admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
8,347 Commits 697 Branches 195 Tags
94de7c8d57553ed698e489857713153cc386170e
Commit Graph

8347 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Jason Brewer c3b04375c9 CRL-1719 - Fixing reference to https://attack.mitre.org/wiki/Privilege_Escalation >>> https://attack.mitre.org/tactics/TA0004/ 2020-01-22 12:17:24 -08:00
Bhavin Patel 38b84113bf Merge pull request #318 from splunk/CRL-1495-update_share_creation_and_deletion 
CRL-1495 update share creation and deletion
 2020-01-22 09:19:43 -08:00
Bhavin Patel 0cef2e73b1 Merge pull request #315 from splunk/CRL-1716-FixPowerShellObfusc 
CRL-1716 - Fixing by clause to allow searching Processes.process for …
 2020-01-22 09:18:42 -08:00
bpatel 5d6ef5ce60 renaming files 2020-01-22 09:14:51 -08:00
Jason Brewer b85543e0b5 CRL-1717 - Addressing comments by removing unnecessary output_filter macros from investigation searches and removing references to those in the investigation definitions. 2020-01-22 08:40:30 -08:00
Jason Brewer b62ce205b8 CRL-1716 - Updating per code review requests. Adding output macro file and reference within the detection search. 2020-01-22 08:26:16 -08:00
dependabot-preview[bot] f196179eee Merge pull request #317 from splunk/dependabot/pip/zipp-2.0.0 2020-01-22 02:17:12 +00:00
Jose Enrique Hernandez bfa7317668 removing comments 2020-01-21 18:14:24 -08:00
bpatel 3bf8cf26de updating the manifest to reflect correct details 2020-01-21 18:05:33 -08:00
bpatel 14f54a12e8 removing incorrect macro file 2020-01-21 17:29:55 -08:00
dependabot-preview[bot] bccc500554 Bump more-itertools from 8.0.2 to 8.1.0 
Bumps [more-itertools](https://github.com/erikrose/more-itertools) from 8.0.2 to 8.1.0.
- [Release notes](https://github.com/erikrose/more-itertools/releases)
- [Commits](https://github.com/erikrose/more-itertools/compare/v8.0.2...v8.1.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-01-21 19:44:25 +00:00
dependabot-preview[bot] 593798dfb3 Merge pull request #304 from splunk/dependabot/pip/nodeenv-1.3.4 2020-01-21 19:43:03 +00:00
Jose Enrique Hernandez c6a904b36f Merge pull request #314 from splunk/CRL-1712_netsh_abuse 
CRL-1712 Disabling Security Tools
 2020-01-21 11:42:42 -08:00
Jose Enrique Hernandez 7b976f25f7 Update investigate_user_activities_in_all_cloud_region_output_filter.yml 2020-01-21 11:34:38 -08:00
Jose Enrique Hernandez 11a1b68979 bumping version 2020-01-21 11:28:26 -08:00
jzsplunk c007d41844 remove comments to get search working, clean up detection 2020-01-21 02:23:15 -08:00
jzsplunk 82d00df489 Drop comments to get search working, change file name to reflect generic case of detecting any type of share deletion or creation. 2020-01-21 02:07:30 -08:00
jzsplunk 6eed922214 testing commented search 2020-01-21 01:58:30 -08:00
jzsplunk 0a006f7b04 Add IDEA IDE ignores 2020-01-21 00:51:29 -08:00
dependabot-preview[bot] 2f81672bbb Bump zipp from 1.0.0 to 2.0.0 
Bumps [zipp](https://github.com/jaraco/zipp) from 1.0.0 to 2.0.0.
- [Release notes](https://github.com/jaraco/zipp/releases)
- [Changelog](https://github.com/jaraco/zipp/blob/master/CHANGES.rst)
- [Commits](https://github.com/jaraco/zipp/compare/v1.0.0...v2.0.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-01-20 14:12:06 +00:00
divious1 0ac15cb563 updated fields and added macros and lookup entries 2020-01-19 21:37:45 -05:00
dependabot-preview[bot] 8eddded385 Bump nodeenv from 1.3.3 to 1.3.4 
Bumps [nodeenv](https://github.com/ekalinin/nodeenv) from 1.3.3 to 1.3.4.
- [Release notes](https://github.com/ekalinin/nodeenv/releases)
- [Changelog](https://github.com/ekalinin/nodeenv/blob/master/CHANGES)
- [Commits](https://github.com/ekalinin/nodeenv/compare/1.3.3...1.3.4)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-01-18 02:47:21 +00:00
dependabot-preview[bot] 94b939e576 Merge pull request #303 from splunk/dependabot/pip/pyyaml-5.3 2020-01-18 02:46:05 +00:00
Jose Enrique Hernandez cb34f780a5 Update requirements.txt 2020-01-17 21:41:52 -05:00
dependabot-preview[bot] 9232992989 Merge pull request #308 from splunk/dependabot/pip/importlib-metadata-1.4.0 2020-01-18 02:40:17 +00:00
dependabot-preview[bot] db943d560f Merge pull request #284 from splunk/dependabot/pip/virtualenv-16.7.9 2020-01-18 02:40:01 +00:00
Jose Enrique Hernandez e3d5f9bbf2 Merge branch 'develop' into dependabot/pip/pyyaml-5.3 2020-01-17 20:39:28 -06:00
dependabot-preview[bot] 3f48f5a96d Merge pull request #305 from splunk/dependabot/pip/pyrsistent-0.15.7 2020-01-18 02:38:38 +00:00
dependabot-preview[bot] a2bec0bdb4 Bump virtualenv from 16.7.8 to 16.7.9 
Bumps [virtualenv](https://github.com/pypa/virtualenv) from 16.7.8 to 16.7.9.
- [Release notes](https://github.com/pypa/virtualenv/releases)
- [Changelog](https://github.com/pypa/virtualenv/blob/master/docs/changes.rst)
- [Commits](https://github.com/pypa/virtualenv/compare/16.7.8...16.7.9)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-01-18 02:35:45 +00:00
dependabot-preview[bot] cfe4c7f09c Merge pull request #311 from splunk/dependabot/pip/zipp-1.0.0 2020-01-18 02:34:31 +00:00
dependabot-preview[bot] 2ed19c7cf2 Bump importlib-metadata from 1.3.0 to 1.4.0 
Bumps [importlib-metadata](http://importlib-metadata.readthedocs.io/) from 1.3.0 to 1.4.0.

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-01-18 02:32:40 +00:00
dependabot-preview[bot] 6b7f260a4b Merge pull request #312 from splunk/dependabot/pip/identify-1.4.10 2020-01-18 02:31:26 +00:00
Jason Brewer 56e7182720 CRL-1717 - Added "search *" definitions to the macros without definitions. 2020-01-17 17:09:01 -08:00
Jason Brewer 5383117f1c CRL-1716 - Fixing by clause to allow searching Processes.process for obfuscation chars. 2020-01-17 16:48:27 -08:00
dependabot-preview[bot] 79833ac948 Bump pyrsistent from 0.15.6 to 0.15.7 
Bumps [pyrsistent](https://github.com/tobgu/pyrsistent) from 0.15.6 to 0.15.7.
- [Release notes](https://github.com/tobgu/pyrsistent/releases)
- [Changelog](https://github.com/tobgu/pyrsistent/blob/master/CHANGES.txt)
- [Commits](https://github.com/tobgu/pyrsistent/compare/v0.15.6...v0.15.7)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-01-16 21:39:50 +00:00
dependabot-preview[bot] d4a1ca38b4 Bump pyyaml from 5.2 to 5.3 
Bumps [pyyaml](https://github.com/yaml/pyyaml) from 5.2 to 5.3.
- [Release notes](https://github.com/yaml/pyyaml/releases)
- [Changelog](https://github.com/yaml/pyyaml/blob/master/CHANGES)
- [Commits](https://github.com/yaml/pyyaml/compare/5.2...5.3)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-01-16 21:39:49 +00:00
dependabot-preview[bot] c854500ede Merge pull request #313 from splunk/dependabot/pip/six-1.14.0 2020-01-16 21:38:32 +00:00
Jose Enrique Hernandez 6a4d42f582 Merge pull request #310 from splunk/CRL-1715 
CRL-1715 updated search syntax, tested in attack_range
 2020-01-16 15:36:19 -06:00
Bhavin Patel bc33e55a85 Merge pull request #307 from splunk/CRL-1714_new_version_lateral_movement 
CRL-1714 new version lateral movement
 2020-01-16 12:13:41 -08:00
dependabot-preview[bot] 4a9b1fceea Bump six from 1.13.0 to 1.14.0 
Bumps [six](https://github.com/benjaminp/six) from 1.13.0 to 1.14.0.
- [Release notes](https://github.com/benjaminp/six/releases)
- [Changelog](https://github.com/benjaminp/six/blob/master/CHANGES)
- [Commits](https://github.com/benjaminp/six/compare/1.13.0...1.14.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-01-16 14:12:58 +00:00
dependabot-preview[bot] 5c510dd987 Bump identify from 1.4.9 to 1.4.10 
Bumps [identify](https://github.com/chriskuehl/identify) from 1.4.9 to 1.4.10.
- [Release notes](https://github.com/chriskuehl/identify/releases)
- [Commits](https://github.com/chriskuehl/identify/compare/v1.4.9...v1.4.10)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-01-15 14:12:48 +00:00
bpatel 629badf7e7 macros file, still not liking this practice 2020-01-14 15:58:38 -08:00
bpatel 69a35f1c16 macros 2020-01-14 15:40:45 -08:00
bpatel 52f5a71060 new search unload sysmon filter 2020-01-14 15:27:57 -08:00
dependabot-preview[bot] ee8c952e98 Bump zipp from 0.6.0 to 1.0.0 
Bumps [zipp](https://github.com/jaraco/zipp) from 0.6.0 to 1.0.0.
- [Release notes](https://github.com/jaraco/zipp/releases)
- [Changelog](https://github.com/jaraco/zipp/blob/master/CHANGES.rst)
- [Commits](https://github.com/jaraco/zipp/compare/v0.6.0...v1.0.0)

Signed-off-by: dependabot-preview[bot] <support@dependabot.com>
 2020-01-14 14:12:45 +00:00
divious1 a899938a07 Revert "Remove data-toggle="tab"" 
This reverts commit 6f16d98f31.
 2020-01-13 18:23:49 -05:00
bpatel 54c9bc9c38 updated search/metadata, tested in attack_range 2020-01-13 12:42:35 -08:00
Patrick Bareiss 4a0bf015e8 tested and updates searches for lateral movement story 2020-01-13 11:18:54 +01:00
Patrick Bareiss 71241e566f tested and updates searches for lateral movement story 2020-01-13 10:39:57 +01:00
Bhavin Patel 904bf9445b Merge pull request #302 from splunk/fix_ci_job 
fixing bug where CI crashed when publishing the package
 2020-01-10 12:37:34 -08:00