admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
14,636 Commits 697 Branches 195 Tags
temp_remove_attack_data
Commit Graph

14636 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
tccontre 882f1eafd0 Merge pull request #1436 from splunk/ransom_ttps 
ransomware common TTPs
 2021-06-17 15:21:56 +02:00
tccontre 1199c7f423 ssa3 2021-06-17 14:17:36 +02:00
divious1 8144275f34 making it a correct yml 2021-06-16 18:06:36 -04:00
divious1 1b076b9809 observables 2021-06-16 18:02:29 -04:00
mhaag-spl 90bf8bb996 Update detect_wmi_event_subscription_persistence.yml 2021-06-16 15:55:58 -06:00
Jose Enrique Hernandez 56e77dccfb Update ssa___detect_kerberoasting.yml 2021-06-16 16:15:33 -04:00
Jose Enrique Hernandez bfa0daabd4 fixe dv 2021-06-16 15:50:19 -04:00
mhaag-spl 99e3af8d10 wmi event subscription 2021-06-16 13:48:07 -06:00
divious1 e0446a8ebf adding risk score 2021-06-16 13:52:16 -04:00
divious1 66c4215805 first test 2021-06-16 13:46:22 -04:00
mhaag-spl c85fc0e1c2 Update malicious_powershell.yml 2021-06-16 10:41:49 -06:00
divious1 d35abc5689 moved around location of label 2021-06-16 12:06:49 -04:00
divious1 3134df2380 added deprecated label as well as description annotation 2021-06-16 11:59:31 -04:00
tccontre b6ab35397a ssa2 2021-06-16 17:11:08 +02:00
tccontre fb1ce4133b ssa2 2021-06-16 17:01:00 +02:00
divious1 06fbc3c476 Merge branch 'develop' into deprecation_of_detections 2021-06-16 10:42:00 -04:00
divious1 59ffaf8c25 adding deprecation to generate 2021-06-16 10:31:30 -04:00
tccontre 79c86ce0fd ssa 2021-06-16 16:19:55 +02:00
tccontre a1b27f125f Delete allow_operation_with_consent_admin.test.yml 
un-intended files. this is already in rttp PR
 2021-06-16 10:22:00 +02:00
tccontre 9a25b289c3 Delete clear_unallocated_sector_using_cipher_app.test.yml 
un-intended files. this is already in rttp PR
 2021-06-16 10:21:41 +02:00
tccontre de20af3ac5 Delete permission_modification_using_takeown_app.test.yml 
un-intended files. this is already in rttp PR
 2021-06-16 10:21:28 +02:00
tccontre 150d8c9f34 Delete prevent_automatic_repair_mode_using_bcdedit.test.yml 
un-intended files. this is already in rttp PR
 2021-06-16 10:21:05 +02:00
tccontre 32defb377a Delete start_up_during_safe_mode_boot.test.yml 
un-intended files. this is already in rttp PR
 2021-06-16 10:20:51 +02:00
tccontre b198eb9a22 Delete start_up_during_safe_mode_boot.yml 
un-intended files. this is already in rttp PR
 2021-06-16 10:20:32 +02:00
tccontre 6a92e68a08 Delete prevent_automatic_repair_mode_using_bcdedit.yml 
un-intended files. this is already in rttp PR
 2021-06-16 10:20:17 +02:00
tccontre 75189e2b1d Delete permission_modification_using_takeown_app.yml 
un-intended files. this is already in rttp PR
 2021-06-16 10:19:57 +02:00
tccontre e9e5c446f4 Delete clear_unallocated_sector_using_cipher_app.yml 
un-intended files. this is already in rttp PR
 2021-06-16 10:19:39 +02:00
tccontre c7c2b94d37 Delete allow_operation_with_consent_admin.yml 
un-intended files. this is already in rttp PR
 2021-06-16 10:19:27 +02:00
tccontre 878bf692fa Delete disable_logs_using_wevtutil.test.yml 
un-intended files. this is already in rttp PR
 2021-06-16 10:13:51 +02:00
tccontre ff8878ce3d Delete disable_logs_using_wevtutil.yml 
un-intended files to be included in this PR. this file is in rttp PR
 2021-06-16 10:12:14 +02:00
patel-bhavin 667396b4ce updated rba spec 2021-06-15 17:04:51 -07:00
root 1cf181772d Added detection testing service results inPowerShell Domain Enumeration 2021-06-15 20:53:39 +00:00
mhaag-spl 25b1087abc Domain enumeration 2021-06-15 14:02:45 -06:00
root b83ab2b8b5 Added detection testing service results inPowerShell Loading DotNET into Memory via System Reflection Assembly 2021-06-15 19:53:56 +00:00
mhaag-spl 4476dc1705 spec chars 2021-06-15 13:28:27 -06:00
mhaag-spl a169f1b226 Name fix 2021-06-15 13:26:01 -06:00
mhaag-spl a4d3947ee3 System.Reflection.Assembly 
System.Reflection.Assembly
 2021-06-15 13:16:17 -06:00
Detection Testing Service ba31f2035d Merge branch 'den-haag' of https://github.com/splunk/security_content into den-haag 2021-06-15 18:08:49 +00:00
root 67f8c9e0f2 Added detection testing service results inPowershell Fileless Script Contains Base64 Encoded Content 2021-06-15 18:08:49 +00:00
Detection Testing Service 2a50ee7941 Merge branch 'den-haag' of https://github.com/splunk/security_content into den-haag 2021-06-15 18:00:41 +00:00
root c9ee862dfb Added detection testing service results inPowershell Fileless Process Injection via GetProcAddress 2021-06-15 18:00:40 +00:00
Detection Testing Service 05a3ee8d23 Merge branch 'den-haag' of https://github.com/splunk/security_content into den-haag 2021-06-15 18:00:00 +00:00
root ea30e047cf Added detection testing service results inUnloading AMSI via Reflection 2021-06-15 17:59:59 +00:00
Detection Testing Service c4d68238e2 Merge branch 'den-haag' of https://github.com/splunk/security_content into den-haag 2021-06-15 17:59:41 +00:00
root dc8fef0ae2 Added detection testing service results inDetect Mimikatz With PowerShell Script Block Logging 2021-06-15 17:59:41 +00:00
root 112dddf43c Added detection testing service results inDetect Empire with PowerShell Script Block Logging 2021-06-15 17:53:06 +00:00
mhaag-spl f57f0f22d6 Fixed queries 2021-06-15 11:29:24 -06:00
P4T12ICK 1deb552054 new detection testing 2021-06-15 17:50:53 +02:00
Detection Testing Service 3381ce7205 Merge branch 'hpot_ttp' of https://github.com/splunk/security_content into hpot_ttp 2021-06-15 15:50:48 +00:00
root 76023baae1 Added detection testing service results inWMI Recon Running Process Or Services 2021-06-15 15:50:47 +00:00