24 Commits

Author	SHA1	Message	Date
Ming Di Leom	4803ba6ff4	page(threat-hunting): update InnoDownloadPlugin description	2025-04-06 12:06:57 +00:00
Ming Di Leom	978e8c6ae6	page(threat-hunting): file hiding using attrib.exe	2025-04-06 12:04:48 +00:00
Ming Di Leom	751e9e7c66	page(threat-hunting): powershell auto-start	2025-04-06 12:02:04 +00:00
Ming Di Leom	cd2a742df9	page(threat-hunting): CobaltStrike detection through network share discovery	2025-04-06 11:49:47 +00:00
Ming Di Leom	b7abc47a5c	page(threat-hunting): New Network Share detected	2025-04-06 11:43:44 +00:00
Ming Di Leom	fb69f36eb2	page(threat-hunting): tailscale detection	2025-04-06 11:02:51 +00:00
Ming Di Leom	3f88d3dc20	page(threat-hunting): InnoDownloadPlugin user-agent observed	2025-04-01 09:27:20 +00:00
Ming Di Leom	3fa8c33ea5	page(threat-hunting): ClickFix detection	2025-03-29 07:35:17 +00:00
Ming Di Leom	db84c03325	chore(rmm-monitor): TightVNC	2025-03-29 06:58:46 +00:00
Ming Di Leom	f36554abe8	feat(threat-hunting): Defender Incident	2025-03-13 10:08:59 +00:00
Ming Di Leom	f2b06016c1	feat(threat-hunting): Regasm.exe execution	2025-03-08 07:23:15 +00:00
Ming Di Leom	556ee14d9f	feat(threat-hunting): Excessive RDP	2025-02-26 05:47:41 +00:00
Ming Di Leom	ec7268cf85	chore(threat-hunting): updated date	2025-02-16 10:18:04 +00:00
Ming Di Leom	b5a08380d4	feat(threat-hunting): WinrsHost.exe execution	2025-02-16 10:17:08 +00:00
Ming Di Leom	7da3ce2538	feat(threat-hunting): CDB.exe execution	2025-02-16 10:15:05 +00:00
Ming Di Leom	976d1457d1	chore(rmm-monitor): RealVNC & Dameware	2025-02-16 10:04:07 +00:00
Ming Di Leom	9ea18b1495	page(threat-hunting): cmd without extension	2025-02-08 01:07:45 +00:00
Ming Di Leom	9c02132f68	page(threat-hunting): "Rundll32 Scheduled Task"	2025-02-03 06:46:56 +00:00
Ming Di Leom	afbf7f6428	page(threat-hunting): SimpleHelp,Netop,Impero	2025-02-03 06:31:29 +00:00
Ming Di Leom	42ba8a01de	page(threat-hunting): rename snow_cmdb_lookup to cmdb_ci_list_lookup	2025-02-03 06:24:49 +00:00
Ming Di Leom	ea7d24b3c0	page(threat-hunting): move status monitor to gitlab ... https://gitlab.com/curben/splunk-scripts/-/blob/main/itsi_im_metrics/savedsearches.conf	2025-02-01 03:35:43 +00:00
Ming Di Leom	d25e9662ab	page(threat-hunting): "Unusual printui.exe path"	2025-01-28 08:59:40 +00:00
Ming Di Leom	bd36476125	page(threat-hunting): some queries require custom data model	2025-01-15 11:06:33 +00:00
Ming Di Leom	a9c575817e	page: Splunk Threat Hunting ... migrated from https://gitlab.com/curben/splunk-scripts/-/tree/main/threat-hunting	2025-01-15 10:59:11 +00:00