1762 Commits

Author	SHA1	Message	Date
mhaag-spl	5daf227b3f	gpupdate	2021-04-19 12:58:24 -06:00
mhaag-spl	c143c99ad8	Update winevent_scheduled_task_created_to_spawn_shell.test.yml	2021-04-19 12:37:35 -06:00
mhaag-spl	9579f2d708	Update rundll32_with_no_command_line_arguments_with_network.test.yml	2021-04-19 11:57:51 -06:00
mhaag-spl	b2dc244920	rundll32	2021-04-19 11:21:05 -06:00
tcontreras	a5cf51e9d5	task_sched	2021-04-19 18:58:16 +02:00
mhaag-spl	ac370189ee	winevent fix	2021-04-19 10:39:42 -06:00
tcontreras	0e3bf4835f	spear2	2021-04-19 16:45:03 +02:00
tcontreras	8f80520df7	spear	2021-04-19 16:40:53 +02:00
mhaag-spl	18586f6bb0	winevents task registered	2021-04-15 14:54:22 -06:00
mvelazco	c84656c87b	adding one extra detection, NTLM spray with invalid users	2021-04-15 10:45:10 -04:00
mvelazco	e0cbf01590	adding 2 extra detections	2021-04-15 09:42:36 -04:00
tccontre	0fa575ad4a	Delete office_application_spawned_cmd_shell.test.yml	2021-04-15 09:46:20 +02:00
mvelazco	271bb6d85a	updaing password spraying detection names	2021-04-14 15:40:17 -04:00
github-actions[bot]	beb49969cf	Branch was auto-updated.	2021-04-14 19:27:09 +00:00
mvelazco	4fa6bd1c72	pushing initial password spraying content ... adding password spraying analytic story and the first detections	2021-04-14 14:00:05 -04:00
tcontreras	71b663937e	spear_detections	2021-04-14 16:00:16 +02:00
github-actions[bot]	646828f597	Branch was auto-updated.	2021-04-14 11:06:12 +00:00
bpatel	0e50d0379f	testing	2021-04-13 10:23:35 -07:00
Michael Haag	505d37f0e0	Merge branch 'develop' into cloudywithachanceofhaags	2021-04-08 15:00:56 -06:00
mhaag-spl	2f5c84460a	TaskService Usage	2021-04-08 14:57:43 -06:00
github-actions[bot]	9833a15fd3	Branch was auto-updated.	2021-04-02 18:24:52 +00:00
mhaag-spl	5b2c3a2bd5	Possible DSQuery fix	2021-03-31 14:09:38 -06:00
mhaag-spl	1ab256593f	Domain Trust Discovery	2021-03-31 13:24:32 -06:00
tcontreras	fa58ca006b	def_evasion_detections	2021-03-31 15:00:36 +02:00
tcontreras	c214e8dc53	def_evasion_detections	2021-03-31 14:42:47 +02:00
Michael Haag	602c51bae9	Merge branch 'develop' into mhaag	2021-03-30 14:58:52 -06:00
mhaag-spl	da4bc60750	T1197 BITS Jobs	2021-03-30 14:49:44 -06:00
P4T12ICK	ae86d614eb	updated test file	2021-03-29 18:23:30 +02:00
P4T12ICK	eb5e776fc8	updated test file	2021-03-29 18:14:07 +02:00
P4T12ICK	139bd101d6	new dataset	2021-03-29 17:32:49 +02:00
P4T12ICK	c38768e3f5	updated test file	2021-03-29 17:17:58 +02:00
P4T12ICK	f12d9a90bb	updated test file	2021-03-29 16:49:13 +02:00
P4T12ICK	cfca6b19d5	updated test file	2021-03-29 16:30:15 +02:00
P4T12ICK	3cd8b420c6	updated test file	2021-03-29 16:24:40 +02:00
P4T12ICK	bf1c11e5b5	test file updated	2021-03-29 16:03:06 +02:00
P4T12ICK	49245226c6	test file updated	2021-03-29 15:52:11 +02:00
P4T12ICK	4ad8b2b6ba	Improve ssa detection testing	2021-03-29 11:09:53 +02:00
P4T12ICK	d38c53df07	updated test file	2021-03-26 16:29:58 +01:00
P4T12ICK	6934368668	Merge branch 'ssa_detection_testing_three' into ssa_smoketest_nightly	2021-03-26 16:26:37 +01:00
P4T12ICK	1c4908d6a8	merged	2021-03-26 16:26:13 +01:00
P4T12ICK	243121ce04	merged	2021-03-26 16:23:30 +01:00
P4T12ICK	da86a0b7cf	updated test files	2021-03-26 12:04:51 +01:00
P4T12ICK	e2209cb741	updated test files	2021-03-26 10:21:19 +01:00
P4T12ICK	0ae9f1496d	updated test files	2021-03-26 08:51:39 +01:00
Stanislav Miskovic	08857c50c8	Misko: Fixed tests with correct datasets and dataset locations	2021-03-25 14:26:23 -07:00
github-actions[bot]	a7b63bf17d	Branch was auto-updated.	2021-03-25 18:03:14 +00:00
mhaag-spl	1c3d7a3350	Create certutil_with_decode_argument.yml ... CertUtil Decode	2021-03-25 11:18:36 -06:00
mhaag-spl	5b7aa4ada2	fix	2021-03-24 15:36:19 -06:00
mhaag-spl	52015bd2b5	certutil	2021-03-24 15:32:46 -06:00
mhaag-spl	249fd0a549	Update Certutil ... - Renamed "attempt to add certificate to untrusted store" to "Attempt to add untrusted certificate to certificate store" New Detections: - CertUtil Download With URLCache and Split Arguments - CertUtil Download With VerifyCtl and Split Arguments	2021-03-24 15:15:47 -06:00