admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Modify all tests that fail in gha

Browse Source 
but pass in local testing for easier
troubleshooting.
This commit is contained in:
pyth0n1c
2022-07-11 12:53:51 -07:00
parent 1e6f2d79b0
commit ccbe770e21
24 changed files with 24 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/add_defaultuser_and_password_in_registry.yml
+1 -1
View File
@@ -2,7 +2,7 @@ name: Add DefaultUser And Password In Registry
id: d4a3eb62-0f1e-11ec-a971-acde48001122
version: 2
date: '2022-01-26'
author: Teoderick Contreras, Splunk
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
detections/endpoint/disable_defender_antivirus_registry.yml
+1 -1
View File
@@ -2,7 +2,7 @@ name: Disable Defender AntiVirus Registry
id: aa4f695a-3024-11ec-9987-acde48001122
version: 2
date: '2022-01-26'
author: Teoderick Contreras, Splunk
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
detections/endpoint/disable_defender_enhanced_notification.yml
+1 -1
View File
@@ -2,7 +2,7 @@ name: Disable Defender Enhanced Notification
id: dc65678c-301f-11ec-8e30-acde48001122
version: 2
date: '2022-01-26'
author: Teoderick Contreras, Splunk
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
detections/endpoint/disable_defender_spynet_reporting.yml
+1 -1
View File
@@ -2,7 +2,7 @@ name: Disable Defender Spynet Reporting
id: 898debf4-3021-11ec-ba7c-acde48001122
version: 2
date: '2022-01-26'
author: Teoderick Contreras, Splunk
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
detections/endpoint/disable_security_logs_using_minint_registry.yml
+1 -1
View File
@@ -2,7 +2,7 @@ name: Disable Security Logs Using MiniNt Registry
id: 39ebdc68-25b9-11ec-aec7-acde48001122
version: 2
date: '2022-01-27'
author: Teoderick Contreras, Splunk
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml
+1 -1
View File
@@ -2,7 +2,7 @@ name: DLLHost with no Command Line Arguments with Network
id: f1c07594-a141-11eb-8407-acde48001122
version: 3
date: '2022-03-15'
author: Michael Haag, Splunk
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
detections/endpoint/enable_wdigest_uselogoncredential_registry.yml
+1 -1
View File
@@ -2,7 +2,7 @@ name: Enable WDigest UseLogonCredential Registry
id: 0c7d8ffe-25b1-11ec-9f39-acde48001122
version: 2
date: '2022-01-28'
author: Teoderick Contreras, Splunk
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
detections/endpoint/etw_registry_disabled.yml
+1 -1
View File
@@ -2,7 +2,7 @@ name: ETW Registry Disabled
id: 8ed523ac-276b-11ec-ac39-acde48001122
version: 2
date: '2022-01-28'
author: Teoderick Contreras, Splunk
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
detections/endpoint/hide_user_account_from_sign_in_screen.yml
+1 -1
View File
@@ -2,7 +2,7 @@ name: Hide User Account From Sign-In Screen
id: 834ba832-ad89-11eb-937d-acde48001122
version: 2
date: '2022-01-28'
author: Teoderick Contreras, Splunk
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
detections/endpoint/linux_deletion_of_init_daemon_script.yml
+1 -1
View File
@@ -2,7 +2,7 @@ name: Linux Deletion Of Init Daemon Script
id: 729aab57-d26f-4156-b97f-ab8dda8f44b1
version: 1
date: '2022-04-12'
author: Teoderick Contreras, Splunk
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
detections/endpoint/linux_deletion_of_ssl_certificate.yml
+1 -1
View File
@@ -2,7 +2,7 @@ name: Linux Deletion of SSL Certificate
id: 839ab790-a60a-4f81-bfb3-02567063f615
version: 1
date: '2022-04-12'
author: Teoderick Contreras, Splunk
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
detections/endpoint/linux_high_frequency_of_file_deletion_in_etc_folder.yml
+1 -1
View File
@@ -2,7 +2,7 @@ name: Linux High Frequency Of File Deletion In Etc Folder
