admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
12,922 Commits 697 Branches 195 Tags
DetectionTestingDocker
Commit Graph

81 Commits

Author SHA1 Message Date
Bhavin Patel 0bdcacd7b3 Merge pull request #1869 from splunk/T1059 
The Haag at The Gates
 2022-01-10 12:11:15 -08:00
research bot ff3319329e updating docs and package bits [ci skip] 2021-12-15 02:58:27 +00:00
Bhavin Patel 61d583e45e Branch was auto-updated. 2021-12-14 18:47:02 -08:00
d1vious 16b771eae2 adding tags to detections 2021-12-14 19:38:51 -05:00
mhaag-spl 71295432e3 Windows shells 2021-12-13 13:01:45 -07:00
mhaag-spl f3b31c113b java Shells 2021-12-13 11:54:59 -07:00
Bhavin Patel 46083ae36f Branch was auto-updated. 2021-12-09 09:06:16 -08:00
mvelazco 648bf1fc6e minor fixes 2021-12-08 13:41:04 -05:00
mhaag-spl 81a49be5e8 Out of the Gates 
Microsoft Exchange Mailbox Replication service writing Active Server Pages
 2021-12-07 14:46:14 -07:00
mvelazco fc478d80a7 Merge branch 'TR-1085_LateralMovement_4' of github.com:splunk/security_content into TR-1085_LateralMovement_4 2021-12-06 17:10:00 -05:00
mvelazco efd890e2c2 updating analytic story name 2021-12-06 17:01:58 -05:00
Bhavin Patel e5fd9f9fe7 Branch was auto-updated. 2021-12-06 11:04:13 -08:00
mhaag-spl 25dc457c3c The Unbroken Haag 2021-12-06 11:57:20 -07:00
mvelazco 20425018bc minor fixes 2021-12-03 21:12:31 -05:00
mvelazco 71410ddb7a 3 new detections 2021-12-03 15:58:00 -05:00
mvelazco 918b680350 update experimental detection names 2021-11-30 13:20:42 -05:00
mvelazco b5783ab849 adding 2 experimental detections 2021-11-30 12:51:43 -05:00
mhaag-spl 1aa5852b19 Update exchange_powershell_module_usage.yml 2021-11-15 07:53:20 -07:00
d1vious 70d68fe35c moving to prod 2021-10-29 10:56:04 -04:00
Jose Enrique Hernandez a4d3b8480d minor updates given the feedback on issue 1767 2021-10-29 10:54:45 -04:00
research bot a1afa0fa60 updating docs and package bits [ci skip] 2021-10-28 19:55:37 +00:00
Drew Church 3b18c5abcb Added CVE tags to 35 files 2021-10-22 10:03:24 -07:00
tccontre 9d466adc76 CARS_UPDATE_MITRE_ID_B8 
CARS_UPDATE_MITRE_ID_B8
 2021-10-15 10:22:43 +02:00
tccontre 5226dbd99c privilege_escalation_persistence 2021-10-08 14:23:55 +02:00
research bot 2783c3fe43 updating docs and package bits [ci skip] 2021-09-09 19:07:07 +00:00
mhaag-spl e8de140562 fixes 2021-09-01 16:58:23 -06:00
mhaag-spl 06b6d96819 Create exchange_powershell_abuse_via_ssrf.yml 2021-09-01 12:26:03 -06:00
Bhavin Patel 9d83664db7 Update exchange_powershell_module_usage.yml 2021-08-27 11:04:01 -07:00
mhaag-spl 77aea09e0d Update exchange_powershell_module_usage.yml 2021-08-25 12:57:35 -06:00
mhaag-spl 25aaf33a98 Update exchange_powershell_module_usage.yml 2021-08-25 12:35:41 -06:00
mhaag-spl 36f3a9c250 Create exchange_powershell_module_usage.yml 2021-08-25 12:31:48 -06:00
P4T12ICK cfae82505c add analytic types to detections 2021-07-19 17:41:22 +02:00
research bot 2d61b8e675 updating docs and package bits [ci skip] 2021-05-24 17:47:29 +00:00
mhaag-spl b411f2b1fc CVE-2021-31166 2021-05-21 11:25:37 -06:00
mhaag-spl dc319b6eda Spearphishing Attachments detections 2021-04-21 10:16:49 -06:00
mhaag-spl 1ab256593f Domain Trust Discovery 2021-03-31 13:24:32 -06:00
mhaag-spl 249fd0a549 Update Certutil 
- Renamed "attempt to add certificate to untrusted store" to "Attempt to add untrusted certificate to certificate store"
New Detections:
- CertUtil Download With URLCache and Split Arguments
- CertUtil Download With VerifyCtl and Split Arguments
 2021-03-24 15:15:47 -06:00
mhaag-spl 00965fbd34 Delete detect_exchange_web_shell.yml 2021-03-19 06:41:51 -06:00
research bot 4b27622a3f updating docs and package bits [ci skip] 2021-03-12 17:32:09 +00:00
divious1 592e63779c fixing merge conflicts 2021-03-12 11:43:55 -05:00
bpatel 40e1f95e2d fixed validation errors 2021-03-11 12:35:04 -08:00
mhaag-spl 2643be22ff w3wp spawning shell 2021-03-11 12:34:21 -07:00
mhaag-spl 69d73f3dc1 unified messaging service spawning a shell 2021-03-11 12:12:52 -07:00
P4T12ICK edaf9598f2 fixed merging issues 2021-03-11 19:03:54 +01:00
P4T12ICK 43644ff368 add required fields 2021-03-11 09:32:33 +01:00
P4T12ICK 6e826b4e68 add required fields and check 2021-03-11 09:11:48 +01:00
mhaag-spl b15aaa55df Moving non-passed to experimental and deprecating some 2021-03-10 13:27:00 -07:00
P4T12ICK 7c134dbb5d WIP 2021-03-10 14:44:44 +01:00
mhaag-spl 851a46ed41 Updated name 2021-03-10 06:43:26 -07:00
mhaag-spl 90a385e941 Create detect_exchange_webshell.yml 2021-03-10 06:23:54 -07:00