988d123704
reorg dir
2020-10-19 10:10:09 -07:00
029f0afff3
Merge branch 'develop' into gcploit
2020-10-19 10:08:21 -07:00
3a65129f5c
Removed non-alphanumeric characters from detection names
2020-10-19 09:47:34 -07:00
5b2710e684
Merge pull request #796 from splunk/dependabot/pip/ansible-2.10.1
2020-10-19 15:09:25 +00:00
7eb89f7e83
Bump ansible from 2.9.2 to 2.10.1
...
Bumps [ansible](https://github.com/ansible/ansible ) from 2.9.2 to 2.10.1.
- [Release notes](https://github.com/ansible/ansible/releases )
- [Commits](https://github.com/ansible/ansible/compare/v2.9.2...v2.10.1 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-10-19 15:03:39 +00:00
53748d2da0
Merge pull request #799 from splunk/dependabot/pip/jmespath-0.10.0
2020-10-19 15:02:14 +00:00
f74eac4531
Bump jmespath from 0.9.4 to 0.10.0
...
Bumps [jmespath](https://github.com/jmespath/jmespath.py ) from 0.9.4 to 0.10.0.
- [Release notes](https://github.com/jmespath/jmespath.py/releases )
- [Changelog](https://github.com/jmespath/jmespath.py/blob/develop/CHANGELOG.rst )
- [Commits](https://github.com/jmespath/jmespath.py/compare/0.9.4...0.10.0 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-10-19 14:57:23 +00:00
df33414571
Merge pull request #800 from splunk/dependabot/pip/urllib3-1.25.11
2020-10-19 14:56:05 +00:00
fa3f0c2b99
Bump urllib3 from 1.25.10 to 1.25.11
...
Bumps [urllib3](https://github.com/urllib3/urllib3 ) from 1.25.10 to 1.25.11.
- [Release notes](https://github.com/urllib3/urllib3/releases )
- [Changelog](https://github.com/urllib3/urllib3/blob/master/CHANGES.rst )
- [Commits](https://github.com/urllib3/urllib3/compare/1.25.10...1.25.11 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-10-19 14:51:52 +00:00
f3dad40e97
Merge pull request #793 from splunk/dependabot/pip/packaging-20.4
2020-10-19 14:50:31 +00:00
f8151f705f
Bump packaging from 19.2 to 20.4
...
Bumps [packaging](https://github.com/pypa/packaging ) from 19.2 to 20.4.
- [Release notes](https://github.com/pypa/packaging/releases )
- [Changelog](https://github.com/pypa/packaging/blob/master/CHANGELOG.rst )
- [Commits](https://github.com/pypa/packaging/compare/19.2...20.4 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-10-19 14:46:21 +00:00
26cc474dfb
Merge pull request #797 from splunk/dependabot/pip/tabulate-0.8.7
2020-10-19 14:45:03 +00:00
1f83645b6b
Bump tabulate from 0.8.6 to 0.8.7
...
Bumps [tabulate](https://github.com/astanin/python-tabulate ) from 0.8.6 to 0.8.7.
- [Release notes](https://github.com/astanin/python-tabulate/releases )
- [Changelog](https://github.com/astanin/python-tabulate/blob/master/CHANGELOG )
- [Commits](https://github.com/astanin/python-tabulate/compare/v0.8.6...v0.8.7 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-10-19 14:40:37 +00:00
643247cba3
Merge pull request #790 from splunk/dependabot/pip/mysql-connector-python-8.0.22
2020-10-19 14:39:18 +00:00
815ef33688
Bump mysql-connector-python from 8.0.21 to 8.0.22
...
Bumps [mysql-connector-python](http://dev.mysql.com/doc/connector-python/en/index.html ) from 8.0.21 to 8.0.22.
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-10-19 14:35:03 +00:00
bf387e1219
Merge pull request #794 from splunk/dependabot/pip/cffi-1.14.3
2020-10-19 14:33:39 +00:00
3a42601426
Bump cffi from 1.13.2 to 1.14.3
...
