admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
2,793 Commits 697 Branches 195 Tags
remove_commuunity_branch
Commit Graph

57 Commits

Author SHA1 Message Date
Ignacio Bermudez Corrales a19a43c2f9 fixed test and detection 2020-10-26 14:47:50 -07:00
Ignacio Bermudez Corrales aec8ad9712 Removed tests that had issues they should be in branch add_gitlab_ci-all-tests 
- phishing use case (mutliple syntax errors in detection)
- prohibited locations (lack of testing dataset)
 2020-10-23 13:40:33 -07:00
Ignacio Bermudez Corrales ab646c1c36 fixed pass condition 2020-10-22 16:30:17 -07:00
Ignacio Bermudez Corrales 9d139764bf fixed tests 2020-10-22 14:30:14 -07:00
Ignacio Bermudez Corrales 51c8df5f21 multiple tests supported + output validation 2020-10-22 12:47:15 -07:00
Bhavin Patel 8fef4fe2fe Merge pull request #775 from splunk/improved_kerberoasting_attack 
Automated Detection Testing PR improved_kerberoasting_attack
 2020-10-20 11:01:40 -07:00
Bhavin Patel 7a45ca7143 Merge pull request #774 from splunk/pass_the_hash_detection 
Automated Detection Testing PR pass_the_hash_detection
 2020-10-20 10:55:43 -07:00
Jose Enrique Hernandez ca119d7cb5 Merge branch 'develop' into improved_kerberoasting_attack 2020-10-19 17:29:03 -04:00
Ignacio Bermudez Corrales ebb0554cea test files for ssa detections 2020-10-16 14:08:23 -07:00
Ignacio Bermudez Corrales 3f8b95f6cd adding tests per detection 2020-10-16 12:45:14 -07:00
P4T12ICK d788863bca fixed kerberoasting detection 2020-10-16 11:29:46 +02:00
P4T12ICK 7fe760cf54 rebased with develop 2020-10-16 09:52:08 +02:00
divious1 3a384454ac updated to point to the right file 2020-10-15 15:55:36 -04:00
divious1 015514ee1e notebook for prohibited apps spawning 2020-10-15 15:43:22 -04:00
P4T12ICK 2f9fe75f9c Improved and tested pass the hash detection 2020-10-15 14:35:53 +02:00
P4T12ICK 6938154a94 ready for PR 2020-10-14 16:13:55 +02:00
P4T12ICK c9ead8f05b updates to new testing structure 2020-10-14 11:30:24 +02:00
P4T12ICK bf18c1514d updates 2020-10-13 13:50:28 +02:00
P4T12ICK c9875509d4 new test file 2020-10-09 12:54:09 +02:00
P4T12ICK e48567ac56 new test file 2020-10-09 12:28:07 +02:00
P4T12ICK 389e25b2e3 new test file 2020-10-09 12:12:06 +02:00
P4T12ICK e30c83593a new test file 2020-10-09 11:32:38 +02:00
P4T12ICK 51ff574655 new test file 2020-10-09 11:29:48 +02:00
P4T12ICK fd0b90bd2d new test file 2020-10-09 11:28:23 +02:00
P4T12ICK 44bbdf8927 new_test_file 2020-10-09 10:35:28 +02:00
P4T12ICK 9f85f5f34e new_test_file 2020-10-09 10:31:00 +02:00
P4T12ICK 6588eef977 new_test_file 2020-10-09 10:21:21 +02:00
P4T12ICK dbc9f267d0 new test 2020-10-09 09:29:38 +02:00
P4T12ICK b6fac54d24 updates 2020-10-08 16:18:12 +02:00
P4T12ICK f81abbc79d updates 2020-10-08 13:01:52 +02:00
P4T12ICK 1ba4259f4e update for new attack range design 2020-10-06 16:07:45 +02:00
P4T12ICK 3e0cfa84cb updated test files 2020-09-07 13:18:03 +02:00
Patrick Bareiss bd1c4d8231 merged with develop 2020-07-29 11:03:54 +02:00
Patrick Bareiss b34f553837 updated test files 2020-07-29 11:01:13 +02:00
Patrick Bareiss d0aa56f92c updated test files 2020-07-29 11:00:22 +02:00
Patrick Bareiss ed7b65bfab merged with develop 2020-07-29 10:55:23 +02:00
Patrick Bareiss 9d7a8c2e3e Merge branch 'develop' into TR038-create-local-admin-accounts-using-net-exe 2020-07-29 10:55:02 +02:00
P4T12ICK a93c669aac Merge branch 'develop' into TR037-process-execution-via-wmi 2020-07-29 10:03:09 +02:00
Joseph Zadeh 3f93f64bfd [TR-038] update mitre id for detection. add test for net exe specific behavior 2020-07-28 11:47:58 -07:00
Patrick Bareiss 074b782dd0 detection tested 2020-07-28 15:43:57 +02:00
Patrick Bareiss 1619908a32 merged 2020-07-28 14:20:39 +02:00
Patrick Bareiss 004eeb2347 merged 2020-07-28 14:20:14 +02:00
Patrick Bareiss 8db3edafe2 tested detection 2020-07-28 14:17:10 +02:00
Patrick Bareiss f74a0fe273 successful tested 2020-07-28 11:14:34 +02:00
Patrick Bareiss a21c34870f test detection 2020-07-24 15:07:56 +02:00
Joseph Zadeh ce279c60af [TR-037] test for process execution via WMI (no mitre sub-technique for this attack type). 2020-07-22 08:30:02 -07:00
Patrick Bareiss a38b71f11d converted detections to subtechniques 2020-07-22 10:59:55 +02:00
Patrick Bareiss 37e6f6f7c0 new pass condition handling 2020-07-09 14:29:53 +02:00
Patrick Bareiss 6f77dbd20c new pass condition handling 2020-07-09 14:21:33 +02:00
Patrick Bareiss 49d98cfc45 detection tested 2020-07-08 15:09:05 +02:00