9689073946
Edit windows_powerview_kerberos_service_ticket_request detection
...
Edit the windows_powerview_kerberos_service_ticket_request detection to support xml logs
2022-07-01 16:24:42 -04:00
b75b56b81d
removing test files
2022-06-29 14:18:47 -04:00
757e6b92b8
updating field name to use ScriptBlockText
2022-06-24 11:18:28 -04:00
2637c12014
updating sourcetype to xmlwineventlog
2022-06-24 11:05:02 -04:00
fd78ddcb6f
Merge branch 'TR-2113_New_Kerberoasting_detections' of https://github.com/splunk/security_content into TR-2113_New_Kerberoasting_detections
2022-06-24 10:17:56 -04:00
0f23640526
Updating test file for PowerView SPN detection
2022-06-24 10:17:52 -04:00
6f30962fd6
Branch was auto-updated.
2022-06-23 13:55:27 -07:00
056b07a686
remove detection
2022-06-23 11:09:07 -06:00
28eefb325d
adding 2 new detections for kerberoasting
2022-06-22 17:35:37 -04:00
e53e9cf232
Branch was auto-updated.
2022-06-22 10:19:36 -07:00
cda681eb8b
Merge pull request #2260 from splunk/DetectionFixes
...
Detection fixes
2022-06-22 13:19:16 -04:00
b73ea9e5ae
Added another custom_index to a test
...
file that was failing because it did not
have one.
2022-06-21 16:59:44 -07:00
ff0a57e526
Branch was auto-updated.
2022-06-21 16:45:18 -07:00
cc03d129c3
Branch was auto-updated.
2022-06-21 16:07:17 -07:00
62ed8fe817
Branch was auto-updated.
2022-06-21 16:07:16 -07:00
b5c79b6db8
Added a custom index for a detection test
...
that was created when custom_index
support did not yet exist.
2022-06-21 15:53:26 -07:00
b44da42de6
Branch was auto-updated.
2022-06-21 15:28:40 -07:00
6616463196
Branch was auto-updated.
2022-06-21 15:28:39 -07:00
6cbace8412
Branch was auto-updated.
2022-06-21 15:28:38 -07:00
d5d0868005
merge from develop
2022-06-21 14:53:25 -07:00
de30c530eb
Branch was auto-updated.
2022-06-21 14:46:29 -07:00
25e4a180b1
Branch was auto-updated.
2022-06-21 14:46:28 -07:00
c42c8acce2
Branch was auto-updated.
2022-06-21 14:46:22 -07:00
6554d4a42b
Moved ssa___ test file from the tests/network directory to the tests/experimental/endpoint directory because that's where the corresponding detection resides.
2022-06-21 13:59:50 -07:00
6b06ab718b
Fixing a link to a dataset that has been moved.
2022-06-21 13:13:50 -07:00
e681b766c2
Fixing field name
2022-06-21 14:59:48 -05:00
85f4f107a3
Changed to anomaly
2022-06-21 14:45:43 -05:00
2ea683be87
Merge branch 'develop' into inspired_2194
2022-06-21 11:04:27 -07:00
56394444ce
fix
2022-06-17 13:09:37 -06:00
2788e8e63c
path fix
2022-06-17 10:22:24 -06:00
9a25da4387
T1218.007 - MSIExec
2022-06-17 09:36:34 -06:00
df7ec18786
Branch was auto-updated.
2022-06-14 20:14:11 -07:00
0cf536acd5
fix path error
2022-06-14 20:13:42 -07:00
ca8290388f
Branch was auto-updated.
2022-06-14 05:42:29 -07:00
9a266a78ee
update per review comments
2022-06-13 15:33:12 -07:00
5a34e6c633
add risky command abuse ML detection
2022-06-13 10:53:09 -07:00
d5c65edc6a
Branch was auto-updated.
2022-06-13 10:41:17 -07:00
44247456f6
Branch was auto-updated.
2022-06-13 10:41:15 -07:00
3369d15d72
rm wrong commit
2022-06-13 10:40:47 -07:00
2512086977
Branch was auto-updated.
2022-06-13 09:51:59 -07:00
d5fa5ddc0b
Branch was auto-updated.
2022-06-13 09:51:47 -07:00
6efcbd4b93
add risky command ML detection
2022-06-13 09:50:58 -07:00
c538613139
wrong detection file linked from
...
test file. Fixed.
2022-06-08 16:47:56 -07:00
b87dff2883
Fixing name field in a detection
...
test file
2022-06-08 16:01:21 -07:00
10b2b29122
Adding appropriate custom_index to detection
...
and fixing naming error and file_name error
2022-06-08 12:14:46 -07:00
47cd84d377
Wrong sourcetype declared in one
...
of the test files, causing it to fail.
Fixed missing backticks on some
macros.
2022-06-08 11:46:42 -07:00
e8abbd916b
Added missing _internal custom_indexes
...
to relevant test files. Removed the |
character from searches that use
index and sourcetype macros at the
beginning of the search.
2022-06-08 11:08:21 -07:00
3fb342d4c4
Fixed improperly named macro.
...
Renamed the macro in the tests
that use that macro. Added the
optional field, "custom_index"
to the test files which MUST
upload data into the _audit
index. This branch doesn't
support custom_index yet,
but those changes will be merged
soon from another branch.
2022-06-08 10:31:53 -07:00
bc57962c0c
more-defense-evasion
2022-06-07 13:13:02 +02:00
7c2dd368cd
more-defense-evasion
2022-06-07 12:53:31 +02:00
gowthamarajr