1eb9bf8a1e
Branch was auto-updated.
2022-01-12 12:17:51 -08:00
fd60029855
Branch was auto-updated.
2022-01-12 12:17:49 -08:00
50176afcc8
Branch was auto-updated.
2022-01-12 12:17:47 -08:00
054653023e
Branch was auto-updated.
2022-01-12 12:17:46 -08:00
52e482c604
Merge pull request #1928 from splunk/DockerDetectionUpdatesAndFixes
...
Docker detection updates and fixes
2022-01-12 12:17:22 -08:00
b12ccf0cd2
Added a readme.md. Need to check that the
...
markdown renders appropriately
2022-01-12 10:54:45 -08:00
42920eccd9
comment out Mustang configs
2022-01-12 10:53:33 -08:00
3afef5d559
Updated the error for providing both PR and
...
commit_hash to a warning. This was causing
an error during PR triggered testing in github
actions as both of these are provided. Perhaps
we actually can include both of these and can
get old PRs based on commit hash, but until
then we will just test using the PR number and
ignore the commit_hash if we find both.
2022-01-12 10:38:23 -08:00
86328655ec
fixlinpe
2022-01-12 10:21:50 -08:00
020e9d5f58
endpfx
2022-01-12 09:56:26 -08:00
c9f12163a8
fixedformatt
2022-01-12 09:46:50 -08:00
815fa610e9
Updated PowerShell - Connect To Internet With Hidden Window
2022-01-12 09:45:32 -07:00
56b5159b5d
Update windows_possible_credential_dumping.test.yml
2022-01-12 09:39:14 -07:00
7d8e5e3973
fixrs
2022-01-12 08:03:39 -08:00
f4bcc6b1c4
fixedrisk
2022-01-12 07:59:08 -08:00
c263ef4ac5
Merge branch 'nixpost' of github.com:splunk/security_content into nixpost
2022-01-12 07:47:54 -08:00
5f71b501f2
addedmacros
2022-01-12 07:47:14 -08:00
3d75e6df52
Added detection testing service results inLinux NOPASSWD Entry In Sudoers File
2022-01-12 09:22:22 +00:00
6f09d650c8
Merge branch 'linux_persist_priv_batch_5' of https://github.com/splunk/security_content into linux_persist_priv_batch_5
2022-01-12 08:55:53 +00:00
0ac29166d0
Added detection testing service results inLinux Possible Access Or Modification Of sshd_config File
2022-01-12 08:55:52 +00:00
fc0719eda4
Added detection testing service results inLinux Possible Ssh Key File Creation
2022-01-12 08:52:58 +00:00
c67ba4f10c
Branch was auto-updated.
2022-01-12 00:13:37 -08:00
7ae4e2e894
Branch was auto-updated.
2022-01-12 00:13:36 -08:00
fee241a394
Branch was auto-updated.
2022-01-12 00:13:35 -08:00
9e969059d5
Branch was auto-updated.
2022-01-12 00:13:34 -08:00
0ead4203ba
Branch was auto-updated.
2022-01-12 00:13:33 -08:00
3f82d075e1
Branch was auto-updated.
2022-01-12 00:13:32 -08:00
1ecc215773
Branch was auto-updated.
2022-01-12 00:13:31 -08:00
ace2f35fd6
Branch was auto-updated.
2022-01-12 00:13:31 -08:00
ec5b3ff482
Branch was auto-updated.
2022-01-12 00:13:27 -08:00
4eaf33adaa
Branch was auto-updated.
2022-01-12 00:13:25 -08:00
b24ec7dc20
Branch was auto-updated.
2022-01-12 00:13:25 -08:00
4073b95fae
Merge pull request #1923 from splunk/linux_persist_priv_batch_4
...
linux_persist_priv_batch_4
2022-01-12 09:13:04 +01:00
b9f44d9b2d
linux_persist_priv_batch_5
2022-01-12 09:12:43 +01:00
4d9349084e
Changed to run nightly on develop and changes on other branches for pushes and PRs.
2022-01-11 16:37:03 -08:00
7b3029b187
Removed splunkbase-only test_config file. Pushing to run a test on all. Will push again for changes only.
2022-01-11 16:35:19 -08:00
23da2f45d2
removing file that was accidentally added.
2022-01-11 16:06:47 -08:00
e3ba9f0074
Finished removing dead code from DataManipulation.
...
Added the new_sysmon as an additional default application.
While it is not ideal to have the old and new sysmons installed
side by side, there are some detection that only work with one
and not the other. We will run both until we have moved
all detections to the new sysmon.
2022-01-11 16:03:04 -08:00
6a6bd04819
Removing some dead code from
...
DataManipulation.py
2022-01-11 15:46:38 -08:00
e8b6be29c7
yml changes and testing
2022-01-11 15:44:16 -08:00
14461f46ff
modifying window
2022-01-11 16:44:49 -06:00
79d13fccef
Converted DataManipulation from using FileInput to with open, readline, etc. We needed to do this because FileInput with inplace=True remaps the print command, which may be called by several parallel threads running DataManipulation or to output status info, will cause a crash if multiple threads write to it.
2022-01-11 14:18:04 -08:00
29cb276dec
control_rundll32 update
2022-01-11 13:16:22 -07:00
d4b1b48d5d
Cred Dump
...
Resolving #1744 .
2022-01-11 13:14:35 -07:00
81df4e0eec
A bunch of changes to support parallel testing and waiting to ensure data has been properly ingested/indexed before running a test. Still double-checking edge cases for this. Also improved some error printouts and status printouts. When a test completes, it now includes its runtime in its pass/fail/error print.
2022-01-11 11:59:26 -08:00
e7f1eff711
fixing field names
2022-01-11 13:16:19 -06:00
0535389f23
Tweaked detection
2022-01-11 12:44:08 -06:00
b1a285b483
Renamed test
2022-01-11 11:34:26 -06:00
ffb734456a
Merge branch 'develop' into refactored_security_content
2022-01-11 16:01:07 +01:00
a8f1d083f8
WIP rewrite scripts
2022-01-11 15:59:57 +01:00
pyth0n1c