Commit Graph

12922 Commits

Author SHA1 Message Date
pyth0n1c 7ba36644bf As suggested by semgrep: Replaced a call to os.system with a call to subprocess.call. Fixed csv quoting to QUOTE_ALL in one of the files that was missed. 2021-08-12 15:31:36 -07:00
pyth0n1c c0107fde5e Fixed other semgrep recommendations - for certain uses of urllib (getting content from a dynamic URI/URL), use the python requests library instead. 2021-08-12 15:07:27 -07:00
pyth0n1c 54bde203c3 Changed QUOTE_MINIMAL to QUOTE_ALL in Python CSV Writer calls in response to semgrep recommendations. 2021-08-12 14:04:26 -07:00
pyth0n1c 6f938863e7 validate caught a syntax error in one of the python files. 2021-08-12 13:48:32 -07:00
pyth0n1c c1d144e0d5 auto_escape fix with either not picked up by semgrep because it was changing a global jinja2 configuration or because it didn't actually fix what we thought it would. Setting the global default is probably the best idea since if another function call doesn't explicitly set it, then it won't be set. However, we leave it like this for now. 2021-08-12 13:43:54 -07:00
pyth0n1c 88b2a47a4c Converted humvee md5 check to sha256 check for increased integrity in response to semgrep recommendation. 2021-08-12 13:35:18 -07:00
pyth0n1c b6b5f9317f Using the proper commandline to generate sha256 checksum of files. Added autoescaping to the Jinja2 templates in response to semgrep results. 2021-08-12 13:26:29 -07:00
mhaag-spl 0728cb8f87 Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm 2021-08-12 14:07:02 -06:00
mhaag-spl ed971abfac Update detect_sharphound_usage.yml 2021-08-12 14:06:59 -06:00
pyth0n1c 9d32f23bbc Removed a large block of commented out code. 2021-08-12 13:04:16 -07:00
pyth0n1c 6d100dbcc9 Uploading additional release artifacts. Moved away from ghr and to an action designed for attaching github release artifacts. This will only run for tagged releases. 2021-08-12 13:03:15 -07:00
pyth0n1c 1cf0f63d8f Merge branch 'develop' of https://github.com/pyth0n1c/security_content into develop 2021-08-12 12:20:08 -07:00
pyth0n1c a875e38d08 Renamed a store_artifacts step 2021-08-12 12:20:02 -07:00
research bot a2bb49f089 updating docs and package bits [ci skip] 2021-08-12 18:43:04 +00:00
github-actions[bot] ecc75732b3 Branch was auto-updated. 2021-08-12 18:15:51 +00:00
github-actions[bot] d8cb7677e0 Branch was auto-updated. 2021-08-12 18:15:39 +00:00
github-actions[bot] d9aec8e5f1 Branch was auto-updated. 2021-08-12 18:15:39 +00:00
github-actions[bot] 1e4fe37d63 Branch was auto-updated. 2021-08-12 18:15:38 +00:00
github-actions[bot] e031738360 Branch was auto-updated. 2021-08-12 18:15:37 +00:00
pyth0n1c 2df1975e5f Merge pull request #1559 from splunk/appinspect_failures
fixes
v3.26.0
2021-08-12 11:15:21 -07:00
pyth0n1c 4a94db95c2 Turned off file output from semgrep - current bug prevents anything from being written. it is okay when it is writted to stdout. 2021-08-12 10:18:22 -07:00
mhaag-spl 1e6e1c795e Update suspicious_msbuild_rename.yml 2021-08-12 10:52:48 -06:00
patel-bhavin cd4df7567a fixes 2021-08-12 09:47:40 -07:00
mhaag-spl 86e78db19a Added detection testing service results inDetect Renamed WinRAR 2021-08-12 10:41:19 -06:00
pyth0n1c 3f23ca062b Merge branch 'splunk:develop' into develop 2021-08-12 09:31:19 -07:00
Jose Enrique Hernandez d1d2aa92dc Rename detect_phishing_content___ssa.yml to ssa___detect_phishing_content.yml 2021-08-12 12:26:04 -04:00
mhaag-spl 611c65f1fc Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm 2021-08-12 09:53:49 -06:00
mhaag-spl fc58b0fe69 Update detect_renamed_winrar.yml 2021-08-12 09:53:42 -06:00
tccontre 0c46b33693 Merge branch 'conti_leak' of github.com:splunk/security_content into conti_leak 2021-08-12 17:49:36 +02:00
tccontre 788c1fb495 conti_leak 2021-08-12 17:49:16 +02:00
mhaag-spl 104e8b3526 Added detection testing service results inDetect Renamed PSExec 2021-08-12 09:43:50 -06:00
mhaag-spl 31b5dc53b3 Update detect_renamed_psexec.yml 2021-08-12 08:55:58 -06:00
mhaag-spl 3576abc8c0 psexec and startw fix 2021-08-12 08:55:39 -06:00
mhaag-spl a49702a9fe Added detection testing service results inDetect microsoft.workflow.compiler.exe usage 2021-08-12 08:23:22 -06:00
mhaag-spl 14e55880cd mwc fix 2021-08-12 07:27:44 -06:00
mhaag-spl 633c3b8f06 Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm 2021-08-12 06:41:03 -06:00
mhaag-spl f538e37f09 Update detect_mshta_renamed.yml 2021-08-12 06:40:52 -06:00
mhaag-spl a2f9ac969c Added detection testing service results inDetect microsoft.workflow.compiler.exe rename 2021-08-12 06:32:45 -06:00
mhaag-spl 915f5ac350 Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm 2021-08-12 05:46:51 -06:00
mhaag-spl 8397af1673 Update suspicious_microsoft_workflow_compiler_usage.yml 2021-08-12 05:46:36 -06:00
Detection Testing Service 4f8b5ad361 Merge branch 'conti_leak' of https://github.com/splunk/security_content into conti_leak 2021-08-12 10:11:40 +00:00
root a89eeababf Added detection testing service results inRundll32 LockWorkStation 2021-08-12 10:11:39 +00:00
root 6e7280e936 Added detection testing service results inUninstall App Using MsiExec 2021-08-12 10:06:47 +00:00
tccontre 568fa87c40 conti_leak 2021-08-12 11:48:18 +02:00
root 899e9d01c0 Added detection testing service results inPowershell Execute COM Object 2021-08-12 09:19:27 +00:00
github-actions[bot] 74e20eb919 Branch was auto-updated. 2021-08-12 08:59:58 +00:00
github-actions[bot] 70d87bc2ce Branch was auto-updated. 2021-08-12 08:59:52 +00:00
github-actions[bot] c3a973657a Branch was auto-updated. 2021-08-12 08:59:51 +00:00
github-actions[bot] 6b4ae84e01 Branch was auto-updated. 2021-08-12 08:59:50 +00:00
tccontre c8d21347b1 Merge pull request #1549 from splunk/icedid
icedid
2021-08-12 10:59:31 +02:00