.yml
  mhaag-spl
  committed
  5708e3d
- Update suspicious_mshta_activity.yml
  mhaag-spl
  committed
  1d1fcfc
- Branch was auto-updated.
  github-actions[bot]
  authored
  f53e9f7
Commits on Jan 22, 2021
- Branch was auto-updated.
  github-actions[bot]
  authored
  b26af2d
- Adding WBAdmin - delete system backups
  mhaag-spl
  committed
  e202e62
- Added detection testing service results inWBAdmin Delete System Backups
  root
  committed
  9b1e9d7
Commits on Jan 25, 2021
- Branch was auto-updated.
  github-actions[bot]
  authored
  4c16bfd
- T1482 - NLTest usage
  mhaag-spl
  committed
  2d3b98f
- Merge branch 'develop' into msbuild
  mhaag-spl
  committed
  3e839ea
- minor updates
  mhaag-spl
  committed
  294be79
Commits on Jan 26, 2021
- Merge branch 'develop' into msbuild
  MHaggis
  authored
  4cc4a8a
- Removed mshta rename
  mhaag-spl
  committed
  404f4b3
- Branch was auto-updated.
  github-actions[bot]
  authored
  7ed449d
- Added detection testing service results inNLTest Domain Trust Discovery
  root
  committed
  720f26c
- Update suspicious_mshta_child_process.test.yml
  mhaag-spl
  committed
  c42f729
- Merge branch 'msbuild' of https://github.com/splunk/security_content into msbuild
  mhaag-spl
  committed
  7071c70
- Update suspicious_mshta_child_process.yml
  mhaag-spl
  committed
  8d86921
- wrong url
  mhaag-spl
  committed
  f0ccfd7
- Added detection testing service results inDetect mshta spawning a process
  root
  committed
  12ca26b
- Branch was auto-updated.
  github-actions[bot]
  authored
  cd18663
Commits on Jan 27, 2021
- Branch was auto-updated.
  github-actions[bot]
  authored
  4146065
- Branch was auto-updated.
  github-actions[bot]
  authored
  af13b60
- Branch was auto-updated.
  github-actions[bot]
  authored
  ab0f6cd
- Added detection testing service results inDetect renamed msbuild execution
  root
  committed
  20f29e6
- Merge branch 'msbuild' of https://github.com/splunk/security_content into msbuild
  Detection Testing Service
  committed
  ff2b9be
- Branch was auto-updated.
  github-actions[bot]
  authored
  3185f8f
- Branch was auto-updated.
  github-actions[bot]
  authored
  376e2d0
- Branch was auto-updated.
  github-actions[bot]
  authored
  c465193
- Branch was auto-updated.
  github-actions[bot]
  authored
  5aa0422
- Branch was auto-updated.
  github-actions[bot]
  authored
  45212b2
- Resolved yml formatting
  mhaag-spl
  committed
  d82f9a5
- Branch was auto-updated.
  github-actions[bot]
  authored
  f18e02a
- Branch was auto-updated.
  github-actions[bot]
  authored
  9fbf39b
- Branch was auto-updated.
  github-actions[bot]
  authored
  c3788c2
- Branch was auto-updated.
  github-actions[bot]
  authored
  63b23e9
- Branch was auto-updated.
  github-actions[bot]
  authored
  c050d18
- Update suspicious_msbuild_path.yml
  mhaag-spl
  committed
  5b86943

Commits

Commits on Jan 15, 2021

Commits on Jan 18, 2021

Commits on Jan 19, 2021

Commits on Jan 20, 2021

Commits on Jan 21, 2021

Commits on Jan 22, 2021

Commits on Jan 25, 2021

Commits on Jan 26, 2021

Commits on Jan 27, 2021