 mhaag-spl
|
70e1c9a454
|
Update office_document_spawned_child_process_to_download.yml
|
2021-09-20 12:05:05 -06:00 |
|
|
root
|
7ed4be864e
|
Added detection testing service results inSuspicious SearchProtocolHost no Command Line Arguments
|
2021-09-20 18:05:05 +00:00 |
|
|
pyth0n1c
|
0cd2cd850f
|
Duplicate folder names were clobbering each other. Also commented around initial steps to speed up testing time. We will re use the docker containers that we initially built each time for testing.
|
2021-09-20 11:01:06 -07:00 |
|
|
Detection Testing Service
|
479384a6c1
|
Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm
|
2021-09-20 17:58:13 +00:00 |
|
|
root
|
28f03fcbcd
|
Added detection testing service results inSuspicious Rundll32 with no Command Line Arguments
|
2021-09-20 17:58:12 +00:00 |
|
|
Detection Testing Service
|
7d3c68faa1
|
Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm
|
2021-09-20 17:54:58 +00:00 |
|
|
root
|
9373763ea3
|
Added detection testing service results inSuspicious GPUpdate no Command Line Arguments
|
2021-09-20 17:54:58 +00:00 |
|
|
Detection Testing Service
|
583db3e726
|
Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm
|
2021-09-20 17:51:29 +00:00 |
|
|
root
|
0a34def1b3
|
Added detection testing service results inSuspicious DLLHost no Command Line Arguments
|
2021-09-20 17:51:28 +00:00 |
|
|
mhaag-spl
|
0718d28f83
|
Update suspicious_searchprotocolhost_no_command_line_arguments.yml
|
2021-09-20 11:42:34 -06:00 |
|
|
mhaag-spl
|
14f9bea865
|
mwc hunting and rundll32 fix
|
2021-09-20 11:39:40 -06:00 |
|
|
mhaag-spl
|
4096b496a5
|
Update suspicious_gpupdate_no_command_line_arguments.yml
|
2021-09-20 11:34:25 -06:00 |
|
|
mhaag-spl
|
4320d4ab5b
|
Update suspicious_dllhost_no_command_line_arguments.yml
|
2021-09-20 11:32:31 -06:00 |
|
|
root
|
5d2d0384e3
|
Added detection testing service results inDetect regsvcs with no Command Line Arguments
|
2021-09-20 17:21:26 +00:00 |
|
|
Stanislav Miskovic
|
75109143ca
|
Paths to new tests ...
|
2021-09-20 10:20:33 -07:00 |
|
|
mhaag-spl
|
e07d94f396
|
regsvcs regasm
|
2021-09-20 11:02:20 -06:00 |
|
|
root
|
2bf10d4a33
|
Added detection testing service results inDetect Regasm with no Command Line Arguments
|
2021-09-20 16:58:10 +00:00 |
|
|
mhaag-spl
|
81183b661c
|
Update detect_regasm_with_no_command_line_arguments.yml
|
2021-09-20 10:37:57 -06:00 |
|
|
mhaag-spl
|
958e195593
|
Update searchprotocolhost_with_no_command_line_with_network.yml
|
2021-09-20 10:05:07 -06:00 |
|
|
d1vious
|
8831bec3a3
|
detection page
|
2021-09-20 10:30:24 -04:00 |
|
|
d1vious
|
6515c861f5
|
Merge branch 'fancy_docs' of github.com:splunk/security_content into fancy_docs
|
2021-09-20 10:08:12 -04:00 |
|
|
d1vious
|
05d99143ef
|
adding detection page generation
|
2021-09-20 10:08:05 -04:00 |
|
|
Detection Testing Service
|
74795ed35c
|
Merge branch 'fin7' of https://github.com/splunk/security_content into fin7
|
2021-09-20 13:42:55 +00:00 |
|
|
root
|
f4d532b6a2
|
Added detection testing service results inMS Scripting Process Loading Ldap Module
|
2021-09-20 13:42:55 +00:00 |
|
|
root
|
5d8af6f242
|
Added detection testing service results inMS Scripting Process Loading WMI Module
|
2021-09-20 13:41:30 +00:00 |
|
|
tccontre
|
5a70382466
|
fin7
|
2021-09-20 15:21:53 +02:00 |
|
|
tccontre
|
f22bd1b018
|
Merge branch 'fin7' of github.com:splunk/security_content into fin7
|
2021-09-20 12:22:34 +02:00 |
|
|
tccontre
|
4ed026fa35
|
fin7
|
2021-09-20 12:22:12 +02:00 |
|
|
Bhavin Patel
|
6b21a64401
|
Branch was auto-updated.
