 Jose Enrique Hernandez
|
0934e5ea2f
|
Merge pull request #1860 from splunk/BA
Data Stream Haag
|
2021-12-08 12:36:06 -05:00 |
|
|
mhaag-spl
|
44bf73018a
|
wbadmin
|
2021-12-07 13:31:19 -07:00 |
|
|
mhaag-spl
|
51a47f76df
|
Update ssa___bcdedit_failure_recovery_modification.yml
|
2021-12-07 12:30:48 -07:00 |
|
|
mhaag-spl
|
e2abbaffe1
|
fsutil and bcdedit
|
2021-12-07 12:19:41 -07:00 |
|
|
mhaag-spl
|
16849ba96e
|
Update ssa___dns_exfiltration_using_nslookup_app.yml
|
2021-12-07 11:58:44 -07:00 |
|
|
mhaag-spl
|
77d186e946
|
Update ssa___dns_exfiltration_using_nslookup_app.yml
|
2021-12-07 11:51:15 -07:00 |
|
|
mhaag-spl
|
6b36d8c6ec
|
DNS Exfil
|
2021-12-07 11:43:34 -07:00 |
|
|
mhaag-spl
|
b51b7dbdf1
|
Update ssa___detect_rclone_command_line_usage.yml
|
2021-12-07 11:40:46 -07:00 |
|
|
mhaag-spl
|
11784add74
|
Update ssa___detect_rclone_command_line_usage.yml
|
2021-12-06 18:18:45 -07:00 |
|
|
patel-bhavin
|
c477482c73
|
risk_scores
|
2021-12-06 14:10:11 -08:00 |
|
|
Michael Haag
|
6ee79abe31
|
Update ssa___windows_curl_upload_to_remote_destination.yml
|
2021-12-06 14:52:01 -07:00 |
|
|
mhaag-spl
|
f54c806b44
|
Merge branch 're-ssa' of https://github.com/splunk/security_content into re-ssa
|
2021-12-06 13:27:38 -07:00 |
|
|
mhaag-spl
|
228330b182
|
Update ssa___attempt_to_disable_services.yml
|
2021-12-06 13:27:36 -07:00 |
|
|
Bhavin Patel
|
11f1805412
|
Branch was auto-updated.
|
2021-12-06 11:51:55 -08:00 |
|
|
Bhavin Patel
|
3fd03418db
|
Branch was auto-updated.
|
2021-12-06 11:51:49 -08:00 |
|
|
d1vious
|
b9b6912d97
|
adding eventid from customer convo
|
2021-12-06 14:42:14 -05:00 |
|
|
mhaag-spl
|
a6895729d3
|
fixes
|
2021-12-06 12:34:59 -07:00 |
|
|
Jose Enrique Hernandez
|
b7cd6b0700
|
Update ssa___rare_parent_process_relationship_lolbas.yml
|
2021-12-06 14:13:03 -05:00 |
|
|
Bhavin Patel
|
10b5d5f980
|
Branch was auto-updated.
|
2021-12-06 11:04:15 -08:00 |
|
|
Bhavin Patel
|
5aade90ec2
|
Branch was auto-updated.
|
2021-12-06 11:04:14 -08:00 |
|
|
mhaag-spl
|
25dc457c3c
|
The Unbroken Haag
|
2021-12-06 11:57:20 -07:00 |
|
|
mhaag-spl
|
575cb1dcf4
|
Update ssa___detect_rclone_command_line_usage.yml
|
2021-12-03 11:29:34 -07:00 |
|
|
mhaag-spl
|
0e53970750
|
First SSA
|
2021-12-03 11:26:27 -07:00 |
|
|
mhaag-spl
|
a862fd7d4a
|
Update net_localgroup_discovery.yml
|
2021-12-03 10:19:40 -07:00 |
|
|
mhaag-spl
|
370ef774ed
|
minor fixes - passed validate
|
2021-12-03 06:01:32 -07:00 |
|
|
mhaag-spl
|
c21877ceb8
|
A Nightmare on Haag Street
## Updated Analytics
Attempt To Delete Services
Attempt To Disable Services
Attempted Credential Dump From Registry via Reg exe
Delete a net user
Deny Permission using Cacls Utility
Detect Dump LSASS Memory using comsvcs
Disable Net User Account
First time seen command line argument
Grant Permission Using Cacls Utility
Prohibited apps spawning cmdprompt
Potential Pass the Token or Hash Observed at the Destination Device
Rare Parent-Child Process Relationship
ptt pth kerb ntlm origin device
Resize Shadowstorage Volume
sdelete application execution
## Deprecated BA Analytics
ssa___applying_stolen_credentials_via_mimikatz_modules.yml
ssa___applying_stolen_credentials_via_powersploit_modules.yml
ssa___assess_credential_strength_via_dsinternals_modules.yml
ssa___credential_extraction_dsinternals_conversion_modules.yml
Ssa___credential_extraction_dsinternals_modules.yml
Ssa___credential_extraction_getaddbaccount_from_dump.yml
Ssa___credential_extraction_powersploit_modules.yml
ssa___illegal_access_user_content_via_powersploit_modules.yml
ssa___illegal_account_creation_via_powersploit_modules.yml
ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
