 Bhavin Patel
|
b60f4a2b5a
|
Update linux_file_creation_in_init_boot_directory.yml
|
2022-01-10 12:30:55 -08:00 |
|
|
d1vious
|
6edaa90519
|
updated generate to match javiers feedback
|
2022-01-10 15:12:30 -05:00 |
|
|
pyth0n1c
|
ff6b6c4397
|
Branch was auto-updated.
|
2022-01-10 12:11:52 -08:00 |
|
|
pyth0n1c
|
273bf8a809
|
Branch was auto-updated.
|
2022-01-10 12:11:51 -08:00 |
|
|
pyth0n1c
|
4e81a8f541
|
Branch was auto-updated.
|
2022-01-10 12:11:49 -08:00 |
|
|
pyth0n1c
|
aa4f1a8cbc
|
Branch was auto-updated.
|
2022-01-10 12:11:48 -08:00 |
|
|
pyth0n1c
|
f1c16ea6c9
|
Branch was auto-updated.
|
2022-01-10 12:11:47 -08:00 |
|
|
pyth0n1c
|
ef018cd9cb
|
Branch was auto-updated.
|
2022-01-10 12:11:45 -08:00 |
|
|
pyth0n1c
|
20cfa5d7db
|
Branch was auto-updated.
|
2022-01-10 12:11:37 -08:00 |
|
|
pyth0n1c
|
10e575a793
|
Branch was auto-updated.
|
2022-01-10 12:11:36 -08:00 |
|
|
pyth0n1c
|
787a5afd99
|
Branch was auto-updated.
|
2022-01-10 12:11:34 -08:00 |
|
|
Bhavin Patel
|
0bdcacd7b3
|
Merge pull request #1869 from splunk/T1059
The Haag at The Gates
|
2022-01-10 12:11:15 -08:00 |
|
|
d1vious
|
871a66ebae
|
changed to use srs and complex division
|
2022-01-10 14:59:29 -05:00 |
|
|
tccontre
|
856635f601
|
linux_persist_priv_batch_4
|
2022-01-10 12:51:04 +01:00 |
|
|
tccontre
|
ef99a8c8bc
|
Update linux_sudoers_tmp_file_creation.yml
|
2022-01-10 12:36:33 +01:00 |
|
|
tccontre
|
f48713b301
|
Update linux_possible_append_command_to_at_allow_config_file.yml
|
2022-01-10 09:46:50 +01:00 |
|
|
tccontre
|
265a1f0494
|
Update linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml
|
2022-01-10 09:44:05 +01:00 |
|
|
tccontre
|
72859e63e8
|
Update linux_possible_append_command_to_at_allow_config_file.yml
|
2022-01-10 09:43:33 +01:00 |
|
|
d1vious
|
067b6e5bbe
|
cleaning up detections
|
2022-01-07 16:04:51 -05:00 |
|
|
d1vious
|
20c0196d7f
|
moving things around
|
2022-01-07 16:04:21 -05:00 |
|
|
Jose Enrique Hernandez
|
6d206d9646
|
Merge pull request #1922 from splunk/doc_gen_remcos
Update docs for upcoming blog
|
2022-01-06 17:45:27 -05:00 |
|
|
Lou Stella
|
a8e2af5782
|
Update docs for upcoming blog
|
2022-01-06 16:38:33 -06:00 |
|
|
Jose Enrique Hernandez
|
b7597fc509
|
Merge pull request #1919 from splunk/playbook_mig_remcos
Playbook migration for remcos
|
2022-01-06 17:08:37 -05:00 |
|
|
Lou Stella
|
988f5d157a
|
Created test dataset & moved detection out of experimental
|
2022-01-06 16:08:08 -06:00 |
|
|
Lou Stella
|
049482c74c
|
Fixed casing per request
|
2022-01-06 15:16:52 -06:00 |
|
|
mhaag-spl
|
89f37444f4
|
Update msi_module_loaded_by_non_system_binary.yml
|
2022-01-06 10:06:40 -07:00 |
|
|
pyth0n1c
|
1dea66d75c
|
Added authorize.conf.tar to make it possible to delete data from completed searches properly.
