admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
12,922 Commits 697 Branches 195 Tags
DetectionTestingDocker
Commit Graph

12922 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Jose Enrique Hernandez 24591c1022 Merge pull request #1863 from splunk/minor_ba_cleanup 
Teenage Mutant Ninja Haags
 2021-12-06 14:51:30 -05:00
pyth0n1c 652355a124 Typo in branch name caused an error during checking. 2021-12-06 11:51:14 -08:00
d1vious b9b6912d97 adding eventid from customer convo 2021-12-06 14:42:14 -05:00
pyth0n1c 9be4d1a4eb Large changes to json validation for local_apps. json validation was wrong. also changed CI to run on push and on PR using the new CI job! Note that it will still require lots of testing. 2021-12-06 11:41:35 -08:00
mhaag-spl a6895729d3 fixes 2021-12-06 12:34:59 -07:00
Jose Enrique Hernandez b7cd6b0700 Update ssa___rare_parent_process_relationship_lolbas.yml 2021-12-06 14:13:03 -05:00
Bhavin Patel dd5598f3a7 Branch was auto-updated. 2021-12-06 11:04:18 -08:00
Bhavin Patel c80309c060 Branch was auto-updated. 2021-12-06 11:04:17 -08:00
Bhavin Patel d267ed5477 Branch was auto-updated. 2021-12-06 11:04:16 -08:00
Bhavin Patel 10b5d5f980 Branch was auto-updated. 2021-12-06 11:04:15 -08:00
Bhavin Patel 5aade90ec2 Branch was auto-updated. 2021-12-06 11:04:14 -08:00
Bhavin Patel e5fd9f9fe7 Branch was auto-updated. 2021-12-06 11:04:13 -08:00
pyth0n1c 0020841ba4 Merge pull request #1862 from splunk/the-unseen 
The Unbroken Haag
 2021-12-06 11:03:51 -08:00
Bhavin Patel cdf5ede9b8 Branch was auto-updated. 2021-12-06 10:59:21 -08:00
Bhavin Patel 9453165aac Branch was auto-updated. 2021-12-06 10:59:20 -08:00
Bhavin Patel 858681fe56 Branch was auto-updated. 2021-12-06 10:59:19 -08:00
Bhavin Patel 5bee3b0855 Branch was auto-updated. 2021-12-06 10:59:18 -08:00
Bhavin Patel a01416cacf Branch was auto-updated. 2021-12-06 10:59:17 -08:00
Bhavin Patel 063cb87d85 Branch was auto-updated. 2021-12-06 10:59:16 -08:00
Bhavin Patel eb1ef77a37 Branch was auto-updated. 2021-12-06 10:59:10 -08:00
pyth0n1c a9019252ba Merge pull request #1823 from splunk/publish_build_to_pre_qa 
Publish build to pre qa
 2021-12-06 10:58:50 -08:00
mhaag-spl 25dc457c3c The Unbroken Haag 2021-12-06 11:57:20 -07:00
Bhavin Patel 8b266f664d Branch was auto-updated. 2021-12-06 10:27:03 -08:00
Bhavin Patel 96f9af1693 Branch was auto-updated. 2021-12-06 10:26:58 -08:00
Bhavin Patel ac38e8dbab Branch was auto-updated. 2021-12-06 10:26:57 -08:00
Bhavin Patel ce935b353b Branch was auto-updated. 2021-12-06 10:26:55 -08:00
Bhavin Patel cd31c66a6e Branch was auto-updated. 2021-12-06 10:26:54 -08:00
Bhavin Patel e80abc3b39 Branch was auto-updated. 2021-12-06 10:26:52 -08:00
Bhavin Patel a39b02eec7 Branch was auto-updated. 2021-12-06 10:26:51 -08:00
Jose Enrique Hernandez 02f73f64a0 Merge pull request #1861 from splunk/TR-880_fixing_ssa_package 
Minor SSA package updates
 2021-12-06 13:26:18 -05:00
d1vious bfa0500ed7 Merge branch 'develop' into TR-880_fixing_ssa_package 2021-12-06 13:12:12 -05:00
mvelazco 0431d06e71 Merge branch 'TR-1085_LateralMovement_4' of github.com:splunk/security_content into TR-1085_LateralMovement_4 2021-12-03 21:12:33 -05:00
mvelazco 20425018bc minor fixes 2021-12-03 21:12:31 -05:00
root 3cf105d7a6 Added detection testing service results inShort Lived Scheduled Task 2021-12-03 21:22:38 +00:00
mvelazco 71410ddb7a 3 new detections 2021-12-03 15:58:00 -05:00
mhaag-spl 575cb1dcf4 Update ssa___detect_rclone_command_line_usage.yml 2021-12-03 11:29:34 -07:00
mhaag-spl 0e53970750 First SSA 2021-12-03 11:26:27 -07:00
mhaag-spl a862fd7d4a Update net_localgroup_discovery.yml 2021-12-03 10:19:40 -07:00
mhaag-spl 370ef774ed minor fixes - passed validate 2021-12-03 06:01:32 -07:00
mhaag-spl c21877ceb8 A Nightmare on Haag Street 
## Updated Analytics
Attempt To Delete Services
Attempt To Disable Services
Attempted Credential Dump From Registry via Reg exe
Delete a net user
Deny Permission using Cacls Utility
Detect Dump LSASS Memory using comsvcs
Disable Net User Account
First time seen command line argument
Grant Permission Using Cacls Utility
Prohibited apps spawning cmdprompt
Potential Pass the Token or Hash Observed at the Destination Device
Rare Parent-Child Process Relationship
ptt pth kerb ntlm origin device
Resize Shadowstorage Volume
sdelete application execution