Bumps [cffi](https://github.com/python-cffi/release-doc ) from 1.13.2 to 1.14.3.
- [Release notes](https://github.com/python-cffi/release-doc/releases )
- [Commits](https://github.com/python-cffi/release-doc/commits )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-10-19 14:29:22 +00:00
470eed170a
Merge pull request #792 from splunk/dependabot/pip/pexpect-4.8.0
2020-10-19 14:28:03 +00:00
734a24a595
Bump pexpect from 4.7.0 to 4.8.0
...
Bumps [pexpect](https://github.com/pexpect/pexpect ) from 4.7.0 to 4.8.0.
- [Release notes](https://github.com/pexpect/pexpect/releases )
- [Commits](https://github.com/pexpect/pexpect/compare/4.7.0...4.8.0 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-10-19 14:23:57 +00:00
d65fdedb5b
Merge pull request #798 from splunk/dependabot/pip/splunk-sdk-1.6.14
2020-10-19 14:22:41 +00:00
246fefb4b8
Bump splunk-sdk from 1.6.12 to 1.6.14
...
Bumps [splunk-sdk](https://github.com/splunk/splunk-sdk-python ) from 1.6.12 to 1.6.14.
- [Release notes](https://github.com/splunk/splunk-sdk-python/releases )
- [Changelog](https://github.com/splunk/splunk-sdk-python/blob/master/CHANGELOG.md )
- [Commits](https://github.com/splunk/splunk-sdk-python/compare/1.6.12...1.6.14 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-10-19 14:18:54 +00:00
d007b60456
Merge pull request #795 from splunk/dependabot/pip/cryptography-3.1.1
2020-10-19 14:17:36 +00:00
1daaefe1a3
Bump cryptography from 2.8 to 3.1.1
...
Bumps [cryptography](https://github.com/pyca/cryptography ) from 2.8 to 3.1.1.
- [Release notes](https://github.com/pyca/cryptography/releases )
- [Changelog](https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst )
- [Commits](https://github.com/pyca/cryptography/compare/2.8...3.1.1 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-10-19 14:14:08 +00:00
8aa5392c50
Adding SSA detections for credential extraction from dumped secure stores or live Windows systems.
2020-10-19 01:42:14 -07:00
6d76a4d268
Fix:
...
1) Adding both long and short name registry section names for Security, SAM and System
2) Adding a condition that command line marameter is not null (faster exit in case customer is not logging command lines)
2020-10-18 22:46:39 -07:00
c457ba1ce2
We need to do 2 fixes here:
...
1) comma sign is also possible between "comsvcs.dll" "MiniDump" in execution of this attack as described in https://risksense.com/blog/hidden-gems-in-windows-the-hunt-is-on/ and https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz and our notebook https://confluence.splunk.com/display/~smiskovic/Test+Events+for+SSA+Detections#TestEventsforSSADetections-DumpingLSASSprocessmemory , and
2) referenced pdf does not contain this detection (will fix this later when I make my notebook public, so we do not need to refer any external companies)
2020-10-18 22:23:18 -07:00
172b5e7d67
update to TF2.3
2020-10-17 00:21:28 -07:00
14b88aa2af
Merge branch 'develop' into lolbas-fixes
2020-10-16 15:46:58 -07:00
fcc005121c
Merge pull request #789 from splunk/add_time
...
Adding _time to phishing detection tests
2020-10-16 15:46:28 -07:00
7a9be3fa01
add
2020-10-16 15:34:26 -07:00
864c8f42bc
Merge pull request #788 from splunk/adding-ssa-tests
...
Organized tests for detections
2020-10-16 15:10:03 -07:00
43392488ee
Merge remote-tracking branch 'origin/develop' into lolbas-fixes
2020-10-16 14:59:31 -07:00
98be589890
Merge remote-tracking branch 'origin/develop' into adding-ssa-tests
2020-10-16 14:16:42 -07:00
ebb0554cea
test files for ssa detections
2020-10-16 14:08:23 -07:00
3f8b95f6cd
adding tests per detection
2020-10-16 12:45:14 -07:00
1c2746eb80
Merge pull request #786 from splunk/dependabot/pip/botocore-1.18.18
2020-10-16 19:45:05 +00:00
b990631363
Bump botocore from 1.18.17 to 1.18.18
...
