admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
17,429 Commits 697 Branches 195 Tags
security_content_4_dev
Commit Graph

1652 Commits

Author SHA1 Message Date
P4T12ICK a9fe894cb9 wip 2022-10-20 16:35:05 +02:00
Michael Haag 593c433ae8 fixes 
fixes
 2022-09-16 12:47:19 -06:00
Michael Haag 6d1734b902 msdt 2022-09-15 13:43:28 -06:00
Michael Haag 0597208d3d cant type 2022-09-15 13:06:37 -06:00
Michael Haag 7a95a27a2c ODBC 2022-09-15 12:42:34 -06:00
Michael Haag 5e85c0dd7c Windows Ingress Tool Transfer Using Explorer SSA 2022-09-15 12:19:18 -06:00
Michael Haag 615b24fe6d PLINK 2022-09-15 10:52:56 -06:00
pyth0n1c 8f7b0aead7 Branch was auto-updated. 2022-09-15 09:33:37 -07:00
pyth0n1c e7ea3800b2 Branch was auto-updated. 2022-09-14 12:54:36 -07:00
pyth0n1c f16c9ddf53 Branch was auto-updated. 2022-09-14 12:54:32 -07:00
pyth0n1c a5a54def02 Branch was auto-updated. 2022-09-14 09:54:32 -07:00
pyth0n1c 86113bd7b2 Branch was auto-updated. 2022-09-14 09:54:30 -07:00
pyth0n1c 39cc6579ca Branch was auto-updated. 2022-09-14 09:54:25 -07:00
patel-bhavin 96e81ef195 adding test file updates 2022-09-13 18:49:00 -05:00
patel-bhavin 7ae6ec7be1 search updates and datasets 2022-09-13 17:37:24 -05:00
patel-bhavin fd475e9625 adding datasets 2022-09-13 15:33:46 -05:00
Michael Haag f0324892d5 hunt Windows Event Triggered Image File Execution Options Injection 2022-09-09 06:50:43 -06:00
Michael Haag 442955c826 chm fixes 2022-09-08 10:48:20 -06:00
Michael Haag 6531d4350e Update ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml 2022-09-08 10:34:08 -06:00
Michael Haag 1c928ebffe fixord 2022-09-08 10:27:54 -06:00
Michael Haag 6ea7428011 test test 2022-09-08 10:23:08 -06:00
tccontre 85fc55b281 brute-rate-3 2022-09-05 10:26:55 +02:00
pyth0n1c 9894bf1583 Branch was auto-updated. 2022-09-02 19:15:34 -04:00
pyth0n1c 7879f6b016 Branch was auto-updated. 2022-09-02 19:15:33 -04:00
pyth0n1c 5946b4adfa Branch was auto-updated. 2022-09-02 19:15:30 -04:00
pyth0n1c 5c4d054652 Update linux_kernel_module_enumeration.test.yml 
Changing sourcetype from linux_sysmon --> sysmon_linux
 2022-09-02 18:50:48 -04:00
Michael Haag 6287645f48 BA 2022-09-02 14:44:39 -06:00
Michael Haag affae7229d SSA all things 2022-09-01 15:02:44 -06:00
tccontre 25ec32f85d Merge branch 'brute-ratel-3' of github.com:splunk/security_content into brute-ratel-3 2022-09-01 15:18:54 +02:00
tccontre c1491e38d1 brute-ratel-3 2022-09-01 15:18:30 +02:00
tccontre a04fd01b34 Delete windows_gather_victim_identity_sam_info.test.yml 2022-09-01 13:20:14 +02:00
tccontre 42cf9d4d02 Delete windows_hijack_execution_flow_version_dll_side_load.test.yml 2022-09-01 13:20:04 +02:00
tccontre 183f1f689e Delete windows_input_capture_using_credential_ui_dll.test.yml 2022-09-01 13:19:55 +02:00
tccontre 22721a4554 Delete windows_phishing_recent_iso_exec_registry.test.yml 2022-09-01 13:19:45 +02:00
tccontre ce4f5e5ad3 Delete windows_remote_access_software_brc4_loaded_dll.test.yml 2022-09-01 13:19:35 +02:00
tccontre 506732a62b brute-ratel-3 2022-09-01 13:16:24 +02:00
tccontre 1557a528cf brute-ratel-2 2022-08-31 10:12:55 +02:00
tccontre b401ed9d50 brute-ratel-2 2022-08-30 13:08:04 +02:00
pyth0n1c bd2d1515cb Branch was auto-updated. 2022-08-26 10:01:42 -07:00
Michael Haag 8248278109 Remote Access Software 2022-08-22 21:57:53 -06:00
Michael Haag 13d400611a LSA 🐍 SS 2022-08-22 21:16:12 -06:00
Michael Haag fd88c88762 Hijack Libraries 2022-08-19 14:37:29 -06:00
gowthamarajr ddf0db898d Merge branch 'TR_2301' of https://github.com/splunk/security_content into TR_2301 2022-08-12 07:27:19 -04:00
gowthamarajr bed8043fe8 Add 12 More detections (T1548) 2022-08-12 07:27:16 -04:00
pyth0n1c 084d711188 Branch was auto-updated. 2022-08-11 12:16:22 -07:00
pyth0n1c 742d674a89 Branch was auto-updated. 2022-08-11 11:30:14 -07:00
pyth0n1c 2eb9bf40de Branch was auto-updated. 2022-08-11 11:30:10 -07:00
Bhavin Patel 74ece59913 Merge pull request #2309 from splunk/tatertots 
Haag it!
 2022-08-11 11:29:48 -07:00
gowthamarajr 51693e4ba5 Add T1548.003 2022-08-10 06:58:54 -04:00
gowthamarajr 29a61f8cb6 Add detections for Awk, Node, Docker Lotl 2022-08-02 16:23:31 -04:00