admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
12,922 Commits 697 Branches 195 Tags
DetectionTestingDocker
Commit Graph

12922 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
P4T12ICK 8b1e40a546 update type 2021-07-21 16:21:45 +02:00
github-actions[bot] 9a78b89f3b Branch was auto-updated. 2021-07-21 14:14:28 +00:00
github-actions[bot] 03a9e5f2ea Branch was auto-updated. 2021-07-21 14:14:26 +00:00
github-actions[bot] 94cc31cc64 Branch was auto-updated. 2021-07-21 14:14:23 +00:00
P4T12ICK 0d8da0488e Merge pull request #1496 from splunk/uac_bypass 
uac
 2021-07-21 16:14:05 +02:00
P4T12ICK ca8565c034 test circleci 2021-07-21 16:09:28 +02:00
sec-researcher ee3f8638c4 As I know PTR requests can not be used for data exfiltration so having them in search result is just a false positive. Also they have effect on deviation calculation and lead to a lot of false positive in result, specially when PTR requests in the environment is about 20% or more. So I add this filter to the search 'where NOT DNS.message_type IN("Pointer","PTR")' 2021-07-21 18:20:15 +04:30
P4T12ICK 618e2fbf21 test circleci 2021-07-21 15:32:25 +02:00
P4T12ICK d3db4a0b1b Merge branch 'develop' into uac_bypass 2021-07-21 14:59:18 +02:00
Detection Testing Service d6db4af59f Merge branch 'uac_bypass' of https://github.com/splunk/security_content into uac_bypass 2021-07-21 10:46:45 +00:00
root bbfcfb9aac Added detection testing service results inUAC Bypass MMC Load Unsigned Dll 2021-07-21 10:46:45 +00:00
P4T12ICK 21f8ef2990 updated stories 2021-07-21 12:41:06 +02:00
tccontre f3501d056e uac 2021-07-21 12:33:33 +02:00
P4T12ICK 80be6029de updated stories 2021-07-21 12:26:15 +02:00
tccontre a6fb638b9c Update mshta_spawning_rundll32_or_regsvr32_process.yml 2021-07-21 12:23:36 +02:00
tccontre 87a46e76cb Update wsreset_uac_bypass.yml 2021-07-21 12:22:24 +02:00
P4T12ICK 76bbbe4609 add deployments to baselines 2021-07-21 11:31:40 +02:00
P4T12ICK d633c92513 bug fix 2021-07-21 09:24:07 +02:00
P4T12ICK 5e6e987fb7 resolved merge conflicts 2021-07-21 09:22:09 +02:00
root 0dbf7fdab6 Added detection testing service results inDetect shared ec2 snapshot 2021-07-20 23:41:56 +00:00
patel-bhavin 4a1841fbed updates 2021-07-20 15:37:36 -07:00
Bhavin Patel 8d8bdaeaab Merge branch 'develop' into aws_snap_exfil 2021-07-20 15:16:07 -07:00
research bot 44ea56053d updating docs and package bits [ci skip] 2021-07-20 21:12:30 +00:00
github-actions[bot] df6e6c6a5e Branch was auto-updated. 2021-07-20 20:41:12 +00:00
github-actions[bot] 51b30268b5 Branch was auto-updated. 2021-07-20 20:41:11 +00:00
github-actions[bot] 2a81a8400a Branch was auto-updated. 2021-07-20 20:41:05 +00:00
Bhavin Patel 0872f02a13 Merge pull request #1511 from splunk/Risky 
Risky Based Analytics
v3.25.2 		2021-07-20 13:40:49 -07:00
github-actions[bot] c8cdf9162e Branch was auto-updated. 2021-07-20 20:34:50 +00:00
github-actions[bot] 82e9884b93 Branch was auto-updated. 2021-07-20 20:34:45 +00:00
github-actions[bot] 14c82ee203 Branch was auto-updated. 2021-07-20 20:34:45 +00:00
github-actions[bot] 8b83e2a888 Branch was auto-updated. 2021-07-20 20:34:44 +00:00
Bhavin Patel 9560018229 Merge pull request #1534 from splunk/fixes 
validate fix:
 2021-07-20 13:34:27 -07:00
patel-bhavin 23adb90bdc validate fix: 2021-07-20 13:20:31 -07:00
mhaag-spl ce0ffe6cb8 Update office_application_spawn_rundll32_process.yml 2021-07-20 14:08:10 -06:00
patel-bhavin 4d714cd6f6 snap 2021-07-20 12:55:18 -07:00
Michael Haag 2f33b99816 Merge branch 'develop' into Risky 2021-07-20 13:47:15 -06:00
github-actions[bot] 780ac5f61c Branch was auto-updated. 2021-07-20 19:45:26 +00:00
github-actions[bot] f4164d845a Branch was auto-updated. 2021-07-20 19:45:20 +00:00
Jose Enrique Hernandez 3d9573d14c Merge pull request #1532 from splunk/TR_794 
Mustang bug fixes
 2021-07-20 15:43:59 -04:00
github-actions[bot] 11e270ec33 Branch was auto-updated. 2021-07-20 19:43:31 +00:00
github-actions[bot] ed7f7456b6 Branch was auto-updated. 2021-07-20 19:43:24 +00:00
github-actions[bot] 20601cc215 Branch was auto-updated. 2021-07-20 19:43:21 +00:00
Jose Enrique Hernandez c076fc99d4 Merge pull request #1506 from splunk/TR-772_rba 
TR-772 - Rba support
 2021-07-20 15:43:04 -04:00
Jose Enrique Hernandez 153fe9b32b Merge branch 'develop' into TR-772_rba 2021-07-20 15:42:56 -04:00
mvelazco 589d3f92ed fixing extra space 2021-07-20 13:53:50 -04:00
research bot 3740535cca updating docs and package bits [ci skip] 2021-07-20 17:49:09 +00:00
github-actions[bot] d74c858cdd Branch was auto-updated. 2021-07-20 15:56:34 +00:00
github-actions[bot] 5e909eea9b Branch was auto-updated. 2021-07-20 15:56:32 +00:00
github-actions[bot] 9b53b88871 Branch was auto-updated. 2021-07-20 15:56:29 +00:00
github-actions[bot] 5ebfbc10c2 Branch was auto-updated. 2021-07-20 15:56:26 +00:00