admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
14,636 Commits 697 Branches 195 Tags
temp_remove_attack_data
Commit Graph

14636 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
mhaag-spl a862fd7d4a Update net_localgroup_discovery.yml 2021-12-03 10:19:40 -07:00
mhaag-spl 370ef774ed minor fixes - passed validate 2021-12-03 06:01:32 -07:00
mhaag-spl c21877ceb8 A Nightmare on Haag Street 
## Updated Analytics
Attempt To Delete Services
Attempt To Disable Services
Attempted Credential Dump From Registry via Reg exe
Delete a net user
Deny Permission using Cacls Utility
Detect Dump LSASS Memory using comsvcs
Disable Net User Account
First time seen command line argument
Grant Permission Using Cacls Utility
Prohibited apps spawning cmdprompt
Potential Pass the Token or Hash Observed at the Destination Device
Rare Parent-Child Process Relationship
ptt pth kerb ntlm origin device
Resize Shadowstorage Volume
sdelete application execution

## Deprecated BA Analytics
ssa___applying_stolen_credentials_via_mimikatz_modules.yml
ssa___applying_stolen_credentials_via_powersploit_modules.yml
ssa___assess_credential_strength_via_dsinternals_modules.yml
ssa___credential_extraction_dsinternals_conversion_modules.yml
Ssa___credential_extraction_dsinternals_modules.yml
Ssa___credential_extraction_getaddbaccount_from_dump.yml
Ssa___credential_extraction_powersploit_modules.yml
ssa___illegal_access_user_content_via_powersploit_modules.yml
ssa___illegal_account_creation_via_powersploit_modules.yml
ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
ssa___illegal_log_deletion_via_mimikatz_modules.yml
ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
Ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
ssa___illegal_service_and_process_control_via_powersploit_modules.yml
Ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
ssa___recon_and_use_computers_via_mimikatz_modules.yml
ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
ssa___recon_and_use_shares_via_mimikatz_modules.yml
ssa___recon_and_use_shares_via_powersploit_modules.yml
Ssa___recon_connectivity_via_powersploit_modules.yml
ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
ssa___recon_defensive_tools_via_powersploit_modules.yml
ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
ssa___recon_processes_and_services_via_mimikatz_modules.yml
ssa___setting_credentials_via_dsinternals_modules.yml
ssa___setting_credentials_via_mimikatz_modules.yml
ssa___setting_credentials_via_powersploit_modules.yml

ssa___credential_extraction_fgdump_cachedump_s_option.yml
Ssa___credential_extraction_fgdump_cachedump_v_option.yml
ssa___credential_extraction_ms_debuggers_kernel_peek.yml
ssa___credential_extraction_ms_debuggers_z_option.yml
Ssa___credential_extraction_lazagne_command_options.yml
 2021-12-03 05:57:54 -07:00
research bot 750c81fb5b updating docs and package bits [ci skip] 2021-12-02 18:50:01 +00:00
pyth0n1c 17726fcdff Running a test with the old sysmon to compare the results. 2021-12-02 10:00:01 -08:00
Bhavin Patel 2c0bc58a6a Branch was auto-updated. 2021-12-02 09:02:10 -08:00
Bhavin Patel 51ccf14ddf Branch was auto-updated. 2021-12-02 09:02:08 -08:00
Bhavin Patel fba1d395b5 Branch was auto-updated. 2021-12-02 09:02:07 -08:00
Bhavin Patel 6eadae069a Branch was auto-updated. 2021-12-02 09:02:04 -08:00
Bhavin Patel 3074f69e25 Branch was auto-updated. 2021-12-02 09:02:01 -08:00
Bhavin Patel fa2a204672 Merge pull request #1858 from splunk/ssa_why_java_why 
Extra filters for java
v3.31.0 		2021-12-02 09:01:40 -08:00
David Dorsey 0df7bf2cdc Extra filters for java 2021-12-02 08:54:12 -06:00
pyth0n1c 6457b505db When there is an error checking out a git PR. If the PR number is bad, we will exit. Also updated the CI/CD to test all of develop again. We will look at the results after we have increased the wait time after loading data a bit. 2021-12-01 15:58:31 -08:00
Bhavin Patel 1747744648 Branch was auto-updated. 2021-12-01 15:41:24 -08:00
Bhavin Patel abbbab400f Branch was auto-updated. 2021-12-01 15:41:23 -08:00
Bhavin Patel d9cb252a34 Branch was auto-updated. 2021-12-01 15:41:20 -08:00
Bhavin Patel 568d2e9481 Branch was auto-updated. 2021-12-01 15:41:19 -08:00
Bhavin Patel cf0a7d0c9e Branch was auto-updated. 2021-12-01 15:41:18 -08:00
Bhavin Patel 57c1ef30dd Merge pull request #1857 from splunk/RegistryDetectionFixes 
Registry detection fixes
 2021-12-01 15:41:01 -08:00
dependabot[bot] 044d3ccca2 Bump filelock from 3.3.2 to 3.4.0 
Bumps [filelock](https://github.com/tox-dev/py-filelock) from 3.3.2 to 3.4.0.
- [Release notes](https://github.com/tox-dev/py-filelock/releases)
- [Changelog](https://github.com/tox-dev/py-filelock/blob/main/docs/changelog.rst)
- [Commits](https://github.com/tox-dev/py-filelock/compare/3.3.2...3.4.0)

