admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
23,231 Commits 697 Branches 195 Tags
gitlab_release_testing_2
Commit Graph

45 Commits

Author SHA1 Message Date
tccontre 71e6ae8406 njrat2 2023-09-21 10:56:06 +02:00
Bhavin Patel 775d38c96f fix another 30 yamls 2023-08-21 13:13:21 -07:00
tccontre 41c823ef55 win_modify_reg_correlation 2023-06-15 17:19:38 +02:00
Michael Haag 95828c9d72 fixed required fields 2023-05-04 10:49:10 -06:00
Michael Haag eb1bc08eeb We're going to need a bigger Docker 2023-04-27 22:01:49 -06:00
P4T12ICK 78909f6429 merged with develop 2023-03-03 12:40:16 +01:00
pyth0n1c 6c1ceb1bad Ported all changes from interlock 2023-01-25 13:31:11 -08:00
P4T12ICK fd0c8b349f updated tags 2023-01-09 09:33:30 +01:00
P4T12ICK 5ae53c9368 Migrated all detections to v4 2023-01-03 13:42:10 +01:00
root c71b04a866 Updated detection files with recommended TA list. 2022-08-01 18:43:39 +00:00
tccontre 81607c596e add_story_and_minor_fix 2022-03-17 16:41:29 +01:00
P4T12ICK 6f0ee68913 Refactored security content 2022-03-09 14:43:09 +01:00
Jose Enrique Hernandez d78bb53baa Revert "Refactored security content" 2022-03-04 15:13:04 -05:00
P4T12ICK 68543a8dc1 merged with develop 2022-03-03 13:11:56 +01:00
truptilangalia-crest 179134e8ef test:removed cim version 2022-02-08 12:05:05 +05:30
P4T12ICK 5fbff3630e merged with develop 2022-02-07 14:55:34 +01:00
truptilangalia-crest 7e649f11b2 test: conflict resolved 2022-02-01 11:29:07 +05:30
research bot e52d00b53d updating docs and package bits [ci skip] 2022-01-31 20:04:12 +00:00
truptilangalia-crest 08f0ff6405 test: Removed tas with mapping from detection files 2022-01-31 19:46:09 +05:30
tccontre 05a002fffa Update disabling_cmd_application.yml 2022-01-28 11:43:24 +01:00
tccontre 0c7bfdfb91 Update disabling_cmd_application.yml 2022-01-27 10:19:35 +01:00
tccontre 6e369a316f reg_yml_analytics_updates_2 2022-01-27 10:14:52 +01:00
P4T12ICK 4fd8604b9a removed SAAWS and automated_detection_testing flag 2022-01-27 09:50:45 +01:00
Detection Testing Service 6fd7a4e812 test: updated supported_tas to recommended_tas 2022-01-19 17:43:41 +05:30
P4T12ICK 84092434a2 fixed more detections 2022-01-18 12:53:54 +01:00
Detection Testing Service a2b6fff739 test:updated ymls 2021-12-15 21:15:02 +05:30
tlangalia 343ceae12f Updated detection files with supported TA list. 2021-12-14 13:27:55 +05:50
Bhavin Patel 57c1ef30dd Merge pull request #1857 from splunk/RegistryDetectionFixes 
Registry detection fixes
 2021-12-01 15:41:01 -08:00
pyth0n1c 9f91279c51 Changed affected Registry.registry_value_name 
fields to Registry.registry_value_data and changed
value from DWORD(0x...) to 0x...
This probably does not cover all the detections that
will need to be addressed in this fix, but is a good
initial pass to see if the fixes and new TA are working
properly.
 2021-10-14 14:58:03 -07:00
pyth0n1c 3f01dc7409 Touched a number of detections to see if they 
fail with the current sysmon TA before testing
against the sysmon TA update.
 2021-10-14 14:24:25 -07:00
tccontre 14e3597bf4 CARS_UPDATE_MITRE_ID_B4 
CARS_UPDATE_MITRE_ID_B3
 2021-10-13 11:13:24 +02:00
P4T12ICK 5e6e987fb7 resolved merge conflicts 2021-07-21 09:22:09 +02:00
research bot 44ea56053d updating docs and package bits [ci skip] 2021-07-20 21:12:30 +00:00
Michael Haag 2f33b99816 Merge branch 'develop' into Risky 2021-07-20 13:47:15 -06:00
research bot 3740535cca updating docs and package bits [ci skip] 2021-07-20 17:49:09 +00:00
P4T12ICK 1c9f44bf37 Merge branch 'develop' into analytic_types 2021-07-20 16:46:34 +02:00
P4T12ICK 65a92a64e1 add analytic types to detections 2021-07-19 16:49:33 +02:00
P4T12ICK 694509e7a4 Merge branch 'develop' into apger-content-v4 2021-07-15 15:01:11 +02:00
jim@apger.com b37882f7e7 Apger's second round of detection content updates 2021-07-14 20:58:54 -05:00
mhaag-spl 44f7892c19 RBA done 2021-07-14 15:43:38 -06:00
research bot 9944856c3f updating docs and package bits [ci skip] 2021-07-13 23:26:40 +00:00
P4T12ICK dc3083731c new detection testing 2021-06-15 16:50:42 +02:00
research bot a40dc12832 updating docs and package bits [ci skip] 2021-04-15 19:40:20 +00:00
root 7e29850f48 Added detection testing service results inDisabling CMD Application 2021-04-01 08:27:41 +00:00
tcontreras c214e8dc53 def_evasion_detections 2021-03-31 14:42:47 +02:00