 P4T12ICK
|
4549464b9d
|
Merge branch 'develop' into inspired-mbjerkeland-develop
|
2020-11-12 10:28:10 +01:00 |
|
|
Xiao Lin
|
e7e659e882
|
Merge branch 'develop' of github.com:splunk/security-content into TR162
|
2020-11-11 23:25:18 +00:00 |
|
|
Stanislav Miskovic
|
2b64634e2f
|
Fix - renaming and providing adequate test set for log deletion detection (this was Mimikatz detection, not PowerSploit one)
|
2020-11-10 19:01:01 -08:00 |
|
|
Jose Enrique Hernandez
|
dc7d3bf9ea
|
Merge branch 'develop' into misko_illegal_management
|
2020-11-10 19:21:33 -05:00 |
|
|
Stanislav Miskovic
|
1969d4a9ab
|
Illegal control of compromised resources via Mimikatz, PowerSploit and DSInternals modules
|
2020-11-10 00:58:27 -08:00 |
|
|
P4T12ICK
|
1f3f1ae408
|
Merge branch 'develop' into mbjerkeland-develop
|
2020-11-10 09:24:55 +01:00 |
|
|
Xiao Lin
|
09c43eff66
|
Merge branch 'develop' of github.com:splunk/security-content into TR162
|
2020-11-09 18:10:02 +00:00 |
|
|
P4T12ICK
|
ca7c9c878e
|
detection test
|
2020-11-09 16:41:09 +01:00 |
|
|
P4T12ICK
|
87a7d64d66
|
new tests
|
2020-11-09 13:25:27 +01:00 |
|
|
P4T12ICK
|
079742338b
|
deleting shadow copy test
|
2020-11-09 10:38:40 +01:00 |
|
|
Mikael Bjerkeland
|
fb0398fafb
|
Added test
|
2020-11-09 10:12:52 +01:00 |
|
|
P4T12ICK
|
f7fad21b02
|
ransomware notes test
|
2020-11-09 09:36:01 +01:00 |
|
|
P4T12ICK
|
66e2341012
|
ransomware extension
|
2020-11-09 09:26:04 +01:00 |
|
|
P4T12ICK
|
85f349668c
|
new detection testing file
|
2020-11-06 13:43:49 +01:00 |
|
|
P4T12ICK
|
ee59a8150b
|
new test file
|
2020-11-06 13:26:45 +01:00 |
|
|
Xiao Lin
|
811ba865fa
|
change test files to use ssa prefix
|
2020-11-05 17:36:30 +00:00 |
|
|
Xiao Lin
|
fa2ca47546
|
test yml
|
2020-11-05 17:03:54 +00:00 |
|
|
Xiao Lin
|
04f8db150a
|
Merge branch 'develop' of github.com:splunk/security-content into TR162
|
2020-11-04 22:40:23 +00:00 |
|
|
Jose Enrique Hernandez
|
db0e7bd862
|
Merge branch 'develop' into misko_apply_set_stolen_credentials
|
2020-11-04 14:40:49 -05:00 |
|
|
Jose Enrique Hernandez
|
c7b8e7166f
|
Merge pull request #816 from splunk/misko_cred_extract_APIs_and_Filenames
Credential Extraction detected via common exploit modules ...
|
2020-11-04 14:03:02 -05:00 |
|
|
jzsplunk
|
7434975199
|
Merge branch 'develop' into misko_apply_set_stolen_credentials
|
2020-11-04 10:03:17 -08:00 |
|
|
Jose Enrique Hernandez
|
c25465c174
|
Merge branch 'develop' into misko_cred_extract_APIs_and_Filenames
|
2020-11-04 12:26:48 -05:00 |
|
|
P4T12ICK
|
ac27485034
|
Merge branch 'develop' into new_test_file_format
|
2020-11-04 17:58:26 +01:00 |
|
|
Stanislav Miskovic
|
16821b72b8
|
Applying and setting stolen cresentials - detections via PowerSploit, Mimikatz and DSInternals APIs
|
2020-11-04 01:02:47 -08:00 |
|
|
P4T12ICK
|
15a3dfed60
|
detection tests
|
2020-11-03 17:04:53 +01:00 |
|
|
P4T12ICK
|
c952f06956
|
new format for test files
|
2020-10-30 09:11:41 +01:00 |
|
|
Stanislav Miskovic
|
470c94fc90
|
Credential Extraction: Changing passing condition to a new syntax
|
2020-10-29 00:42:19 -07:00 |
|
|
Stanislav Miskovic
|
b5707c8e22
|
Credential Extraction: moving test data from SMLE's to AR's S3 bucket and renaming test links
|
2020-10-28 11:38:08 -07:00 |
|
|
miskoSplunk
|
2839525e0c
|
Update and rename credential_extraction_ms_debuggers_z_option.test.yml to ssa___credential_extraction_ms_debuggers_z_option.test.yml
|
2020-10-28 01:30:16 -07:00 |