## Deprecated BA Analytics
ssa___applying_stolen_credentials_via_mimikatz_modules.yml
ssa___applying_stolen_credentials_via_powersploit_modules.yml
ssa___assess_credential_strength_via_dsinternals_modules.yml
ssa___credential_extraction_dsinternals_conversion_modules.yml
Ssa___credential_extraction_dsinternals_modules.yml
Ssa___credential_extraction_getaddbaccount_from_dump.yml
Ssa___credential_extraction_powersploit_modules.yml
ssa___illegal_access_user_content_via_powersploit_modules.yml
ssa___illegal_account_creation_via_powersploit_modules.yml
ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
ssa___illegal_log_deletion_via_mimikatz_modules.yml
ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
Ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
ssa___illegal_service_and_process_control_via_powersploit_modules.yml
Ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
ssa___recon_and_use_computers_via_mimikatz_modules.yml
ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
ssa___recon_and_use_shares_via_mimikatz_modules.yml
ssa___recon_and_use_shares_via_powersploit_modules.yml
Ssa___recon_connectivity_via_powersploit_modules.yml
ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
ssa___recon_defensive_tools_via_powersploit_modules.yml
ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
ssa___recon_processes_and_services_via_mimikatz_modules.yml
ssa___setting_credentials_via_dsinternals_modules.yml
ssa___setting_credentials_via_mimikatz_modules.yml
ssa___setting_credentials_via_powersploit_modules.yml

ssa___credential_extraction_fgdump_cachedump_s_option.yml
Ssa___credential_extraction_fgdump_cachedump_v_option.yml
ssa___credential_extraction_ms_debuggers_kernel_peek.yml
ssa___credential_extraction_ms_debuggers_z_option.yml
Ssa___credential_extraction_lazagne_command_options.yml
 2021-12-03 05:57:54 -07:00
research bot 750c81fb5b updating docs and package bits [ci skip] 2021-12-02 18:50:01 +00:00
pyth0n1c 17726fcdff Running a test with the old sysmon to compare the results. 2021-12-02 10:00:01 -08:00
Bhavin Patel 2c0bc58a6a Branch was auto-updated. 2021-12-02 09:02:10 -08:00
Bhavin Patel 51ccf14ddf Branch was auto-updated. 2021-12-02 09:02:08 -08:00
Bhavin Patel fba1d395b5 Branch was auto-updated. 2021-12-02 09:02:07 -08:00
Bhavin Patel 6eadae069a Branch was auto-updated. 2021-12-02 09:02:04 -08:00
Bhavin Patel 3074f69e25 Branch was auto-updated. 2021-12-02 09:02:01 -08:00
Bhavin Patel fa2a204672 Merge pull request #1858 from splunk/ssa_why_java_why 
Extra filters for java
v3.31.0 		2021-12-02 09:01:40 -08:00
David Dorsey 0df7bf2cdc Extra filters for java 2021-12-02 08:54:12 -06:00
pyth0n1c 6457b505db When there is an error checking out a git PR. If the PR number is bad, we will exit. Also updated the CI/CD to test all of develop again. We will look at the results after we have increased the wait time after loading data a bit. 2021-12-01 15:58:31 -08:00