|
2022-01-05 15:26:43 -08:00 |
|
|
pyth0n1c
|
64abbe4458
|
Significant changes. Most importantly, instead of a hard-coded wait time after uploading data, we poll to make sure that all the data has been indexed. When this is complete, we move ahead with the test. While this costs extra in terms of CPU and Disk access, it usually allows us to go much faster since wait time is usually just a few seconds. Better tracking of time per test and time estimation.
|
2022-01-05 14:39:13 -08:00 |
|
|
Lou Stella
|
334fb25cd0
|
Added malware hunt and contain playbook
|
2022-01-05 13:41:59 -06:00 |
|
|
Lou Stella
|
6819bb1be7
|
Added email notification for malware playbook
|
2022-01-05 13:28:38 -06:00 |
|
|
Lou Stella
|
e396a3b9d4
|
Added block_indicators playbook
|
2022-01-05 12:17:54 -06:00 |
|
|
root
|
9bcad3d21b
|
Added detection testing service results inLinux Change File Owner To Root
|
2022-01-05 16:34:58 +00:00 |
|
|
tccontre
|
cebc5ac4fd
|
Update linux_edit_cron_table_parameter.yml
|
2022-01-05 16:38:48 +01:00 |
|
|
tccontre
|
204670cbe1
|
Update linux_at_allow_config_file_creation.yml
|
2022-01-05 16:33:43 +01:00 |
|
|
root
|
2e9f51cca4
|
Added detection testing service results inLinux File Created In Kernel Driver Directory
|
2022-01-05 14:34:31 +00:00 |
|
|
root
|
64dfd4a621
|
Added detection testing service results inLinux Install Kernel Module Using Modprobe Utility
|
2022-01-05 13:08:14 +00:00 |
|
|
root
|
a1a6087bcd
|
Added detection testing service results inLinux Sudoers Tmp File Creation
|
2022-01-05 12:38:46 +00:00 |
|
|
tccontre
|
06ffa22394
|
Update linux_sudoers_tmp_file_creation.yml
|
2022-01-05 13:20:37 +01:00 |
|
|
tccontre
|
ab844e062f
|
linux_persist_priv_batch_3
|
2022-01-05 13:17:08 +01:00 |
|
|
root
|
fb306cb79b
|
Added detection testing service results inLinux Visudo Utility Execution
|
2022-01-05 12:12:09 +00:00 |
|
|
tccontre
|
14534c2f53
|
Merge branch 'linux_persist_priv_batch_3' of github.com:splunk/security_content into linux_persist_priv_batch_3
|
2022-01-05 12:48:02 +01:00 |
|
|
tccontre
|
377a4822f7
|
linux_persist_priv_batch_3
|
2022-01-05 12:47:45 +01:00 |
|
|
root
|
78e61e8ee4
|
Added detection testing service results inLinux Change File Owner To Root
|
2022-01-05 11:42:47 +00:00 |
|
|
tccontre
|
37185f3e0d
|
linux_persist_priv_batch_3
|
2022-01-05 11:34:57 +01:00 |
|
|
tccontre
|
fa843067da
|
Merge pull request #1917 from splunk/remocs_desc_update
remcos_desc_update
|
2022-01-05 09:41:08 +01:00 |
|
|
tccontre
|
78732dfe2d
|
Update linux_file_creation_in_profile_directory.yml
|
2022-01-04 18:00:42 +01:00 |
|
|
tccontre
|
e8cde0b1f6
|
Update linux_file_creation_in_init_boot_directory.yml
|
2022-01-04 17:59:26 +01:00 |
|
|
pyth0n1c
|
e10f55348c
|
Updated Detection Text
Updated Text of Detection "Suspicious Process DNS Query Known Abuse Web Services"
|
2022-01-04 08:47:13 -08:00 |
|
|
pyth0n1c
|
8891384376
|
Small Text Update
Small Text Update to "Loading Of Dynwrapx Module"
|
2022-01-04 08:42:39 -08:00 |
|
|
tccontre
|
7420f730d4
|
Update suspicious_process_dns_query_known_abuse_web_services.yml
|
2022-01-04 17:39:17 +01:00 |
|