744485ea81
Branch was auto-updated.
2023-02-06 15:40:27 -08:00
ee6319d12c
Branch was auto-updated.
2023-02-06 15:40:25 -08:00
60f28eb6c2
Merge pull request #2512 from splunk/asyncrat-onenote-chain
...
asyncrat-onenote-chain
2023-02-06 15:40:08 -08:00
3526c9df4e
revert errrors
2023-02-06 14:46:07 -08:00
c275a89ab1
experimental
2023-02-06 11:35:04 -07:00
94153c0a55
Backup Time
2023-02-06 09:48:55 -07:00
a1f8c08831
Certs! Certs! CERTS!
2023-02-06 07:03:37 -07:00
fe1dfb0db0
Fixed some prints to make it easier
...
to understand why certain tests are
being skipped. This is because they
are deprecated, experimental, or
manual_test
2023-02-03 15:27:11 -08:00
5264515a3d
Remove filename printouts in factory.
...
Add reason why file will not be tested in
GitHub service. This could be the wrong type
or the wrong status.
2023-02-03 15:03:57 -08:00
13ccdc1e16
Add validators to automatically set the
...
deprecated and experimental boolean
fields of a detection. Should these fields
still exist given that there is a status
field? Also added enum to help with
validation.
2023-02-03 14:38:19 -08:00
70c93f798f
Update windows_driver_inventory.test.yml
2023-02-03 15:05:26 -07:00
1f57edfdd4
Update windows_driver_inventory.test.yml
2023-02-03 14:59:37 -07:00
b4796ccc27
Driver Inventory
2023-02-03 14:51:28 -07:00
1d42f499c6
Update winevent_scheduled_task_created_within_public_path.yml
2023-02-03 13:46:59 -07:00
561c60df26
Attempt at adding proper experimental and
...
manual_test parsing support to
detection_testing.
2023-02-03 11:48:05 -08:00
621fe10dfd
Delete test_config_bak.json
2023-02-03 12:40:01 -05:00
ccc97c6dca
MOAR Tasks
2023-02-03 09:55:08 -07:00
7ab04b6d72
PubPath
2023-02-03 09:49:36 -07:00
710ed11449
fixy
2023-02-03 09:07:10 -07:00
192b93a110
adding required field
2023-02-03 10:53:26 -05:00
7d45ae6677
security_content_commonalities_notebook
2023-02-03 16:33:19 +01:00
68e3d5016a
security_content_commonalities_notebook
2023-02-03 16:31:31 +01:00
5b50f663a6
security_content_commonalities_notebook
2023-02-03 16:27:39 +01:00
ebc91326ec
Cert services and MOAR
2023-02-03 06:58:50 -07:00
b791a7e458
security_content_commonalities_notebook
2023-02-03 13:59:07 +01:00
0b1f09fda7
swiftslicer
2023-02-03 09:52:47 +01:00
fe3c940162
swiftslicer
2023-02-03 09:47:51 +01:00
af5c030cb3
Update executables_or_script_creation_in_suspicious_path.yml
2023-02-03 09:17:11 +01:00
ecda0cb289
Update suspicious_process_file_path.yml
2023-02-03 09:15:35 +01:00
4aab4bfe1a
Update wsreset_uac_bypass.yml
2023-02-02 17:39:40 -08:00
a94e1c8878
Update how we ge the release tag
...
and the timestamp. Now, we get
it from the workflow and the
current datetime
2023-02-02 17:35:27 -08:00
191ced0e03
Update windows_modify_show_compress_color_and_info_tip_registry.yml
2023-02-02 17:22:35 -08:00
525f26ac73
adding new detection from community
2023-02-02 16:40:32 -08:00
60ea283f53
Moving failing tests to experimental
2023-02-02 16:32:24 -08:00
ddc779103b
Update office_application_drop_executable.yml
2023-02-02 16:30:42 -08:00
5ae3a295a7
fix typo
2023-02-02 19:09:32 -05:00
bc7fa3078f
multiple fixes
2023-02-02 18:38:06 -05:00
f50008a88f
adding commits
2023-02-02 13:42:18 -08:00
a056d1bece
Update delete_shadowcopy_with_powershell.yml
...
Observable User was changed to UserID. I don't think this is useful as it's the SID, and not sure if all folks will capture SID for the assets & identities, so maybe deleting the part of the stanza for the Victim User is better.
2023-02-02 16:25:43 -05:00
e8cd643c40
Update create_local_admin_accounts_using_net_exe.yml
...
Added parent_process_name into the query, as the rest of the yaml wanted it.
2023-02-02 16:10:33 -05:00
330a31e9f2
Update windows_service_created_with_suspicious_service_path.yml
...
Updated field names to match, and added dest and user_id to the query for investigation purposes.
2023-02-02 12:32:23 -05:00
4f774be1b4
Update powershell_fileless_script_contains_base64_encoded_content.yml
...
Updated risk message to the new field names.
2023-02-02 12:04:36 -05:00
f6f4c306fd
Update powershell_fileless_script_contains_base64_encoded_content.yml
...
Renamed risk object ComputerName to Computer
Removed User from risk object (UserID is the proper field, but the SID isn't part of assets/identities, so just full on removed the part of the stanza for User)
Removes the 's' off EventCodes
2023-02-02 11:39:58 -05:00
2c92876813
fix requirements
2023-02-02 16:46:02 +01:00
327ab6b4c7
fixed detections
2023-02-02 15:24:43 +01:00
126ab0c3a1
solved merge conflict requirements
2023-02-02 12:11:38 +01:00
4d5ff48962
merged with develop
2023-02-02 09:16:36 +01:00
ffa1210a00
merged with develop
2023-02-02 09:15:59 +01:00
0daa31c481
Updated the macro in another
...
search whose test file was changed.
2023-02-01 18:01:19 -08:00
9cf9d1d3f7
Fixing incorrect macro in a detection
...
whose test file was updated.
2023-02-01 17:59:02 -08:00
srv-rr-gh-researchbt