admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
4,652 Commits 697 Branches 195 Tags
bfec79252f413bfff412acbac4e8f597927a72fd
Commit Graph

292 Commits

Author SHA1 Message Date
mhaag-spl b2aed2b816 rundll32 advpack and rename 2021-02-04 14:38:54 -07:00
github-actions[bot] ff3918ca17 Branch was auto-updated. 2021-02-04 16:36:16 +00:00
github-actions[bot] 4b40451171 Branch was auto-updated. 2021-02-04 01:21:01 +00:00
github-actions[bot] 147624dc32 Branch was auto-updated. 2021-02-04 01:21:00 +00:00
Bhavin Patel 3aa6adebd6 Merge branch 'develop' into sh_test 2021-02-03 14:24:50 -08:00
bpatel df2cd41959 remove security hub for user test file since there is not data yet 2021-02-03 14:10:14 -08:00
mhaag-spl dd6286bd04 Creation of lsass dump with taskmgr 2021-02-03 14:57:59 -07:00
mhaag-spl d138f4ea8c procdump rename 
renamed procdump query using sysmon
 2021-02-03 09:58:51 -07:00
github-actions[bot] b6b333d756 Branch was auto-updated. 2021-02-03 16:35:51 +00:00
github-actions[bot] 15c742eb46 Branch was auto-updated. 2021-02-03 16:35:46 +00:00
P4T12ICK 623c8fee33 moved to experimental 2021-02-03 17:03:19 +01:00
Ignacio Bermudez Corrales 497714f09b added more test corner cases 2021-02-02 22:13:05 -08:00
Ignacio Bermudez Corrales 61615abcc6 regex to handle path corner case 2021-02-02 17:50:38 -08:00
Ignacio Bermudez Corrales 63ec24ad56 Improved regex to handle paths 
- changed regex for paths
- updated unit test & data
 2021-02-02 15:02:36 -08:00
Ignacio Bermudez Corrales 16c0021d56 updated testing data file and made test assertion more tight 2021-02-01 13:45:07 -08:00
github-actions[bot] 798086d713 Branch was auto-updated. 2021-02-01 20:09:49 +00:00
divious1 0a9ba3f547 fixing file path 2021-02-01 14:56:27 -05:00
mhaag-spl 0a92fadf76 dump lsass via procdump 2021-02-01 12:37:36 -07:00
mhaag-spl 781572a7d6 Update suspicious_regsvr32_register_suspicious_path.test.yml 2021-01-29 13:34:40 -07:00
mhaag-spl 3551039f09 register suspicious path rename 2021-01-29 11:48:19 -07:00
mhaag-spl 3d5d188dd7 Regsvr32 Story and Analytics 
First batch of Regsvr32
 2021-01-29 10:58:53 -07:00
Michael Haag cd56808350 Merge branch 'develop' into 02rel1 2021-01-28 14:38:55 -07:00
mhaag-spl 177dc4eb96 ntdsutil export NTDS.dit 
Broke out ntdsutil.exe from creation_of_shadow_copy to allow for better filtering and specific monitoring/alerting.
 2021-01-28 14:36:52 -07:00
divious1 5f649291e0 rename detection and updated description 2021-01-28 11:56:01 -05:00
github-actions[bot] 6545418a70 Branch was auto-updated. 2021-01-27 19:53:08 +00:00
bpatel 1b799d788c user test file draft 2021-01-26 15:46:36 -08:00
bpatel f446cc2f8a test file 2021-01-26 13:54:49 -08:00
github-actions[bot] cd18663ced Branch was auto-updated. 2021-01-26 19:56:22 +00:00
mhaag-spl f0ccfd7914 wrong url 
URL was wrong :(
 2021-01-26 10:56:49 -07:00
mhaag-spl c42f729d2e Update suspicious_mshta_child_process.test.yml 2021-01-26 10:21:23 -07:00
mhaag-spl 404f4b3900 Removed mshta rename 2021-01-26 06:44:33 -07:00
Michael Haag 4cc4a8ac3c Merge branch 'develop' into msbuild 2021-01-26 06:10:09 -07:00
Ignacio Bermudez Corrales b9eb65a558 renamed ssa detections 2021-01-25 16:32:23 -08:00
mhaag-spl 294be790dc minor updates 2021-01-25 14:28:26 -07:00
mhaag-spl 2d3b98ff82 T1482 - NLTest usage 
NLTest execution to discover domain trusts.
 2021-01-25 09:09:02 -07:00
mhaag-spl e202e6299a Adding WBAdmin - delete system backups 
Deleting system backups with WBAdmin
 2021-01-22 13:52:56 -07:00
mhaag-spl f3d274c0f8 ID changes 
ID changes and a test file needed moved
 2021-01-20 14:45:27 -07:00
mhaag-spl c3197d003e mshta renamed 2021-01-20 13:50:57 -07:00
mhaag-spl 5b0ff63278 rename mshta inline hta execution 2021-01-20 12:44:21 -07:00
mhaag-spl 1d11230510 MSHTA 
Updated story
added mshta url in cmdline analytic
 2021-01-20 12:00:25 -07:00
mhaag-spl ed6e40433c rundll32 inline hta 
Rundll32 inline hta execution
 2021-01-20 10:48:25 -07:00
mhaag-spl d6a9bf502f Microsoft Workflow Compiler 
Adding analytics for microsoft.workflow.compiler.exe.
 2021-01-19 14:45:02 -07:00
mhaag-spl 44a9d0bc8c URL Fixes 
Fixing all the URLs
 2021-01-19 13:43:37 -07:00
mhaag-spl cdb6d034c4 Removing netconn 2021-01-19 12:23:00 -07:00
mhaag-spl 3fa5c378cc Timestamp 
Trying to fix :)
 2021-01-19 08:21:59 -07:00
P4T12ICK 442d944890 new test file 2021-01-19 14:44:01 +01:00
P4T12ICK 0d75faf323 new test file 2021-01-19 13:55:33 +01:00
P4T12ICK 44bf41a678 new test file 2021-01-18 15:22:05 +01:00
mhaag-spl 28827c7fdb MSHTA 
Modified inlne mshta execution with the `about` protocol handler.
Added new mshta.exe child process analytic
 2021-01-17 20:02:56 -07:00
mhaag-spl 08488e067e Revert "Revert "Revert "Revert "T1127.001 MSbuild"""" 
This reverts commit fd5e4adfb1.
 2021-01-17 19:38:36 -07:00