admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
14,636 Commits 697 Branches 195 Tags
temp_remove_attack_data
Commit Graph

14636 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
mhaag-spl 0772e6352b taskscheduler hunting 2021-10-21 09:56:27 -06:00
mjobanputra 2347743eed Add one stage in gitlab CI file which will trigger on tag push, which will publish build to pre_qa artifactory 2021-10-21 18:50:54 +05:30
root 0f12c3141a Added detection testing service results inCMD Carry Out String Command Parameter 2021-10-21 10:46:20 +00:00
tccontre bb1a684667 iceid_ttps 2021-10-21 12:24:22 +02:00
root ca54d339da Added detection testing service results inDisabling Defender Services 2021-10-21 10:10:35 +00:00
pyth0n1c 10d43aa599 Added functionality and checks to remove the security_content directory or persist the security_content directory. This is useful because, on slow connections, it makes running subsequent tests A LOT faster. It is also faster on a fast connection. Finally, and most importantly, it lets you easily persist and re-test changes that you've made to detections. 2021-10-20 18:17:07 -07:00
pyth0n1c 60262a57f8 Added some more command line arguments to speed up testing and did some more smoketesting. 2021-10-20 17:33:26 -07:00
pyth0n1c 4e52891726 Better parsing of files to test, better error handling, more code reuse. 2021-10-20 17:06:44 -07:00
pyth0n1c 505e2f7986 Cleanup and restructuring of main logic. Better prints, error handling, and readability. 2021-10-20 15:13:50 -07:00
mhaag-spl ebfe049534 Update windows_curl_download_to_suspicious_path.yml 2021-10-20 15:25:48 -06:00
root 682b9cbc74 Added detection testing service results inWindows Curl Download to Suspicious Path 2021-10-20 13:34:35 +00:00
mhaag-spl f7112aca62 fixes 2021-10-20 07:08:14 -06:00
root 50f4a08cca Added detection testing service results inWmic NonInteractive App Uninstallation 2021-10-20 12:01:43 +00:00
tccontre efdc9df9d5 iceid_ttps 2021-10-20 11:38:22 +02:00
pyth0n1c 9995e9123d Added some additional arguments to control which detections we will test. 2021-10-19 17:14:30 -07:00
pyth0n1c 9e76ab75fc Working better during testing, but still needs a huge amount of cleanup. Lots of dead code and magic strings. 2021-10-19 16:49:43 -07:00
mhaag-spl ee54fa595a Update windows_curl_download_to_suspicious_path.yml 2021-10-19 10:45:39 -06:00
mhaag-spl f8d6ce147d Curling 2021-10-19 10:44:17 -06:00
root 590722abf9 Added detection testing service results inDisable Defender AntiVirus Registry 2021-10-19 13:20:04 +00:00
root 8cc1b51807 Added detection testing service results inDisable Defender BlockAtFirstSeen Feature 2021-10-19 11:19:35 +00:00
root 810f878c7f Added detection testing service results inDisable Defender Enhanced Notification 2021-10-19 10:55:31 +00:00
root dba4e97378 Added detection testing service results inDisable Defender MpEngine Registry 2021-10-19 10:24:05 +00:00
root a201b87285 Added detection testing service results inDisable Defender Spynet Reporting 2021-10-19 10:00:24 +00:00
root 498f464337 Added detection testing service results inDisable Defender Submit Samples Consent Feature 2021-10-19 09:28:48 +00:00
root 6048d9697a Added detection testing service results inDisable Schedule Task 2021-10-19 08:42:46 +00:00
pyth0n1c cebe2118e5 Fixed name of one of the test files. 2021-10-18 16:45:34 -07:00
pyth0n1c 46fb396506 Changed one registry related detection to 
fix field name.
 2021-10-18 13:55:49 -07:00
tccontre fc7e90bd37 iceid_ttps 2021-10-18 17:11:53 +02:00
tccontre 794adbe6f3 iceid_ttps 2021-10-18 16:56:46 +02:00
pyth0n1c 2460d6b93b Fixing the naming of more Registry values 2021-10-15 16:19:37 -07:00
pyth0n1c a6522d37b6 Changed registry_key_name to 
registry_value_name in a number of
detections in response to sysmonTA
updates (correcting a previous error).
 2021-10-15 15:31:54 -07:00
pyth0n1c 69b809579d Fixed filenames on some tests. There were named 
*.yml.test.yml instead of *.test.yml
 2021-10-15 14:58:21 -07:00
pyth0n1c 75fe6a9f61 More progress. Now build and upload apps from local file system as well as install from splunkbase. 2021-10-15 13:55:46 -07:00
Bhavin Patel 5fe2633537 Branch was auto-updated. 2021-10-15 13:42:49 -07:00
Bhavin Patel e63f04d84b Branch was auto-updated. 2021-10-15 13:42:47 -07:00
Bhavin Patel 9624d3d31b Branch was auto-updated. 2021-10-15 13:42:46 -07:00
Bhavin Patel 078dbb5d6e Branch was auto-updated. 2021-10-15 13:42:45 -07:00
Bhavin Patel f872cfa2d0 Branch was auto-updated. 2021-10-15 13:42:44 -07:00
Bhavin Patel ae63d4a14d Branch was auto-updated. 2021-10-15 13:42:42 -07:00
Bhavin Patel 552b67da94 Merge pull request #1726 from splunk/tr-1076 
Process_id to Process_guid
 2021-10-15 13:42:23 -07:00
Detection Testing Service 6b60df3cba Merge branch 'setspn' of https://github.com/splunk/security_content into setspn 2021-10-15 19:26:27 +00:00
root d16e2b2829 Added detection testing service results inServicePrincipalNames Discovery with SetSPN 2021-10-15 19:26:26 +00:00
root 611e8b9595 Added detection testing service results inServicePrincipalNames Discovery with PowerShell 2021-10-15 19:25:19 +00:00
Bhavin Patel 49a31364e7 Branch was auto-updated. 2021-10-15 11:51:40 -07:00
Bhavin Patel 4f7403a485 Branch was auto-updated. 2021-10-15 11:51:39 -07:00
Bhavin Patel b3617991aa Branch was auto-updated. 2021-10-15 11:51:37 -07:00
Bhavin Patel e49f8681d2 Branch was auto-updated. 2021-10-15 11:51:37 -07:00
Bhavin Patel 65de958ba8 Branch was auto-updated. 2021-10-15 11:51:35 -07:00
Bhavin Patel cd4f49f6e2 Branch was auto-updated. 2021-10-15 11:51:34 -07:00
Bhavin Patel 40cac59e7c Branch was auto-updated. 2021-10-15 11:51:33 -07:00