---
updated-dependencies:
- dependency-name: filelock
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2021-12-01 23:00:52 +00:00
dependabot[bot] 353513b8c0 Bump identify from 2.3.5 to 2.4.0 
Bumps [identify](https://github.com/pre-commit/identify) from 2.3.5 to 2.4.0.
- [Release notes](https://github.com/pre-commit/identify/releases)
- [Commits](https://github.com/pre-commit/identify/compare/v2.3.5...v2.4.0)

---
updated-dependencies:
- dependency-name: identify
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2021-12-01 23:00:46 +00:00
dependabot[bot] 7687ca1004 Bump msgpack from 1.0.2 to 1.0.3 
Bumps [msgpack](https://github.com/msgpack/msgpack-python) from 1.0.2 to 1.0.3.
- [Release notes](https://github.com/msgpack/msgpack-python/releases)
- [Changelog](https://github.com/msgpack/msgpack-python/blob/main/ChangeLog.rst)
- [Commits](https://github.com/msgpack/msgpack-python/compare/v1.0.2...v1.0.3)

---
updated-dependencies:
- dependency-name: msgpack
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2021-12-01 23:00:42 +00:00
pyth0n1c 531d550b3b Just change the workflow to explicitly test the RegistryDetectionFixes branch. 2021-12-01 14:44:51 -08:00
pyth0n1c 3a8dc379bd Restoring modified files because they do not work with the new sysmon. Now, all of the detections in this branch work. 2021-12-01 14:36:49 -08:00
Bhavin Patel 837cfc2551 Branch was auto-updated. 2021-12-01 12:16:19 -08:00
Bhavin Patel 9836dc85bd Branch was auto-updated. 2021-12-01 12:16:15 -08:00
Bhavin Patel cb053c1847 Merge pull request #1771 from splunk/ssa_why_chrome_why 
Ssa why chrome why
 2021-12-01 12:15:54 -08:00
David Dorsey 76858554a3 Merge branch 'develop' into ssa_why_chrome_why 2021-12-01 14:04:22 -06:00
Bhavin Patel 4c9fc158cd Branch was auto-updated. 2021-12-01 11:42:55 -08:00
Bhavin Patel ee54e4741c Branch was auto-updated. 2021-12-01 11:42:52 -08:00
Michael Haag a5d81f3cd5 Merge pull request #1835 from splunk/ssa_minor_update 
Ssa minor update
 2021-12-01 12:42:32 -07:00
Michael Haag 6999693e3b fixed 2021-12-01 12:34:20 -07:00
Michael Haag f0157408a7 Updated some words 2021-12-01 12:28:38 -07:00
David Dorsey 3872168920 Merge branch 'ssa_why_chrome_why' of github.com:splunk/security-content into ssa_why_chrome_why 2021-12-01 13:15:52 -06:00
David Dorsey 31342ab905 Fixed data model 2021-12-01 13:15:39 -06:00
pyth0n1c 859bd9c6da Some small changes dealing with errors during a test. 2021-12-01 11:00:04 -08:00
Michael Haag 7300bfe836 Update ssa___resize_shadowstorage_volume.yml 2021-12-01 11:50:33 -07:00
Bhavin Patel ff3fb25109 Branch was auto-updated. 2021-12-01 10:31:35 -08:00
Bhavin Patel 20317e465f Branch was auto-updated. 2021-12-01 10:31:32 -08:00
Bhavin Patel 128bf22f39 Branch was auto-updated. 2021-12-01 10:31:31 -08:00
Bhavin Patel 6dd8123c0d Branch was auto-updated. 2021-12-01 10:31:28 -08:00
Bhavin Patel f8c2d3a4ba Merge pull request #1852 from splunk/rclone 
Rclone Haagrid
 2021-12-01 10:31:09 -08:00
David Dorsey 87f62f2177 Fixed data model 2021-11-30 22:23:31 -06:00
pyth0n1c c085327a72 Change the detection testing mode to all for a test of everything. 2021-11-30 19:33:46 -08:00
pyth0n1c c9c2f7c3e3 Initial support for testing if a container crashes or fails to start during setup. In that case, the whole test will finish, the other containers will be stopped, and we will fail. 2021-11-30 19:32:52 -08:00
Bhavin Patel d61b908f5d Branch was auto-updated. 2021-11-30 16:19:12 -08:00
Bhavin Patel 78be05b638 Branch was auto-updated. 2021-11-30 16:19:11 -08:00
Bhavin Patel 46b368785a Branch was auto-updated. 2021-11-30 16:19:10 -08:00
Bhavin Patel dd2475c402 Branch was auto-updated. 2021-11-30 16:19:10 -08:00
Bhavin Patel d557407f94 Branch was auto-updated. 2021-11-30 16:19:07 -08:00