admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
Bhavin Patel
2021-11-19 03:56:25 -08:00
committed by GitHub
parent 05657d48df de15a819bb
commit ec1c5d9d54
16 changed files with 19 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
+1 -1
View File
@@ -38,7 +38,7 @@ tags:
- Stage:Command And Control
- Consequence:Loss Of Control
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log
impact: 80
kill_chain_phases:
- Actions on Objectives
detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml
+1 -1
View File
@@ -44,7 +44,7 @@ tags:
- Stage:Credential Access
- Consequence:Loss Of Control
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log
impact: 80
kill_chain_phases:
- Actions on Objectives
detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml
+1 -1
View File
@@ -37,7 +37,7 @@ tags:
- Stage:Credential Access
- Consequence:Loss Of Control
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllMimikatzModules.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllMimikatzModules.log
impact: 80
kill_chain_phases:
- Actions on Objectives
detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml
+1 -1
View File
@@ -37,7 +37,7 @@ tags:
- Stage:Credential Access
- Consequence:Loss Of Control
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllPowerSploitModulesWithOldNames.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllPowerSploitModulesWithOldNames.log
impact: 90
kill_chain_phases:
- Actions on Objectives
dist/api/detections.json
Vendored
+1 -1
View File
File diff suppressed because one or more lines are too long
dist/api/stories.json
Vendored
+1 -1
View File
File diff suppressed because one or more lines are too long
dist/ssa/detections/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml
Vendored
+1 -1
View File
@@ -41,7 +41,7 @@ tags:
- Stage:Command And Control
- Consequence:Loss Of Control
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log
impact: 80
kill_chain_phases:
- Actions on Objectives
dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml
Vendored
+1 -1
View File
@@ -47,7 +47,7 @@ tags:
- Stage:Credential Access
- Consequence:Loss Of Control
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log
impact: 80
kill_chain_phases:
- Actions on Objectives
dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml
Vendored
+1 -1
View File
@@ -40,7 +40,7 @@ tags:
- Stage:Credential Access
- Consequence:Loss Of Control
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllMimikatzModules.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllMimikatzModules.log
impact: 80
kill_chain_phases:
- Actions on Objectives
dist/ssa/detections/setting_credentials_via_powersploit_modules.yml
Vendored
+1 -1
View File
@@ -40,7 +40,7 @@ tags:
- Stage:Credential Access
- Consequence:Loss Of Control
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllPowerSploitModulesWithOldNames.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllPowerSploitModulesWithOldNames.log
impact: 90
kill_chain_phases:
- Actions on Objectives
docs/_posts/2020-11-03-setting_credentials_via_dsinternals_modules.md
+1 -1
View File
@@ -102,7 +102,7 @@ None identified.
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log)
* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log)
docs/_posts/2020-11-03-setting_credentials_via_mimikatz_modules.md
+1 -1
View File
@@ -99,7 +99,7 @@ None identified.
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllMimikatzModules.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllMimikatzModules.log)
* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllMimikatzModules.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllMimikatzModules.log)
docs/_posts/2020-11-03-setting_credentials_via_powersploit_modules.md
+1 -1
View File
@@ -99,7 +99,7 @@ None identified.
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllPowerSploitModulesWithOldNames.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllPowerSploitModulesWithOldNames.log)
* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllPowerSploitModulesWithOldNames.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllPowerSploitModulesWithOldNames.log)
docs/_posts/2020-11-09-illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.md
+1 -1
View File
@@ -95,7 +95,7 @@ None identified.
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log)
* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log)
docs/detections.wiki
+4 -4
View File
@@ -31508,7 +31508,7 @@ None identified.
====Test Dataset====
* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log
* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log
''version'': 1
@@ -46990,7 +46990,7 @@ None identified.
====Test Dataset====
* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log
* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log
''version'': 1
@@ -47077,7 +47077,7 @@ None identified.
====Test Dataset====
* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllMimikatzModules.log
* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllMimikatzModules.log
''version'': 1
@@ -47164,7 +47164,7 @@ None identified.
====Test Dataset====
* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllPowerSploitModulesWithOldNames.log
* https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllPowerSploitModulesWithOldNames.log
''version'': 1
tests/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.test.yml
+1 -1
View File
@@ -6,5 +6,5 @@ tests:
description: Test enabling or disabling of accounts detections
attack_data:
- file_name: logAllDSInternalsModules.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log
source: WinEventLog:Security