|
2021-09-20 02:43:15 -07:00 |
|
|
Bhavin Patel
|
ad20c36ef7
|
Branch was auto-updated.
|
2021-09-20 02:43:12 -07:00 |
|
|
Bhavin Patel
|
45540c2590
|
Branch was auto-updated.
|
2021-09-20 02:43:07 -07:00 |
|
|
Bhavin Patel
|
4fdabd1594
|
Branch was auto-updated.
|
2021-09-20 02:43:05 -07:00 |
|
|
Bhavin Patel
|
965fd8885c
|
Branch was auto-updated.
|
2021-09-20 02:43:00 -07:00 |
|
|
Bhavin Patel
|
9a44abe15a
|
Branch was auto-updated.
|
2021-09-20 02:42:59 -07:00 |
|
|
Bhavin Patel
|
ef7b45ad57
|
Branch was auto-updated.
|
2021-09-20 02:42:56 -07:00 |
|
|
Bhavin Patel
|
fe9b9ae95a
|
Branch was auto-updated.
|
2021-09-20 02:42:55 -07:00 |
|
|
Bhavin Patel
|
4bc768a8c0
|
Branch was auto-updated.
|
2021-09-20 02:42:53 -07:00 |
|
|
P4T12ICK
|
760328df2c
|
Merge pull request #1644 from splunk/dev_sec_ops_work
Dev Sec Ops Work
|
2021-09-20 11:42:33 +02:00 |
|
|
tccontre
|
bbcaf7a93b
|
fin7
|
2021-09-20 11:37:07 +02:00 |
|
|
tccontre
|
6e0789be3e
|
fin7
|
2021-09-20 11:35:38 +02:00 |
|
|
P4T12ICK
|
549b58e34c
|
merged with develop
|
2021-09-20 11:16:05 +02:00 |
|
|
P4T12ICK
|
5b41aaaa58
|
merged with develop
|
2021-09-20 11:15:23 +02:00 |
|
|
tccontre
|
0b7a836e43
|
fin7
|
2021-09-20 10:33:09 +02:00 |
|
|
pyth0n1c
|
ba78e372e2
|
Changed a port back to the original since it's run inside the docker container as part of a playbook
|
2021-09-17 18:12:02 -07:00 |
|
|
divious1
|
370ea6df6c
|
cleaned up detection display, added testing notes
|
2021-09-17 21:07:16 -04:00 |
|
|
pyth0n1c
|
2a3e220249
|
Made the splunk management port dynamic for uploading replay data.
|
2021-09-17 17:51:27 -07:00 |
|
|
pyth0n1c
|
5588eeabe1
|
Fixed ugly multi line comment
|
2021-09-17 17:35:50 -07:00 |
|
|
pyth0n1c
|
94f05e573c
|
Added some error handling so that the show can go on while we debug. Fixed another bad variable naming error
|
2021-09-17 17:33:20 -07:00 |
|
|
pyth0n1c
|
ebb00af725
|
Forgot to declare results_queue before using it.
|
2021-09-17 16:58:14 -07:00 |
|
|
pyth0n1c
|
4d1c456a33
|
Removed some aws calls which should no longer be made
|
2021-09-17 16:49:05 -07:00 |
|