admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
18,530 Commits 697 Branches 195 Tags
fixDetectionTestingPassFail
Commit Graph

18530 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Stanislav Miskovic 5e845f4b3d Probing access and credential strength with stolen credentials 2020-11-05 09:46:23 -08:00
Xiao Lin 811ba865fa change test files to use ssa prefix 2020-11-05 17:36:30 +00:00
Xiao Lin fa2ca47546 test yml 2020-11-05 17:03:54 +00:00
Xiao Lin 4f581f419d add 3 underscore 2020-11-05 17:01:20 +00:00
Xiao Lin 640cadef7c use ssa as prefix 2020-11-05 16:59:13 +00:00
P4T12ICK 0bb7df59f5 Merge branch 'detection_testing_part_one' of github.com:splunk/security-content into detection_testing_part_one 2020-11-05 17:40:48 +01:00
P4T12ICK e46b37300f bug fix in detection 2020-11-05 17:40:31 +01:00
dependabot[bot] 17c2951b92 Bump attrs from 20.2.0 to 20.3.0 
Bumps [attrs](https://github.com/python-attrs/attrs) from 20.2.0 to 20.3.0.
- [Release notes](https://github.com/python-attrs/attrs/releases)
- [Changelog](https://github.com/python-attrs/attrs/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/python-attrs/attrs/compare/20.2.0...20.3.0)

Signed-off-by: dependabot[bot] <support@github.com>
 2020-11-05 14:03:58 +00:00
dependabot[bot] cbc0fd5aa3 Bump boto3 from 1.16.10 to 1.16.11 
Bumps [boto3](https://github.com/boto/boto3) from 1.16.10 to 1.16.11.
- [Release notes](https://github.com/boto/boto3/releases)
- [Changelog](https://github.com/boto/boto3/blob/develop/CHANGELOG.rst)
- [Commits](https://github.com/boto/boto3/compare/1.16.10...1.16.11)

Signed-off-by: dependabot[bot] <support@github.com>
 2020-11-05 14:03:57 +00:00
dependabot[bot] 7234237741 Bump botocore from 1.19.10 to 1.19.11 
Bumps [botocore](https://github.com/boto/botocore) from 1.19.10 to 1.19.11.
- [Release notes](https://github.com/boto/botocore/releases)
- [Changelog](https://github.com/boto/botocore/blob/develop/CHANGELOG.rst)
- [Commits](https://github.com/boto/botocore/compare/1.19.10...1.19.11)

