 patel-bhavin
|
bb3a73b0dd
|
array
|
2022-06-27 15:26:45 -07:00 |
|
|
patel-bhavin
|
5c1e44eb32
|
adding more technologieas
|
2022-06-27 13:49:44 -07:00 |
|
|
tccontre
|
51f77f9184
|
azorult-bomb2
|
2022-06-27 11:16:39 +02:00 |
|
|
patel-bhavin
|
d5ab2bd9c8
|
CI
|
2022-06-24 14:42:57 -07:00 |
|
|
patel-bhavin
|
690021590a
|
add MS windows
|
2022-06-24 14:30:58 -07:00 |
|
|
patel-bhavin
|
e92699f315
|
st
|
2022-06-24 14:27:27 -07:00 |
|
|
pyth0n1c
|
01a50b9294
|
Branch was auto-updated.
|
2022-06-24 10:16:00 -07:00 |
|
|
pyth0n1c
|
f5ec4b0500
|
Branch was auto-updated.
|
2022-06-24 10:16:00 -07:00 |
|
|
pyth0n1c
|
493a87e8ec
|
Branch was auto-updated.
|
2022-06-24 10:15:59 -07:00 |
|
|
pyth0n1c
|
91d785bac6
|
Branch was auto-updated.
|
2022-06-24 10:15:58 -07:00 |
|
|
pyth0n1c
|
bbeef84375
|
Branch was auto-updated.
|
2022-06-24 10:15:57 -07:00 |
|
|
mvelazco
|
73a76ac59a
|
Merge pull request #2262 from splunk/TR-2113_New_Kerberoasting_detections
Adding new kerberoasting detections
|
2022-06-24 13:13:52 -04:00 |
|
|
mvelazco
|
0df3dc5e51
|
updating fields
|
2022-06-24 12:50:43 -04:00 |
|
|
mvelazco
|
757e6b92b8
|
updating field name to use ScriptBlockText
|
2022-06-24 11:18:28 -04:00 |
|
|
mvelazco
|
2637c12014
|
updating sourcetype to xmlwineventlog
|
2022-06-24 11:05:02 -04:00 |
|
|
gowthamarajr
|
fd78ddcb6f
|
Merge branch 'TR-2113_New_Kerberoasting_detections' of https://github.com/splunk/security_content into TR-2113_New_Kerberoasting_detections
|
2022-06-24 10:17:56 -04:00 |
|
|
gowthamarajr
|
0f23640526
|
Updating test file for PowerView SPN detection
|
2022-06-24 10:17:52 -04:00 |
|
|
tccontre
|
f1f1ef47c7
|
Update windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml
|
2022-06-24 14:29:36 +02:00 |
|
|
tccontre
|
e9137cc822
|
azorult-bomb2
|
2022-06-24 14:20:37 +02:00 |
|
|
pyth0n1c
|
e818a0d1ed
|
Fixing print statement that was
was not obeying the verbose argument.
|
2022-06-23 15:35:56 -07:00 |
|
|
pyth0n1c
|
050491a1cc
|
Forgot to include a print statement, causing
lines to be jumbled together.
|
2022-06-23 15:28:24 -07:00 |
|
|
patel-bhavin
|
ca40738c75
|
Merge branch 'risky-spl-detector' of github.com:splunk/security_content into risky-spl-detector
|
2022-06-23 15:21:43 -07:00 |
|
|
patel-bhavin
|
cb150c258e
|
minor edits for yml validation and test file name update
|
2022-06-23 15:21:30 -07:00 |
|
|
pyth0n1c
|
0181c9fd63
|
Update the docker detection testing code
to use the latest contentctl from develop
as well as skip enrichment.
|
2022-06-23 15:18:56 -07:00 |
|
|
pyth0n1c
|
4931458ff9
|
Updated one broken reference link.
|
2022-06-23 15:02:26 -07:00 |
|
|
pyth0n1c
|
d40ca09d61
|
Merged develop into content_changer_improvements to resolve merge conflict. this was making it impossible to merge the PR in the GitHub Interface.