Bumps [botocore](https://github.com/boto/botocore ) from 1.18.17 to 1.18.18.
- [Release notes](https://github.com/boto/botocore/releases )
- [Changelog](https://github.com/boto/botocore/blob/develop/CHANGELOG.rst )
- [Commits](https://github.com/boto/botocore/compare/1.18.17...1.18.18 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-10-16 19:39:08 +00:00
d901104709
Merge pull request #787 from splunk/dependabot/pip/boto3-1.15.18
2020-10-16 19:37:55 +00:00
cf2294a9d0
Bump boto3 from 1.15.17 to 1.15.18
...
Bumps [boto3](https://github.com/boto/boto3 ) from 1.15.17 to 1.15.18.
- [Release notes](https://github.com/boto/boto3/releases )
- [Changelog](https://github.com/boto/boto3/blob/develop/CHANGELOG.rst )
- [Commits](https://github.com/boto/boto3/compare/1.15.17...1.15.18 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-10-16 19:31:54 +00:00
4bf812c9f6
Merge pull request #751 from splunk/TR-193
...
fixed syntax in unusual command line ssa detection
2020-10-16 11:43:13 -07:00
02f8891e3b
Merge remote-tracking branch 'origin/develop' into TR-193
2020-10-16 11:33:17 -07:00
d857af2a0a
Merge branch 'develop' into lolbas-fixes
2020-10-16 10:01:17 -07:00
ca6d1c381a
Merge pull request #777 from splunk/dependabot/pip/mock-4.0.2
2020-10-16 15:04:44 +00:00
17efc12d0f
Bump mock from 3.0.5 to 4.0.2
...
Bumps [mock](https://github.com/testing-cabal/mock ) from 3.0.5 to 4.0.2.
- [Release notes](https://github.com/testing-cabal/mock/releases )
- [Changelog](https://github.com/testing-cabal/mock/blob/master/CHANGELOG.rst )
- [Commits](https://github.com/testing-cabal/mock/compare/3.0.5...4.0.2 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-10-16 15:00:21 +00:00
3f1f21577a
Merge pull request #785 from splunk/dependabot/pip/mysql-connector-python-8.0.21
2020-10-16 14:58:59 +00:00
09cb8120bb
Bump mysql-connector-python from 8.0.19 to 8.0.21
...
Bumps [mysql-connector-python](http://dev.mysql.com/doc/connector-python/en/index.html ) from 8.0.19 to 8.0.21.
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-10-16 14:55:07 +00:00
7913e7cb34
Merge pull request #784 from splunk/dependabot/pip/ntlm-auth-1.5.0
2020-10-16 14:54:03 +00:00
d9ab4d6464
Bump ntlm-auth from 1.4.0 to 1.5.0
...
Bumps [ntlm-auth](https://github.com/jborean93/ntlm-auth ) from 1.4.0 to 1.5.0.
- [Release notes](https://github.com/jborean93/ntlm-auth/releases )
- [Changelog](https://github.com/jborean93/ntlm-auth/blob/master/CHANGES.md )
- [Commits](https://github.com/jborean93/ntlm-auth/compare/v1.4.0...v1.5.0 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-10-16 14:50:17 +00:00
ed47764d4b
Merge pull request #780 from splunk/dependabot/pip/path-15.0.0
2020-10-16 14:48:58 +00:00
bac818aa86
Bump path from 13.1.0 to 15.0.0
...
Bumps [path](https://github.com/jaraco/path ) from 13.1.0 to 15.0.0.
- [Release notes](https://github.com/jaraco/path/releases )
- [Changelog](https://github.com/jaraco/path/blob/master/CHANGES.rst )
- [Commits](https://github.com/jaraco/path/compare/v13.1.0...v15.0.0 )
Signed-off-by: dependabot-preview[bot] <support@dependabot.com >
2020-10-16 14:44:45 +00:00
bpatel