admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
8,347 Commits 697 Branches 195 Tags
94de7c8d57553ed698e489857713153cc386170e
Commit Graph

8347 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Stanislav Miskovic c457ba1ce2 We need to do 2 fixes here: 
1) comma sign is also possible between "comsvcs.dll" "MiniDump" in execution of this attack as described in https://risksense.com/blog/hidden-gems-in-windows-the-hunt-is-on/ and https://www.ired.team/offensive-security/credential-access-and-credential-dumping/dump-credentials-from-lsass-process-without-mimikatz and our notebook https://confluence.splunk.com/display/~smiskovic/Test+Events+for+SSA+Detections#TestEventsforSSADetections-DumpingLSASSprocessmemory, and

2) referenced pdf does not contain this detection (will fix this later when I make my notebook public, so we do not need to refer any external companies)
 2020-10-18 22:23:18 -07:00
Xiao Lin 172b5e7d67 update to TF2.3 2020-10-17 00:21:28 -07:00
Ignacio 14b88aa2af Merge branch 'develop' into lolbas-fixes 2020-10-16 15:46:58 -07:00
Ignacio fcc005121c Merge pull request #789 from splunk/add_time 
Adding _time to phishing detection tests
 2020-10-16 15:46:28 -07:00
Xiao Lin 7a9be3fa01 add 2020-10-16 15:34:26 -07:00
Ignacio 864c8f42bc Merge pull request #788 from splunk/adding-ssa-tests 
Organized tests for detections
 2020-10-16 15:10:03 -07:00
Ignacio Bermudez Corrales 43392488ee Merge remote-tracking branch 'origin/develop' into lolbas-fixes 2020-10-16 14:59:31 -07:00
Ignacio Bermudez Corrales 98be589890 Merge remote-tracking branch 'origin/develop' into adding-ssa-tests 2020-10-16 14:16:42 -07:00
Ignacio Bermudez Corrales ebb0554cea test files for ssa detections 2020-10-16 14:08:23 -07:00
Ignacio Bermudez Corrales 3f8b95f6cd adding tests per detection 2020-10-16 12:45:14 -07:00
dependabot-preview[bot] 1c2746eb80 Merge pull request #786 from splunk/dependabot/pip/botocore-1.18.18 2020-10-16 19:45:05 +00:00
dependabot-preview[bot] b990631363 Bump botocore from 1.18.17 to 1.18.18 
Bumps [botocore](https://github.com/boto/botocore) from 1.18.17 to 1.18.18.
- [Release notes](https://github.com/boto/botocore/releases)
- [Changelog](https://github.com/boto/botocore/blob/develop/CHANGELOG.rst)
- [Commits](https://github.com/boto/botocore/compare/1.18.17...1.18.18)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-10-16 19:39:08 +00:00
dependabot-preview[bot] d901104709 Merge pull request #787 from splunk/dependabot/pip/boto3-1.15.18 2020-10-16 19:37:55 +00:00
dependabot-preview[bot] cf2294a9d0 Bump boto3 from 1.15.17 to 1.15.18 
Bumps [boto3](https://github.com/boto/boto3) from 1.15.17 to 1.15.18.
- [Release notes](https://github.com/boto/boto3/releases)
- [Changelog](https://github.com/boto/boto3/blob/develop/CHANGELOG.rst)
- [Commits](https://github.com/boto/boto3/compare/1.15.17...1.15.18)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-10-16 19:31:54 +00:00
peter 4bf812c9f6 Merge pull request #751 from splunk/TR-193 
fixed syntax in unusual command line ssa detection
 2020-10-16 11:43:13 -07:00
peter-cg 02f8891e3b Merge remote-tracking branch 'origin/develop' into TR-193 2020-10-16 11:33:17 -07:00
Ignacio d857af2a0a Merge branch 'develop' into lolbas-fixes 2020-10-16 10:01:17 -07:00
dependabot-preview[bot] ca6d1c381a Merge pull request #777 from splunk/dependabot/pip/mock-4.0.2 2020-10-16 15:04:44 +00:00
dependabot-preview[bot] 17efc12d0f Bump mock from 3.0.5 to 4.0.2 
Bumps [mock](https://github.com/testing-cabal/mock) from 3.0.5 to 4.0.2.
