admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
18,530 Commits 697 Branches 195 Tags
fixDetectionTestingPassFail
Commit Graph

18530 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
github-actions[bot] 33ec5aa35f Branch was auto-updated. 2021-02-10 02:33:05 +00:00
github-actions[bot] 85bb5bf62b Branch was auto-updated. 2021-02-10 02:33:01 +00:00
dependabot[bot] 1792ec428b Merge pull request #1181 from splunk/dependabot/pip/automated_detection_testing/cryptography-3.3.2 2021-02-10 02:32:44 +00:00
dependabot[bot] c6f3096d5d Bump cryptography from 3.3.1 to 3.3.2 in /automated_detection_testing 
Bumps [cryptography](https://github.com/pyca/cryptography) from 3.3.1 to 3.3.2.
- [Release notes](https://github.com/pyca/cryptography/releases)
- [Changelog](https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/pyca/cryptography/compare/3.3.1...3.3.2)

Signed-off-by: dependabot[bot] <support@github.com>
 2021-02-10 02:25:12 +00:00
bpatel 405ebb4dae spl update and test file 2021-02-09 16:33:53 -08:00
mhaag-spl b6840c14f8 Update suspicious_rundll32_activity.yml 2021-02-09 15:30:10 -07:00
mhaag-spl c2c8d9c320 Update suspicious_regsvr32_activity.yml 2021-02-09 15:27:37 -07:00
mhaag-spl 03a48cd47d formatting 2021-02-09 14:24:39 -07:00
mhaag-spl c99b478d72 format fixing 2021-02-09 14:18:56 -07:00
mhaag-spl 07ffc993b4 removing for now 2021-02-09 14:14:49 -07:00
mhaag-spl 9db73e43c8 Create suspicious_rundll32_activity.yml 2021-02-09 14:11:38 -07:00
mhaag-spl 2ce3a6adcb Update suspicious_regsvr32_activity.yml 2021-02-09 14:01:59 -07:00
mhaag-spl c26c9a9989 Update dump_lsass_via_comsvcs_dll.yml 2021-02-09 13:57:50 -07:00
mhaag-spl d6a219f0b5 Merge branch '02rel1' of https://github.com/splunk/security_content into 02rel1 2021-02-09 13:13:07 -07:00
mhaag-spl 9c08582cfa Update suspicious_regsvr32_rename.yml 2021-02-09 13:13:05 -07:00
root d53f30cff7 Added detection testing service results inSuspicious Rundll32 dllregisterserver 2021-02-09 19:37:50 +00:00
mhaag-spl 157d8770e6 rundll32 dllregisterserver 2021-02-09 12:10:39 -07:00
root 525e1ff46c Added detection testing service results inSuspicious Rundll32 with no Command Line Arguments 2021-02-09 18:46:55 +00:00
mhaag-spl bc508128e9 misspell 2021-02-09 11:27:19 -07:00
mhaag-spl c34083adf3 Merge branch '02rel1' of https://github.com/splunk/security_content into 02rel1 2021-02-09 11:25:10 -07:00
mhaag-spl 3ead4c2840 rundll32 with no cmdline arguments 2021-02-09 11:25:01 -07:00
root f9a6635e70 Added detection testing service results inSuspicious Rundll32 startw 2021-02-09 18:18:34 +00:00
mhaag-spl f89c21964d Rundll32,StartW 
Adding content to detect Rundll32 using function name Start/StartW on the commandline. Typically used with CobaltStrike.
 2021-02-09 10:54:34 -07:00
dependabot[bot] ea3d18287c Bump azure-core from 1.10.0 to 1.11.0 
Bumps [azure-core](https://github.com/Azure/azure-sdk-for-python) from 1.10.0 to 1.11.0.
- [Release notes](https://github.com/Azure/azure-sdk-for-python/releases)
- [Commits](https://github.com/Azure/azure-sdk-for-python/compare/azure-core_1.10.0...azure-core_1.11.0)

Signed-off-by: dependabot[bot] <support@github.com>
 2021-02-09 14:02:49 +00:00
Bhavin Patel 33af6dfb13 Merge branch 'develop' into cloudfederationcredentialabuse 2021-02-08 11:29:49 -08:00
divious1 2ae854b678 fixing gitlab CI job to adjust for new types 2021-02-08 10:38:49 -05:00
divious1 004db3e825 renaming analytic stories 2021-02-08 10:21:38 -05:00
divious1 9a7dee893c renamed in response tasks 2021-02-08 10:19:31 -05:00
divious1 eef01502f3 renamed stories 2021-02-08 10:18:57 -05:00
divious1 1ec15cf044 renamed on all detections 2021-02-08 10:18:16 -05:00
divious1 b4c31d718a fixing minor generate bug, since we added response type action 2021-02-08 10:10:05 -05:00
divious1 7cb093cd0b adding risk score values 2021-02-08 09:46:18 -05:00
dependabot[bot] cdf6e11170 Bump more-itertools from 8.6.0 to 8.7.0 
Bumps [more-itertools](https://github.com/more-itertools/more-itertools) from 8.6.0 to 8.7.0.
- [Release notes](https://github.com/more-itertools/more-itertools/releases)
- [Commits](https://github.com/more-itertools/more-itertools/compare/v8.6.0...v8.7.0)

Signed-off-by: dependabot[bot] <support@github.com>
 2021-02-08 14:03:42 +00:00
divious1 acaf6e2501 added type batch to story 2021-02-05 15:41:56 -05:00
divious1 b68e05685e modified type for detections 2021-02-05 14:35:49 -05:00
Detection Testing Service 3eca0fd3f2 Merge branch '02rel1' of https://github.com/splunk/security_content into 02rel1 2021-02-05 14:50:30 +00:00
root 783bc38a1d Added detection testing service results inDetect Rundll32 Application Control Bypass - setupapi 2021-02-05 14:50:28 +00:00
root e02e30e423 Added detection testing service results inDetect Rundll32 Application Control Bypass - syssetup 2021-02-05 14:50:23 +00:00
mhaag-spl 3d37e93d99 rundll32 syssetup, setupapi 
Adding rundll32 syssetup and setupapi
 2021-02-05 07:27:02 -07:00
divious1 bbdd2bd860 add products to responses, added new type response, also new checks for product tag and mitre_attack_id in validate 2021-02-04 22:28:19 -05:00
divious1 6c950af9d4 Merge branch 'develop' into TR-380_reuse_type 2021-02-04 21:24:00 -05:00
divious1 71d22f6c80 Merge branch 'develop' into TR-380_reuse_type 2021-02-04 21:16:12 -05:00
github-actions[bot] a74d64f874 Branch was auto-updated. 2021-02-05 00:53:42 +00:00
github-actions[bot] 706186936b Branch was auto-updated. 2021-02-05 00:53:41 +00:00
github-actions[bot] 8d869fd507 Branch was auto-updated. 2021-02-05 00:53:39 +00:00
github-actions[bot] 754af70021 Branch was auto-updated. 2021-02-05 00:53:38 +00:00
Jose Enrique Hernandez f22e7a85a4 Merge pull request #1175 from splunk/ci_api_cleans 
fixing API bug
 2021-02-04 19:53:21 -05:00
divious1 7fd34c3fc0 fixing API bug 2021-02-04 19:43:19 -05:00
github-actions[bot] 7fbe713056 Branch was auto-updated. 2021-02-04 23:51:13 +00:00
github-actions[bot] 7f4cc7d3f3 Branch was auto-updated. 2021-02-04 23:51:12 +00:00