admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
5,145 Commits 697 Branches 195 Tags
cloud_appinspect_check
Commit Graph

226 Commits

Author SHA1 Message Date
mhaag-spl 0aa830c26d fixes 2021-03-03 14:54:56 -07:00
mhaag-spl ac49f9ab9e HAFNIUM and more updates 2021-03-03 14:10:11 -07:00
mhaag-spl f408036e4a Create windows_disableantispyware_reg.test.yml 2021-03-02 15:21:55 -07:00
mhaag-spl e6fd5ba6c7 Update any_powershell_downloadstring.test.yml 2021-03-02 15:02:51 -07:00
mhaag-spl faca9affeb Update suspicious_scheduled_task_from_public_directory.test.yml 2021-03-02 15:01:54 -07:00
mhaag-spl d5cdffe5fa Update fodhelper_uac_bypass.test.yml 2021-03-02 12:52:07 -07:00
mhaag-spl 0e18f64414 powershell 2021-03-02 09:43:31 -07:00
mhaag-spl 16627bf207 update url 2021-03-01 18:28:25 -07:00
mhaag-spl 9794fd13fb Any PowerShell DownloadString 2021-03-01 16:02:36 -07:00
mhaag-spl bd2c69ec28 Eventvwr UAC Bypass 2021-03-01 15:18:27 -07:00
mhaag-spl bcbd2ebb19 Fodhelper uac bypass 2021-03-01 13:38:06 -07:00
mhaag-spl 5a09edf797 Suspicious Scheduled Task from Public Directory 2021-03-01 12:45:22 -07:00
mhaag-spl a576744f88 Ryuk Wake on LAN 2021-03-01 10:07:12 -07:00
mhaag-spl 75998a3ddf SearchprotocolHost 2021-02-23 15:04:11 -07:00
mhaag-spl 393065bc66 Update suspicious_dllhost_no_command_line_arguments.test.yml 2021-02-23 14:22:23 -07:00
mhaag-spl b7f587b127 Update suspicious_gpupdate_no_command_line_arguments.test.yml 2021-02-23 13:48:57 -07:00
mhaag-spl bb5bc07dab fixes and new 2021-02-23 13:04:17 -07:00
mhaag-spl 9188143fea gpupdate no cmdline arguments 2021-02-23 12:34:52 -07:00
mhaag-spl 03db8006d8 Named Pipes + update 2021-02-22 15:26:35 -07:00
github-actions[bot] bd92943d0e Branch was auto-updated. 2021-02-17 19:28:17 +00:00
bpatel 75b8c1a03d _timeupdate 2021-02-17 10:09:38 -08:00
mhaag-spl 756aeb3987 Update detect_regsvcs_with_no_command_line_arguments.test.yml 2021-02-16 11:56:19 -07:00
mhaag-spl 57ce41d8bc regsvcs no clargs 2021-02-16 11:53:55 -07:00
mhaag-spl 098f12300b regasm no cl arguments 2021-02-16 11:22:07 -07:00
mhaag-spl ad7a3d476a regasm-regsvcs-network 2021-02-16 07:16:05 -07:00
mhaag-spl fd3910ae5b test files 2021-02-12 12:10:53 -07:00
mhaag-spl cc10bb66e6 hh renamed 
hh renamed
 2021-02-11 15:15:30 -07:00
mhaag-spl 445f0f6293 InfoTech Storage Handlers 2021-02-11 15:03:13 -07:00
mhaag-spl 98e4b094ab HTML help spawning a child 2021-02-11 14:35:06 -07:00
mhaag-spl c1380a5641 Merge branch 'develop' into 02rel2 2021-02-11 14:21:33 -07:00
mhaag-spl ba44c1a3b1 T1218.001 remote CHM 
hh.exe with http in command line
 2021-02-11 14:21:07 -07:00
github-actions[bot] 3d43ef0516 Branch was auto-updated. 2021-02-11 18:45:29 +00:00
bpatel 1c8dc0c0d0 change time 2021-02-11 09:02:22 -08:00
bpatel c27a46bd40 update test time 2021-02-10 14:40:13 -08:00
bpatel 405ebb4dae spl update and test file 2021-02-09 16:33:53 -08:00
mhaag-spl 07ffc993b4 removing for now 2021-02-09 14:14:49 -07:00
mhaag-spl 157d8770e6 rundll32 dllregisterserver 2021-02-09 12:10:39 -07:00
mhaag-spl bc508128e9 misspell 2021-02-09 11:27:19 -07:00
mhaag-spl 3ead4c2840 rundll32 with no cmdline arguments 2021-02-09 11:25:01 -07:00
mhaag-spl f89c21964d Rundll32,StartW 
Adding content to detect Rundll32 using function name Start/StartW on the commandline. Typically used with CobaltStrike.
 2021-02-09 10:54:34 -07:00
mhaag-spl 3d37e93d99 rundll32 syssetup, setupapi 
Adding rundll32 syssetup and setupapi
 2021-02-05 07:27:02 -07:00
mhaag-spl b2aed2b816 rundll32 advpack and rename 2021-02-04 14:38:54 -07:00
github-actions[bot] 147624dc32 Branch was auto-updated. 2021-02-04 01:21:00 +00:00
mhaag-spl dd6286bd04 Creation of lsass dump with taskmgr 2021-02-03 14:57:59 -07:00
mhaag-spl d138f4ea8c procdump rename 
renamed procdump query using sysmon
 2021-02-03 09:58:51 -07:00
github-actions[bot] b6b333d756 Branch was auto-updated. 2021-02-03 16:35:51 +00:00
github-actions[bot] 15c742eb46 Branch was auto-updated. 2021-02-03 16:35:46 +00:00
P4T12ICK 623c8fee33 moved to experimental 2021-02-03 17:03:19 +01:00
Ignacio Bermudez Corrales 497714f09b added more test corner cases 2021-02-02 22:13:05 -08:00
Ignacio Bermudez Corrales 61615abcc6 regex to handle path corner case 2021-02-02 17:50:38 -08:00