id: 9d867448-2aff-4d07-876c-89409a752ff8
version: 1
date: '2022-04-12'
author: Teoderick Contreras, Splunk
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
detections/endpoint/remcos_client_registry_install_entry.yml
+1 -1
View File
@@ -2,7 +2,7 @@ name: Remcos client registry install entry
id: f2a1615a-1d63-11ec-97d2-acde48001122
version: 2
date: '2022-01-26'
author: Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk
author: Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
detections/endpoint/revil_registry_entry.yml
+1 -1
View File
@@ -2,7 +2,7 @@ name: Revil Registry Entry
id: e3d3f57a-c381-11eb-9e35-acde48001122
version: 2
date: '2021-01-26'
author: Teoderick Contreras, Splunk
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
detections/endpoint/sdclt_uac_bypass.yml
+1 -1
View File
@@ -2,7 +2,7 @@ name: Sdclt UAC Bypass
id: d71efbf6-da63-11eb-8c6e-acde48001122
version: 2
date: '2020-01-28'
author: Teoderick Contreras, Splunk
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml
+1 -1
View File
@@ -2,7 +2,7 @@ name: SearchProtocolHost with no Command Line with Network
id: b690df8c-a145-11eb-a38b-acde48001122
version: 3
date: '2022-03-15'
author: Michael Haag, Splunk
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
detections/endpoint/windows_disable_change_password_through_registry.yml
+1 -1
View File
@@ -2,7 +2,7 @@ name: Windows Disable Change Password Through Registry
id: 0df33e1a-9ef6-11ec-a1ad-acde48001122
version: 1
date: '2022-03-08'
author: Teoderick Contreras, Splunk
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
detections/endpoint/windows_disable_lock_workstation_feature_through_registry.yml
+1 -1
View File
@@ -2,7 +2,7 @@ name: Windows Disable Lock Workstation Feature Through Registry
id: c82adbc6-9f00-11ec-a81f-acde48001122
version: 1
date: '2022-03-08'
author: Teoderick Contreras, Splunk
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
detections/endpoint/windows_disable_memory_crash_dump.yml
+1 -1
View File
@@ -2,7 +2,7 @@ name: Windows Disable Memory Crash Dump
id: 59e54602-9680-11ec-a8a6-acde48001122
version: 1
date: '2022-02-25'
author: Michael Haag, Splunk
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
detections/endpoint/windows_disable_notification_center.yml
+1 -1
View File
@@ -2,7 +2,7 @@ name: Windows Disable Notification Center
id: 1cd983c8-8fd6-11ec-a09d-acde48001122
version: 1
date: '2022-02-17'
author: Teoderick Contreras, Splunk
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
detections/endpoint/windows_disable_shutdown_button_through_registry.yml
+1 -1
View File
@@ -2,7 +2,7 @@ name: Windows Disable Shutdown Button Through Registry
id: 55fb2958-9ecd-11ec-a06a-acde48001122
version: 1
date: '2022-03-08'
author: Teoderick Contreras, Splunk
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
detections/endpoint/windows_hide_notification_features_through_registry.yml
+1 -1
View File
@@ -2,7 +2,7 @@ name: Windows Hide Notification Features Through Registry
id: cafa4bce-9f06-11ec-a7b2-acde48001122
version: 1
date: '2022-03-08'
author: Teoderick Contreras, Splunk
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
detections/endpoint/windows_installutil_remote_network_connection.yml
+1 -1
View File
@@ -2,7 +2,7 @@ name: Windows InstallUtil Remote Network Connection
id: 4fbf9270-43da-11ec-9486-acde48001122
version: 2
date: '2022-03-16'
author: Michael Haag, Splunk
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml
+1 -1
View File
@@ -2,7 +2,7 @@ name: Windows Modify Show Compress Color And Info Tip Registry
id: b7548c2e-9a10-11ec-99e3-acde48001122
version: 1
date: '2022-03-02'
author: Teoderick Contreras, Splunk
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint