admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
8,347 Commits 697 Branches 195 Tags
94de7c8d57553ed698e489857713153cc386170e
Commit Graph

662 Commits

Author SHA1 Message Date
mhaag-spl 404f4b3900 Removed mshta rename 2021-01-26 06:44:33 -07:00
Michael Haag 4cc4a8ac3c Merge branch 'develop' into msbuild 2021-01-26 06:10:09 -07:00
Ignacio Bermudez Corrales b9eb65a558 renamed ssa detections 2021-01-25 16:32:23 -08:00
mhaag-spl 294be790dc minor updates 2021-01-25 14:28:26 -07:00
mhaag-spl 2d3b98ff82 T1482 - NLTest usage 
NLTest execution to discover domain trusts.
 2021-01-25 09:09:02 -07:00
mhaag-spl e202e6299a Adding WBAdmin - delete system backups 
Deleting system backups with WBAdmin
 2021-01-22 13:52:56 -07:00
mhaag-spl f3d274c0f8 ID changes 
ID changes and a test file needed moved
 2021-01-20 14:45:27 -07:00
mhaag-spl c3197d003e mshta renamed 2021-01-20 13:50:57 -07:00
mhaag-spl 5b0ff63278 rename mshta inline hta execution 2021-01-20 12:44:21 -07:00
mhaag-spl 1d11230510 MSHTA 
Updated story
added mshta url in cmdline analytic
 2021-01-20 12:00:25 -07:00
mhaag-spl ed6e40433c rundll32 inline hta 
Rundll32 inline hta execution
 2021-01-20 10:48:25 -07:00
mhaag-spl d6a9bf502f Microsoft Workflow Compiler 
Adding analytics for microsoft.workflow.compiler.exe.
 2021-01-19 14:45:02 -07:00
mhaag-spl 44a9d0bc8c URL Fixes 
Fixing all the URLs
 2021-01-19 13:43:37 -07:00
mhaag-spl cdb6d034c4 Removing netconn 2021-01-19 12:23:00 -07:00
mhaag-spl 3fa5c378cc Timestamp 
Trying to fix :)
 2021-01-19 08:21:59 -07:00
P4T12ICK 442d944890 new test file 2021-01-19 14:44:01 +01:00
P4T12ICK 0d75faf323 new test file 2021-01-19 13:55:33 +01:00
P4T12ICK 44bf41a678 new test file 2021-01-18 15:22:05 +01:00
mhaag-spl 28827c7fdb MSHTA 
Modified inlne mshta execution with the `about` protocol handler.
Added new mshta.exe child process analytic
 2021-01-17 20:02:56 -07:00
mhaag-spl 08488e067e Revert "Revert "Revert "Revert "T1127.001 MSbuild"""" 
This reverts commit fd5e4adfb1.
 2021-01-17 19:38:36 -07:00
mhaag-spl fd5e4adfb1 Revert "Revert "Revert "T1127.001 MSbuild""" 
This reverts commit 9617d4d9b3.
 2021-01-17 19:37:58 -07:00
mhaag-spl 9617d4d9b3 Revert "Revert "T1127.001 MSbuild"" 
This reverts commit e27ad1399a.
 2021-01-15 15:06:53 -07:00
mhaag-spl e27ad1399a Revert "T1127.001 MSbuild" 
This reverts commit 0eba4877ff.
 2021-01-15 15:06:15 -07:00
mhaag-spl 0eba4877ff T1127.001 MSbuild 
MSbuild detections and test.
 2021-01-15 14:25:25 -07:00
github-actions[bot] 18ba87492f Branch was auto-updated. 2021-01-14 20:29:17 +00:00
P4T12ICK 2e1234c594 improved detections and tests 2021-01-14 15:57:42 +01:00
P4T12ICK c871d6804a improved detections and tests 2021-01-14 15:01:16 +01:00
bpatel 20242b93e6 data path update 2021-01-13 18:27:06 -08:00
bpatel b7c0137282 test timing 2021-01-13 17:57:49 -08:00
Bhavin Patel f74ebbea1c Merge branch 'develop' into TR-318_mfa 2021-01-13 17:19:00 -08:00
bpatel ab6d8cdfe1 new detection file and test data 2021-01-13 16:30:19 -08:00
P4T12ICK 4a626c5246 merged with develop 2021-01-13 14:21:09 +01:00
P4T12ICK 994989b086 improved detections and tests 2021-01-12 15:38:32 +01:00
P4T12ICK 1073cff2f7 improved detections and tests 2021-01-12 11:13:17 +01:00
mhaag-spl def94c4623 Update bcdedit_failure_recovery_modification.test.yml 2021-01-11 13:57:05 -07:00
mhaag-spl d99e66f367 T1490 BCDedit 
T1490 BCDedit
 2021-01-11 12:25:19 -07:00
P4T12ICK b7175cbc08 updated detection and test file 2021-01-11 14:28:14 +01:00
P4T12ICK 4383db4e83 update detection 2021-01-11 13:31:02 +01:00
P4T12ICK 8df36c2e0c Merge branch 'develop' into TR-320-suspicious-rights-delegation 2021-01-07 15:28:30 +01:00
Bhavin Patel 14d6e6d01a Merge branch 'develop' into sunburst_detections 2020-12-17 16:14:28 -08:00
divious1 fc4c30587b renamed test file 2020-12-17 18:05:54 -05:00
divious1 b8326d8b38 Merge branch 'sunburst_detections' of github.com:splunk/security-content into sunburst_detections 2020-12-17 13:53:29 -05:00
divious1 ca1ae13328 renaming dragonfly 2020-12-17 13:53:20 -05:00
Jose Enrique Hernandez 56d4471b78 Merge branch 'develop' into sunburst_detections 2020-12-17 13:01:38 -05:00
divious1 58eade42b6 adding new detection and test for sunburst 2020-12-17 12:20:26 -05:00
P4T12ICK eee9e6bb2f bug fix 2020-12-17 12:00:53 +01:00
P4T12ICK 2c62bc7ede bug fix 2020-12-17 11:40:00 +01:00
P4T12ICK 504a11d8be bug fix 2020-12-17 11:22:22 +01:00
P4T12ICK 48ada30a34 o365 disable mfa 2020-12-17 11:02:20 +01:00
bpatel fdb698cdb3 new detection for login failure 2020-12-16 16:26:25 -08:00