Signed-off-by: dependabot[bot] <support@github.com>
 2020-11-05 14:03:55 +00:00
Detection Testing Service 3de3e6c8ab Merge branch 'detection_testing_part_one' of https://github.com/splunk/security-content into detection_testing_part_one 2020-11-05 13:20:33 +00:00
root c396e43995 Added detection testing service results inKerberoasting spn request with RC4 encryption 2020-11-05 13:20:32 +00:00
root a81ae920af Added detection testing service results inDetect Activity Related to Pass the Hash Attacks 2020-11-05 13:09:41 +00:00
Mikael Bjerkeland 7d0ddb28e9 Reduce FP 2020-11-05 12:40:19 +01:00
Detection Testing Service 59c9b9bcb9 Merge branch 'detection_testing_part_one' of https://github.com/splunk/security-content into detection_testing_part_one 2020-11-05 10:20:59 +00:00
root e29ebc6d92 Added detection testing service results inDetect Credential Dumping through LSASS access 2020-11-05 10:20:58 +00:00
root 6af70e41b7 Added detection testing service results inCreate Remote Thread into LSASS 2020-11-05 10:11:51 +00:00
P4T12ICK 0930c6e7ae Merge branch 'detection_testing_part_one' of github.com:splunk/security-content into detection_testing_part_one 2020-11-05 10:42:12 +01:00
P4T12ICK 25672136fd improvements detection testing service 2020-11-05 10:41:42 +01:00
root 054fa8ca3b Added detection testing service results inAccess LSASS Memory for Dump Creation 2020-11-05 08:46:55 +00:00
P4T12ICK 8a66f8e175 changed macro 2020-11-05 09:18:37 +01:00
jzsplunk 76fc296d43 Merge branch 'develop' into mbjerkeland-develop 2020-11-04 17:45:22 -08:00
jzsplunk 1bfa0dfc6b Merge branch 'develop' into ransomwares3 2020-11-04 17:44:34 -08:00
jzsplunk f845dc331e Merge branch 'develop' into issue_#850 2020-11-04 17:43:59 -08:00
Xiao Lin 04f8db150a Merge branch 'develop' of github.com:splunk/security-content into TR162 2020-11-04 22:40:23 +00:00
Bhavin Patel 11bef0bbc6 Merge pull request #823 from splunk/adding_api_checks 
adding smoke test for master api
 2020-11-04 14:16:58 -08:00
Bhavin Patel 8e317c3c00 Merge branch 'develop' into adding_api_checks 2020-11-04 14:09:15 -08:00
jzsplunk c2d56f2e57 Merge branch 'develop' into issue_#850 2020-11-04 14:07:06 -08:00
Jose Enrique Hernandez 74e25172e4 Merge pull request #854 from splunk/ssa-coverage 
script that shows the coverage for ssa detections
 2020-11-04 16:51:26 -05:00
davisshannon a30cf8bb5d Merge pull request #1 from splunk/develop 
updates
 2020-11-05 08:33:59 +11:00
bpatel 8b93ff2097 minor 2020-11-04 13:32:06 -08:00
jzsplunk be1c42f895 Merge branch 'develop' into mbjerkeland-develop 2020-11-04 13:05:28 -08:00
jzsplunk 24292ea2c8 Merge pull request #877 from splunk/misko_apply_set_stolen_credentials 
Applying and setting stolen credentials - detections via …
 2020-11-04 12:47:25 -08:00
bpatel 27cb068218 updating spl to use All_Traffic.transport=tcp 2020-11-04 12:46:20 -08:00
bpatel bf21ee071f more test files for mustang 2020-11-04 12:39:57 -08:00
Ignacio a348cf6f0b Merge branch 'develop' into ssa-coverage 2020-11-04 11:48:41 -08:00
Jose Enrique Hernandez db0e7bd862 Merge branch 'develop' into misko_apply_set_stolen_credentials 2020-11-04 14:40:49 -05:00
Jose Enrique Hernandez f4f86b2aa1 Merge pull request #881 from splunk/TR-275 
Changed cicd image to use cached repository
 2020-11-04 14:30:36 -05:00
Jose Enrique Hernandez b925f68f2f Merge branch 'develop' into TR-275 2020-11-04 14:22:37 -05:00
Ignacio Bermudez Corrales 6f74b00b43 Changed cicd image to use cached repository 
Tested locally with gitlab-runner behind VPN.
 2020-11-04 11:19:17 -08:00
Jose Enrique Hernandez 907cca4ff8 Merge branch 'develop' into ssa-coverage 2020-11-04 14:06:46 -05:00
Jose Enrique Hernandez c7b8e7166f Merge pull request #816 from splunk/misko_cred_extract_APIs_and_Filenames 
Credential Extraction detected via common exploit modules ...
 2020-11-04 14:03:02 -05:00
Jose Enrique Hernandez 546ddff4c7 Merge branch 'develop' into ssa-coverage 2020-11-04 13:59:26 -05:00
Jose Enrique Hernandez 3a0bd10c23 Merge pull request #864 from splunk/new_test_file_format 
New test file format
 2020-11-04 13:58:14 -05:00
Jose Enrique Hernandez 7391a565d2 Merge pull request #856 from splunk/remove_commuunity_branch 
removed community api
 2020-11-04 13:57:40 -05:00
jzsplunk cfadee1d7a Merge branch 'develop' into misko_apply_set_stolen_credentials 2020-11-04 10:15:19 -08:00
Jose Enrique Hernandez 7281215fc3 Merge branch 'develop' into misko_cred_extract_APIs_and_Filenames 2020-11-04 13:14:03 -05:00
Bhavin Patel bea2c6292e Merge pull request #862 from splunk/kubernetes_gcp_detect_most_active_service_accounts_by_pod-minor-bug-fix 
Update kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml
 2020-11-04 10:12:10 -08:00
jzsplunk 7434975199 Merge branch 'develop' into misko_apply_set_stolen_credentials 2020-11-04 10:03:17 -08:00
Stanislav Miskovic b46acc0d4f Fix SPL in the Mimikatz module detection 2020-11-04 09:28:38 -08:00