|
|
miskoSplunk
|
67be9820f8
|
Update and rename credential_extraction_ms_debuggers_kernel_peek.test.yml to ssa___credential_extraction_ms_debuggers_kernel_peek.test.yml
|
2020-10-28 01:29:01 -07:00 |
|
|
miskoSplunk
|
f47a5e18af
|
Update and rename credential_extraction_lazagne_command_options_ssa.test.yml to ssa___credential_extraction_lazagne_command_options.test.yml
|
2020-10-28 01:28:21 -07:00 |
|
|
miskoSplunk
|
2cdefdd198
|
Update and rename credential_extraction_fgdump_cachedump_v_option_ssa.test.yml to ssa___credential_extraction_fgdump_cachedump_v_option.test.yml
|
2020-10-28 01:27:38 -07:00 |
|
|
miskoSplunk
|
5f01133544
|
Update and rename credential_extraction_fgdump_cachedump_s_option_ssa.test.yml to ssa___credential_extraction_fgdump_cachedump_s_option.test.yml
|
2020-10-28 01:26:40 -07:00 |
|
|
Xiao Lin
|
daea9d4192
|
change to use SSA input_event
|
2020-10-27 22:30:00 +00:00 |
|
|
miskoSplunk
|
3185517716
|
Update and rename credential_extraction_powersploit_modules_ssa.test.yml to ssa___credential_extraction_powersploit_modules.test.yml
|
2020-10-27 15:17:41 -07:00 |
|
|
miskoSplunk
|
575fd73422
|
Update and rename credential_extraction_mimikatz_modules_ssa.test.yml to ssa___credential_extraction_mimikatz_modules.test.yml
|
2020-10-27 15:16:05 -07:00 |
|
|
miskoSplunk
|
8ec9c06f2e
|
Update and rename credential_extraction_getaddbaccount_from_dump_ssa.test.yml to ssa___credential_extraction_getaddbaccount_from_dump.test.yml
|
2020-10-27 11:36:01 -07:00 |
|
|
miskoSplunk
|
abf692795d
|
Update and rename credential_extraction_dsinternals_modules_ssa.test.yml to ssa___credential_extraction_dsinternals_modules.test.yml
|
2020-10-27 11:34:40 -07:00 |
|
|
miskoSplunk
|
2cd4512d65
|
Update and rename credential_extraction_dsinternals_conversion_modules_ssa.test.yml to ssa___credential_extraction_dsinternals_conversion_modules.test.yml
|
2020-10-27 11:32:33 -07:00 |
|
|
Stanislav Miskovic
|
922559d436
|
Credential Extraction: Adding tests, second try to push
|
2020-10-27 11:04:31 -07:00 |
|
|
Xiao Lin
|
ceca8c6e95
|
Merge branch 'develop' of github.com:splunk/security-content into TR162
|
2020-10-27 18:00:21 +00:00 |
|
|
Ignacio Bermudez Corrales
|
a19a43c2f9
|
fixed test and detection
|
2020-10-26 14:47:50 -07:00 |
|
|
Ignacio Bermudez Corrales
|
aec8ad9712
|
Removed tests that had issues they should be in branch add_gitlab_ci-all-tests
- phishing use case (mutliple syntax errors in detection)
- prohibited locations (lack of testing dataset)
|
2020-10-23 13:40:33 -07:00 |
|
|
Ignacio Bermudez Corrales
|
ab646c1c36
|
fixed pass condition
|
2020-10-22 16:30:17 -07:00 |
|
|
Ignacio Bermudez Corrales
|
9d139764bf
|
fixed tests
|
2020-10-22 14:30:14 -07:00 |
|
|
Xiao Lin
|
45f67bc365
|
add test data
|
2020-10-22 21:09:27 +00:00 |
|
|
Ignacio Bermudez Corrales
|
51c8df5f21
|
multiple tests supported + output validation
|
2020-10-22 12:47:15 -07:00 |
|
|
Bhavin Patel
|
8fef4fe2fe
|
Merge pull request #775 from splunk/improved_kerberoasting_attack
Automated Detection Testing PR improved_kerberoasting_attack
|
2020-10-20 11:01:40 -07:00 |
|
|
Bhavin Patel
|
7a45ca7143
|
Merge pull request #774 from splunk/pass_the_hash_detection
Automated Detection Testing PR pass_the_hash_detection
|
2020-10-20 10:55:43 -07:00 |
|
|
Jose Enrique Hernandez
|
ca119d7cb5
|
Merge branch 'develop' into improved_kerberoasting_attack
|
2020-10-19 17:29:03 -04:00 |
|