admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
8,971 Commits 697 Branches 195 Tags
devsec_ops
Commit Graph

8971 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Bhavin Patel 7f1e68eea6 Merge pull request #1536 from sec-researcher/optimized 
Filter PTR requests to optimize deviation calculation and remove them from result.
 2021-07-27 13:53:02 -07:00
Bhavin Patel 4d3c12cf26 Merge branch 'develop' into optimized 2021-07-27 13:02:37 -07:00
Jose Enrique Hernandez 3807152d0a Merge pull request #1510 from splunk/dependabot/pip/splunk-sdk-1.6.16 
Bump splunk-sdk from 1.6.15 to 1.6.16
 2021-07-27 16:01:33 -04:00
root 2fd2af4d29 Added detection testing service results inDNS Query Length With High Standard Deviation 2021-07-27 19:59:57 +00:00
Jose Enrique Hernandez 4eb9a75f80 Merge branch 'develop' into optimized 2021-07-27 10:54:35 -04:00
github-actions[bot] 5ffddf539e Branch was auto-updated. 2021-07-26 16:11:51 +00:00
Bhavin Patel 6fb05a1b9f Merge pull request #1542 from splunk/Shadowsinthecopy 
SAM I AM
 2021-07-26 09:11:29 -07:00
Michael Haag 48165c7e35 Merge branch 'develop' into Shadowsinthecopy 2021-07-23 14:10:05 -06:00
mhaag-spl ba92a642a8 SAM I AM 
I AM SAM
 2021-07-23 14:06:27 -06:00
github-actions[bot] c6639226df Branch was auto-updated. 2021-07-22 19:42:29 +00:00
Michael Haag d1ac094077 Merge pull request #1537 from splunk/Shadowsinthecopy 
4104 Shadow Copy
 2021-07-22 13:42:08 -06:00
github-actions[bot] b7a650741d Branch was auto-updated. 2021-07-22 19:12:53 +00:00
github-actions[bot] f82a26bf8a Branch was auto-updated. 2021-07-22 19:12:52 +00:00
Bhavin Patel a761479f6f Merge pull request #1533 from splunk/aws_snap_exfil 
AWS Exfil
 2021-07-22 12:12:35 -07:00
Michael Haag ad44baef29 Update detect_shared_ec2_snapshot.yml 2021-07-22 13:06:23 -06:00
github-actions[bot] 48babd0a33 Branch was auto-updated. 2021-07-22 16:43:08 +00:00
github-actions[bot] 8e6ab78a8f Branch was auto-updated. 2021-07-22 16:43:07 +00:00
github-actions[bot] d09c80c1cc Branch was auto-updated. 2021-07-22 16:42:56 +00:00
Bhavin Patel 225afaa035 Merge pull request #1540 from splunk/git-fix 
The Haag Continuum
 2021-07-22 09:42:41 -07:00
mhaag-spl afe1d8a286 Update detect_copy_of_shadowcopy_with_script_block_logging.yml 2021-07-22 06:55:12 -06:00
mhaag-spl 9acd9f32f7 Update detect_renamed_psexec.yml 
Resolving #1525 . Thank you!
 2021-07-22 06:20:47 -06:00
mhaag-spl d207154de3 Update detect_renamed_winrar.yml 
Resolving #1524. Thank you!
 2021-07-22 06:19:55 -06:00
Amir hossein Mahboubi 70dc0c1a59 Merge branch 'develop' into optimized 2021-07-22 16:35:02 +04:30
mhaag-spl e5d24fba22 Update detect_copy_of_shadowcopy_with_script_block_logging.yml 2021-07-21 15:48:36 -06:00
mhaag-spl 28af2af96c Update detect_copy_of_shadowcopy_with_script_block_logging.yml 2021-07-21 15:46:49 -06:00
mhaag-spl e9e56493f8 Update detect_copy_of_shadowcopy_with_script_block_logging.test.yml 2021-07-21 15:44:04 -06:00
mhaag-spl b87f262923 test file 2021-07-21 15:41:42 -06:00
mhaag-spl bd69016d7e PowerShell 4104 copy of Security HIVES 
Modified macro to capture both XML rendered and non. Issue is, if you renderXML for powershell logging, it will have different fields. Something to be aware of.
 2021-07-21 13:57:10 -06:00
github-actions[bot] 9a78b89f3b Branch was auto-updated. 2021-07-21 14:14:28 +00:00
github-actions[bot] 03a9e5f2ea Branch was auto-updated. 2021-07-21 14:14:26 +00:00
P4T12ICK 0d8da0488e Merge pull request #1496 from splunk/uac_bypass 
uac
 2021-07-21 16:14:05 +02:00
sec-researcher ee3f8638c4 As I know PTR requests can not be used for data exfiltration so having them in search result is just a false positive. Also they have effect on deviation calculation and lead to a lot of false positive in result, specially when PTR requests in the environment is about 20% or more. So I add this filter to the search 'where NOT DNS.message_type IN("Pointer","PTR")' 2021-07-21 18:20:15 +04:30
P4T12ICK d3db4a0b1b Merge branch 'develop' into uac_bypass 2021-07-21 14:59:18 +02:00
Detection Testing Service d6db4af59f Merge branch 'uac_bypass' of https://github.com/splunk/security_content into uac_bypass 2021-07-21 10:46:45 +00:00
root bbfcfb9aac Added detection testing service results inUAC Bypass MMC Load Unsigned Dll 2021-07-21 10:46:45 +00:00
tccontre f3501d056e uac 2021-07-21 12:33:33 +02:00
tccontre a6fb638b9c Update mshta_spawning_rundll32_or_regsvr32_process.yml 2021-07-21 12:23:36 +02:00
tccontre 87a46e76cb Update wsreset_uac_bypass.yml 2021-07-21 12:22:24 +02:00
root 0dbf7fdab6 Added detection testing service results inDetect shared ec2 snapshot 2021-07-20 23:41:56 +00:00
patel-bhavin 4a1841fbed updates 2021-07-20 15:37:36 -07:00
Bhavin Patel 8d8bdaeaab Merge branch 'develop' into aws_snap_exfil 2021-07-20 15:16:07 -07:00
research bot 44ea56053d updating docs and package bits [ci skip] 2021-07-20 21:12:30 +00:00
github-actions[bot] df6e6c6a5e Branch was auto-updated. 2021-07-20 20:41:12 +00:00
github-actions[bot] 51b30268b5 Branch was auto-updated. 2021-07-20 20:41:11 +00:00
github-actions[bot] 2a81a8400a Branch was auto-updated. 2021-07-20 20:41:05 +00:00
Bhavin Patel 0872f02a13 Merge pull request #1511 from splunk/Risky 
Risky Based Analytics
v3.25.2 		2021-07-20 13:40:49 -07:00
github-actions[bot] c8cdf9162e Branch was auto-updated. 2021-07-20 20:34:50 +00:00
github-actions[bot] 82e9884b93 Branch was auto-updated. 2021-07-20 20:34:45 +00:00
github-actions[bot] 14c82ee203 Branch was auto-updated. 2021-07-20 20:34:45 +00:00
github-actions[bot] 8b83e2a888 Branch was auto-updated. 2021-07-20 20:34:44 +00:00