- [Release notes](https://github.com/testing-cabal/mock/releases)
- [Changelog](https://github.com/testing-cabal/mock/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/testing-cabal/mock/compare/3.0.5...4.0.2)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-10-16 15:00:21 +00:00
dependabot-preview[bot] 3f1f21577a Merge pull request #785 from splunk/dependabot/pip/mysql-connector-python-8.0.21 2020-10-16 14:58:59 +00:00
dependabot-preview[bot] 09cb8120bb Bump mysql-connector-python from 8.0.19 to 8.0.21 
Bumps [mysql-connector-python](http://dev.mysql.com/doc/connector-python/en/index.html) from 8.0.19 to 8.0.21.

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-10-16 14:55:07 +00:00
dependabot-preview[bot] 7913e7cb34 Merge pull request #784 from splunk/dependabot/pip/ntlm-auth-1.5.0 2020-10-16 14:54:03 +00:00
dependabot-preview[bot] d9ab4d6464 Bump ntlm-auth from 1.4.0 to 1.5.0 
Bumps [ntlm-auth](https://github.com/jborean93/ntlm-auth) from 1.4.0 to 1.5.0.
- [Release notes](https://github.com/jborean93/ntlm-auth/releases)
- [Changelog](https://github.com/jborean93/ntlm-auth/blob/master/CHANGES.md)
- [Commits](https://github.com/jborean93/ntlm-auth/compare/v1.4.0...v1.5.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-10-16 14:50:17 +00:00
dependabot-preview[bot] ed47764d4b Merge pull request #780 from splunk/dependabot/pip/path-15.0.0 2020-10-16 14:48:58 +00:00
dependabot-preview[bot] bac818aa86 Bump path from 13.1.0 to 15.0.0 
Bumps [path](https://github.com/jaraco/path) from 13.1.0 to 15.0.0.
- [Release notes](https://github.com/jaraco/path/releases)
- [Changelog](https://github.com/jaraco/path/blob/master/CHANGES.rst)
- [Commits](https://github.com/jaraco/path/compare/v13.1.0...v15.0.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-10-16 14:44:45 +00:00
dependabot-preview[bot] 649ec4222a Merge pull request #779 from splunk/dependabot/pip/bcrypt-3.2.0 2020-10-16 14:43:25 +00:00
dependabot-preview[bot] 3a1981a24c Bump bcrypt from 3.1.7 to 3.2.0 
Bumps [bcrypt](https://github.com/pyca/bcrypt) from 3.1.7 to 3.2.0.
- [Release notes](https://github.com/pyca/bcrypt/releases)
- [Changelog](https://github.com/pyca/bcrypt/blob/master/release.py)
- [Commits](https://github.com/pyca/bcrypt/compare/3.1.7...3.2.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-10-16 14:39:36 +00:00
dependabot-preview[bot] 9b5253a6e7 Merge pull request #778 from splunk/dependabot/pip/py-1.9.0 2020-10-16 14:38:30 +00:00
dependabot-preview[bot] 7a2476823c Bump py from 1.8.1 to 1.9.0 
Bumps [py](https://github.com/pytest-dev/py) from 1.8.1 to 1.9.0.
- [Release notes](https://github.com/pytest-dev/py/releases)
- [Changelog](https://github.com/pytest-dev/py/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/pytest-dev/py/compare/1.8.1...1.9.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-10-16 14:35:01 +00:00
dependabot-preview[bot] 183e5e61e3 Merge pull request #782 from splunk/dependabot/pip/pygithub-1.53 2020-10-16 14:33:42 +00:00
dependabot-preview[bot] 240b50f7c6 Bump pygithub from 1.51 to 1.53 
Bumps [pygithub](https://github.com/PyGithub/PyGithub) from 1.51 to 1.53.
- [Release notes](https://github.com/PyGithub/PyGithub/releases)
- [Commits](https://github.com/PyGithub/PyGithub/compare/v1.51...v1.53)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-10-16 14:30:07 +00:00
dependabot-preview[bot] 98fda42d42 Merge pull request #781 from splunk/dependabot/pip/pytest-6.1.1 2020-10-16 14:28:45 +00:00
dependabot-preview[bot] 753974645e Bump pytest from 5.3.2 to 6.1.1 
Bumps [pytest](https://github.com/pytest-dev/pytest) from 5.3.2 to 6.1.1.