ssa___illegal_log_deletion_via_mimikatz_modules.yml
ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
Ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
ssa___illegal_service_and_process_control_via_powersploit_modules.yml
Ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
ssa___recon_and_use_computers_via_mimikatz_modules.yml
ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
ssa___recon_and_use_shares_via_mimikatz_modules.yml
ssa___recon_and_use_shares_via_powersploit_modules.yml
Ssa___recon_connectivity_via_powersploit_modules.yml
ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
ssa___recon_defensive_tools_via_powersploit_modules.yml
ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
ssa___recon_processes_and_services_via_mimikatz_modules.yml
ssa___setting_credentials_via_dsinternals_modules.yml
ssa___setting_credentials_via_mimikatz_modules.yml
ssa___setting_credentials_via_powersploit_modules.yml
ssa___credential_extraction_fgdump_cachedump_s_option.yml
Ssa___credential_extraction_fgdump_cachedump_v_option.yml
ssa___credential_extraction_ms_debuggers_kernel_peek.yml
ssa___credential_extraction_ms_debuggers_z_option.yml
Ssa___credential_extraction_lazagne_command_options.yml
|
2021-12-03 05:57:54 -07:00 |
|
|
research bot
|
750c81fb5b
|
updating docs and package bits [ci skip]
|
2021-12-02 18:50:01 +00:00 |
|
|
David Dorsey
|
0df7bf2cdc
|
Extra filters for java
|
2021-12-02 08:54:12 -06:00 |
|
|
Bhavin Patel
|
57c1ef30dd
|
Merge pull request #1857 from splunk/RegistryDetectionFixes
Registry detection fixes
|
2021-12-01 15:41:01 -08:00 |
|
|
pyth0n1c
|
3a8dc379bd
|
Restoring modified files because they do not work with the new sysmon. Now, all of the detections in this branch work.
|
2021-12-01 14:36:49 -08:00 |
|
|
David Dorsey
|
76858554a3
|
Merge branch 'develop' into ssa_why_chrome_why
|
2021-12-01 14:04:22 -06:00 |
|
|
Michael Haag
|
6999693e3b
|
fixed
|
2021-12-01 12:34:20 -07:00 |
|
|
Michael Haag
|
f0157408a7
|
Updated some words
|
2021-12-01 12:28:38 -07:00 |
|
|
David Dorsey
|
3872168920
|
Merge branch 'ssa_why_chrome_why' of github.com:splunk/security-content into ssa_why_chrome_why
|
2021-12-01 13:15:52 -06:00 |
|
|
David Dorsey
|
31342ab905
|
Fixed data model
|
2021-12-01 13:15:39 -06:00 |
|
|
Michael Haag
|
7300bfe836
|
Update ssa___resize_shadowstorage_volume.yml
|
2021-12-01 11:50:33 -07:00 |
|
|
Bhavin Patel
|
20317e465f
|
Branch was auto-updated.
|
2021-12-01 10:31:32 -08:00 |
|
|
Bhavin Patel
|
6dd8123c0d
|
Branch was auto-updated.
|
2021-12-01 10:31:28 -08:00 |
|
|
David Dorsey
|
87f62f2177
|
Fixed data model
|
2021-11-30 22:23:31 -06:00 |
|
|
Bhavin Patel
|
78be05b638
|
Branch was auto-updated.
|
2021-11-30 16:19:11 -08:00 |
|
|
Bhavin Patel
|
46b368785a
|
Branch was auto-updated.
|
2021-11-30 16:19:10 -08:00 |
|
|
Bhavin Patel
|
dd2475c402
|
Branch was auto-updated.
|
2021-11-30 16:19:10 -08:00 |
|
|
Bhavin Patel
|
698356d345
|
Branch was auto-updated.
|
2021-11-30 12:02:08 -08:00 |
|
|
Bhavin Patel
|
991d5ab905
|
Branch was auto-updated.
|
2021-11-30 12:02:06 -08:00 |
|
|
Bhavin Patel
|
78fec6e11e
|
Branch was auto-updated.
|
2021-11-30 12:02:05 -08:00 |
|
|
Bhavin Patel
|
3bdbba50e0
|
Branch was auto-updated.
|
2021-11-30 12:02:05 -08:00 |
|
|
root
|
e1947f155a
|
Added detection testing service results inDetect RClone Command-Line Usage
|
2021-11-30 12:56:06 +00:00 |
|
|
Michael Haag
|
bae2e35b1c
|
fix
|
2021-11-29 16:19:21 -07:00 |
|
|
mhaag-spl
|
81e952185e
|
Rclone Haagrid
|
2021-11-29 15:55:38 -07:00 |
|
|
mhaag-spl
|
fe7817f28a
|
Update detect_html_help_renamed.yml
Fixing issue #1849
|
2021-11-29 13:43:41 -07:00 |
|