admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
14,636 Commits 697 Branches 195 Tags
temp_remove_attack_data
Commit Graph

14636 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
pyth0n1c 64abbe4458 Significant changes. Most importantly, instead of a hard-coded wait time after uploading data, we poll to make sure that all the data has been indexed. When this is complete, we move ahead with the test. While this costs extra in terms of CPU and Disk access, it usually allows us to go much faster since wait time is usually just a few seconds. Better tracking of time per test and time estimation. 2022-01-05 14:39:13 -08:00
Lou Stella 334fb25cd0 Added malware hunt and contain playbook 2022-01-05 13:41:59 -06:00
Lou Stella 6819bb1be7 Added email notification for malware playbook 2022-01-05 13:28:38 -06:00
Lou Stella e396a3b9d4 Added block_indicators playbook 2022-01-05 12:17:54 -06:00
root 9bcad3d21b Added detection testing service results inLinux Change File Owner To Root 2022-01-05 16:34:58 +00:00
tccontre cebc5ac4fd Update linux_edit_cron_table_parameter.yml 2022-01-05 16:38:48 +01:00
tccontre 204670cbe1 Update linux_at_allow_config_file_creation.yml 2022-01-05 16:33:43 +01:00
root 2e9f51cca4 Added detection testing service results inLinux File Created In Kernel Driver Directory 2022-01-05 14:34:31 +00:00
root 64dfd4a621 Added detection testing service results inLinux Install Kernel Module Using Modprobe Utility 2022-01-05 13:08:14 +00:00
root a1a6087bcd Added detection testing service results inLinux Sudoers Tmp File Creation 2022-01-05 12:38:46 +00:00
tccontre 06ffa22394 Update linux_sudoers_tmp_file_creation.yml 2022-01-05 13:20:37 +01:00
tccontre ab844e062f linux_persist_priv_batch_3 2022-01-05 13:17:08 +01:00
root fb306cb79b Added detection testing service results inLinux Visudo Utility Execution 2022-01-05 12:12:09 +00:00
tccontre 14534c2f53 Merge branch 'linux_persist_priv_batch_3' of github.com:splunk/security_content into linux_persist_priv_batch_3 2022-01-05 12:48:02 +01:00
tccontre 377a4822f7 linux_persist_priv_batch_3 2022-01-05 12:47:45 +01:00
root 78e61e8ee4 Added detection testing service results inLinux Change File Owner To Root 2022-01-05 11:42:47 +00:00
tccontre 37185f3e0d linux_persist_priv_batch_3 2022-01-05 11:34:57 +01:00
tccontre fa843067da Merge pull request #1917 from splunk/remocs_desc_update 
remcos_desc_update
 2022-01-05 09:41:08 +01:00
tccontre 78732dfe2d Update linux_file_creation_in_profile_directory.yml 2022-01-04 18:00:42 +01:00
tccontre e8cde0b1f6 Update linux_file_creation_in_init_boot_directory.yml 2022-01-04 17:59:26 +01:00
pyth0n1c e10f55348c Updated Detection Text 
Updated Text of Detection "Suspicious Process DNS Query Known Abuse Web Services"
 2022-01-04 08:47:13 -08:00
pyth0n1c 8891384376 Small Text Update 
Small Text Update to "Loading Of Dynwrapx Module"
 2022-01-04 08:42:39 -08:00
tccontre 7420f730d4 Update suspicious_process_dns_query_known_abuse_web_services.yml 2022-01-04 17:39:17 +01:00
pyth0n1c 249c784daf Small Text Updates 
Small Text Updates to "Loading Of Dynwrapx Module"
 2022-01-04 08:38:05 -08:00
pyth0n1c 5702bf9c7d Minor Text Updates 
Minor Text Updates to "System Info Gathering Using Dxdiag Application"
 2022-01-04 08:36:46 -08:00
pyth0n1c 54e6931e48 Minor Text Updates 
Minor updates to the text of  "Suspicious Process DNS Query Known Abuse Web Services"
 2022-01-04 08:31:04 -08:00
pyth0n1c cff1c5dd74 Update Text of Detection 
Minor update to text of "Possible Browser Pass View Parameter"
 2022-01-04 08:23:36 -08:00
pyth0n1c 3c6c0dc575 Minor Text Update 
Minor update to text of "Loading Of Dynwrapx Module"
 2022-01-04 08:21:15 -08:00
Detection Testing Service 7fab0d38e0 test: git token variable name update 2022-01-04 17:45:34 +05:30
Detection Testing Service 79808deea1 Merge branch 'linux_persist_priv_batch_2' of https://github.com/splunk/security_content into linux_persist_priv_batch_2 2022-01-04 11:36:48 +00:00
root 4c40ac8961 Added detection testing service results inLinux Setuid Using Chmod Utility 2022-01-04 11:36:47 +00:00
root 1be58f55d2 Added detection testing service results inLinux Service Restarted 2022-01-04 11:35:23 +00:00
tccontre ff3172c7c0 linux_persist_priv_batch_2 2022-01-04 12:15:50 +01:00
tccontre 74dcbf5bbe linux_persist_priv_batch_2 2022-01-04 11:47:11 +01:00
root 472519cac0 Added detection testing service results inLinux File Creation In Init Boot Directory 2022-01-04 10:32:49 +00:00
tccontre f96aa5fbe3 Update linux_file_creation_in_init_boot_directory.yml 2022-01-04 11:11:14 +01:00
tccontre 9c96e69754 remcos_desc_update 2022-01-04 10:25:11 +01:00
Lou Stella 94f903d685 Merge pull request #1916 from splunk/adding_not_supported 
modify experimental detections to say not supported
 2022-01-03 13:46:45 -06:00
d1vious 8f0518b5af spelling fix 2022-01-03 14:39:48 -05:00
d1vious 7c1025425a fixed spelling 2022-01-03 14:35:49 -05:00
d1vious 50ba793358 fixing formatting 2022-01-03 12:20:42 -05:00
d1vious 1e731ee7af modify experimental detections to say not supported 2022-01-03 12:03:34 -05:00
tccontre 74b0691d7a Update linux_setuid_using_chmod_utility.yml 2022-01-03 15:52:31 +01:00
tccontre b20d3fed32 Update linux_file_creation_in_init_boot_directory.test.yml 2022-01-03 15:43:18 +01:00
Detection Testing Service cfe4b7148e Merge branch 'linux_persist_priv_batch_2' of https://github.com/splunk/security_content into linux_persist_priv_batch_2 2022-01-03 13:06:52 +00:00
root 943802aec6 Added detection testing service results inLinux File Creation In Profile Directory 2022-01-03 13:06:51 +00:00
tccontre 7c2874bb1e linux_persist_priv_batch_2 2022-01-03 13:57:17 +01:00
root 5ea972280c Added detection testing service results inLinux Service File Created In Systemd Directory 2022-01-03 12:38:40 +00:00
tccontre 0140a5a99b Update linux_setuid_using_chmod_utility.yml 2022-01-03 12:54:55 +01:00
tccontre f85658f1a0 linux_persist_priv_batch_2 2022-01-03 12:25:08 +01:00