- [Release notes](https://github.com/pytest-dev/pytest/releases)
- [Changelog](https://github.com/pytest-dev/pytest/blob/master/CHANGELOG.rst)
- [Commits](https://github.com/pytest-dev/pytest/compare/5.3.2...6.1.1)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-10-16 14:25:02 +00:00
dependabot-preview[bot] 8995ffb39a Merge pull request #783 from splunk/dependabot/pip/protobuf-3.13.0 2020-10-16 14:23:47 +00:00
dependabot-preview[bot] bfc0db070e Bump protobuf from 3.6.1 to 3.13.0 
Bumps [protobuf](https://github.com/protocolbuffers/protobuf) from 3.6.1 to 3.13.0.
- [Release notes](https://github.com/protocolbuffers/protobuf/releases)
- [Changelog](https://github.com/protocolbuffers/protobuf/blob/master/generate_changelog.py)
- [Commits](https://github.com/protocolbuffers/protobuf/compare/v3.6.1...v3.13.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-10-16 14:19:57 +00:00
dependabot-preview[bot] 097f1c6501 Merge pull request #776 from splunk/dependabot/pip/pycparser-2.20 2020-10-16 14:18:33 +00:00
dependabot-preview[bot] 8d0129e1fe Bump pycparser from 2.19 to 2.20 
Bumps [pycparser](https://github.com/eliben/pycparser) from 2.19 to 2.20.
- [Release notes](https://github.com/eliben/pycparser/releases)
- [Changelog](https://github.com/eliben/pycparser/blob/master/CHANGES)
- [Commits](https://github.com/eliben/pycparser/compare/release_v2.19...release_v2.20)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-10-16 14:13:37 +00:00
root 85146bd2b8 Added detection testing service results inKerberoasting spn request with RC4 encryption 2020-10-16 09:57:44 +00:00
P4T12ICK d788863bca fixed kerberoasting detection 2020-10-16 11:29:46 +02:00
root 6555e32674 Added detection testing service results inDetect Activity Related to Pass the Hash Attacks 2020-10-16 08:43:40 +00:00
P4T12ICK 7fe760cf54 rebased with develop 2020-10-16 09:52:08 +02:00
P4T12ICK 1e392e631c improvment pth detection 2020-10-16 09:49:11 +02:00
Mikael Bjerkeland 93c0682f43 Merge branch 'master' of https://github.com/inspired/security-content into mbjerkeland-develop 2020-10-16 08:40:49 +02:00
dependabot-preview[bot] 2c75381945 Merge pull request #772 from splunk/dependabot/pip/zipp-3.3.1 2020-10-16 02:25:25 +00:00
dependabot-preview[bot] b6a76897b3 Bump zipp from 3.3.0 to 3.3.1 
Bumps [zipp](https://github.com/jaraco/zipp) from 3.3.0 to 3.3.1.
- [Release notes](https://github.com/jaraco/zipp/releases)
- [Changelog](https://github.com/jaraco/zipp/blob/master/CHANGES.rst)
- [Commits](https://github.com/jaraco/zipp/compare/v3.3.0...v3.3.1)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-10-16 02:21:27 +00:00
Ignacio Bermudez Corrales 7981684b5f Merge branch 'lolbas-fixes' of github.com:splunk/security-content into lolbas-fixes 2020-10-15 14:54:18 -07:00
Ignacio Bermudez Corrales e04592401b unusual lolbas short time period 2020-10-15 14:53:59 -07:00
Bhavin Patel e498927d41 Merge pull request #752 from splunk/suspcious_cloud_user_activites_spl_bugs 
Suspcious cloud user activites spl bugs
mustang_beta1 		2020-10-15 14:27:14 -07:00
jzsplunk 7fb76cac60 Merge pull request #769 from splunk/unit_test_prohibited_apps_spawning_cmdprompt 
Unit test prohibited apps spawning cmdprompt
 2020-10-15 14:19:11 -07:00
Jose Enrique Hernandez 8520f3a281 Merge branch 'develop' into lolbas-fixes 2020-10-15 17:14:34 -04:00