|
2022-06-23 14:19:17 -07:00 |
|
|
Kumar Sharad
|
4ee336631d
|
Merge branch 'risky-spl-detector' of github.com:splunk/security_content into risky-spl-detector
|
2022-06-23 23:03:13 +02:00 |
|
|
Kumar Sharad
|
967bc6e113
|
model to detect risky commands
|
2022-06-23 23:02:44 +02:00 |
|
|
pyth0n1c
|
a133549d6c
|
Fixing a call to content_ctl
generate. This passes initial
testing using nektos act on
my own system!
|
2022-06-23 13:58:13 -07:00 |
|
|
pyth0n1c
|
09364401cf
|
Branch was auto-updated.
|
2022-06-23 13:55:32 -07:00 |
|
|
pyth0n1c
|
3f7cd8dcc3
|
Branch was auto-updated.
|
2022-06-23 13:55:29 -07:00 |
|
|
pyth0n1c
|
6f30962fd6
|
Branch was auto-updated.
|
2022-06-23 13:55:27 -07:00 |
|
|
pyth0n1c
|
83f52ea26d
|
Branch was auto-updated.
|
2022-06-23 13:55:25 -07:00 |
|
|
Bhavin Patel
|
1272dc827a
|
Merge pull request #2251 from splunk/exec-the-msi
T1218.007 - MSIExec
|
2022-06-23 13:55:03 -07:00 |
|
|
pyth0n1c
|
b7955f84b9
|
Typo naming new variable
in workflow.
|
2022-06-23 13:51:56 -07:00 |
|
|
pyth0n1c
|
82af76d67f
|
Added ability to add or remove
the --skip_enrichment argument
to content_ctl based on whether
or not we are running CI/CD workflow
on a tagged release
|
2022-06-23 13:50:15 -07:00 |
|
|
Kumar Sharad
|
8d568ae416
|
model to detect risky commands
|
2022-06-23 22:43:22 +02:00 |
|
|
mhaag-spl
|
056b07a686
|
remove detection
|
2022-06-23 11:09:07 -06:00 |
|
|
tccontre
|
54a23a2a77
|
Update and rename windows_modify_registry_suppress_win_defender_notifs.test.yml to windows_modify_registry_suppress_win_defender_notif.test.yml
|
2022-06-23 15:25:17 +02:00 |
|
|
tccontre
|
5c85507b8f
|
Update and rename windows_modify_registry_disable_windows_security_center_notifs.test.yml to windows_modify_registry_disable_windows_security_center_notif.test.yml
|
2022-06-23 15:24:51 +02:00 |
|
|
tccontre
|
edbf2c86b3
|
Update and rename windows_modify_registry_suppress_win_defender_notifs.yml to windows_modify_registry_suppress_win_defender_notif.yml
|
2022-06-23 15:24:21 +02:00 |
|
|
tccontre
|
374fd54c26
|
Update and rename windows_modify_registry_disable_windows_security_center_notifs.yml to windows_modify_registry_disable_windows_security_center_notif.yml
|
2022-06-23 15:23:59 +02:00 |
|
|
tccontre
|
71e4bd8ebf
|
Update windows_modify_registry_disable_toast_notifications.test.yml
|
2022-06-23 13:57:11 +02:00 |
|
|
tccontre
|
0478d292f4
|
Rename windows_modify_registry_suppress_win_defender_notifications.yml to windows_modify_registry_suppress_win_defender_notifs.yml
|
2022-06-23 13:36:47 +02:00 |
|
|
tccontre
|
a259be3c32
|
azorult-bomb
|
2022-06-23 13:36:06 +02:00 |
|
|
tccontre
|
8321cf9c1d
|
Update and rename windows_modify_registry_disable_windows_security_center_notifications.test.yml to windows_modify_registry_disable_windows_security_center_notifs.test.yml
|
2022-06-23 13:35:02 +02:00 |
|
|
tccontre
|
2e4eac9eaa
|
Update windows_modify_registry_suppress_win_defender_notifs.test.yml
|
2022-06-23 13:28:26 +02:00 |
|
|
tccontre
|
c4f248b11b
|
azorult-bomb
|
2022-06-23 12:38:07 +02:00 |
|
|
tccontre
|
9d9b782b4e
|
azorult-bomb
|
2022-06-23 12:27:43 +02:00 |
|
|
pyth0n1c
|
d858cd6875
|
included the --skip_enrichment flag
|
2022-06-22 16:06:29 -07:00 |
|