admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
3,176 Commits 697 Branches 195 Tags
c274602e04ac99f8ebd653d2b7243764e2bbc19d
Commit Graph

85 Commits

Author SHA1 Message Date
P4T12ICK ca7c9c878e detection test 2020-11-09 16:41:09 +01:00
P4T12ICK 87a7d64d66 new tests 2020-11-09 13:25:27 +01:00
P4T12ICK 079742338b deleting shadow copy test 2020-11-09 10:38:40 +01:00
P4T12ICK f7fad21b02 ransomware notes test 2020-11-09 09:36:01 +01:00
P4T12ICK 66e2341012 ransomware extension 2020-11-09 09:26:04 +01:00
P4T12ICK 85f349668c new detection testing file 2020-11-06 13:43:49 +01:00
P4T12ICK ee59a8150b new test file 2020-11-06 13:26:45 +01:00
Jose Enrique Hernandez db0e7bd862 Merge branch 'develop' into misko_apply_set_stolen_credentials 2020-11-04 14:40:49 -05:00
Jose Enrique Hernandez c7b8e7166f Merge pull request #816 from splunk/misko_cred_extract_APIs_and_Filenames 
Credential Extraction detected via common exploit modules ...
 2020-11-04 14:03:02 -05:00
jzsplunk 7434975199 Merge branch 'develop' into misko_apply_set_stolen_credentials 2020-11-04 10:03:17 -08:00
Jose Enrique Hernandez c25465c174 Merge branch 'develop' into misko_cred_extract_APIs_and_Filenames 2020-11-04 12:26:48 -05:00
P4T12ICK ac27485034 Merge branch 'develop' into new_test_file_format 2020-11-04 17:58:26 +01:00
Stanislav Miskovic 16821b72b8 Applying and setting stolen cresentials - detections via PowerSploit, Mimikatz and DSInternals APIs 2020-11-04 01:02:47 -08:00
P4T12ICK 15a3dfed60 detection tests 2020-11-03 17:04:53 +01:00
P4T12ICK c952f06956 new format for test files 2020-10-30 09:11:41 +01:00
Stanislav Miskovic 470c94fc90 Credential Extraction: Changing passing condition to a new syntax 2020-10-29 00:42:19 -07:00
Stanislav Miskovic b5707c8e22 Credential Extraction: moving test data from SMLE's to AR's S3 bucket and renaming test links 2020-10-28 11:38:08 -07:00
miskoSplunk 2839525e0c Update and rename credential_extraction_ms_debuggers_z_option.test.yml to ssa___credential_extraction_ms_debuggers_z_option.test.yml 2020-10-28 01:30:16 -07:00
miskoSplunk 67be9820f8 Update and rename credential_extraction_ms_debuggers_kernel_peek.test.yml to ssa___credential_extraction_ms_debuggers_kernel_peek.test.yml 2020-10-28 01:29:01 -07:00
miskoSplunk f47a5e18af Update and rename credential_extraction_lazagne_command_options_ssa.test.yml to ssa___credential_extraction_lazagne_command_options.test.yml 2020-10-28 01:28:21 -07:00
miskoSplunk 2cdefdd198 Update and rename credential_extraction_fgdump_cachedump_v_option_ssa.test.yml to ssa___credential_extraction_fgdump_cachedump_v_option.test.yml 2020-10-28 01:27:38 -07:00
miskoSplunk 5f01133544 Update and rename credential_extraction_fgdump_cachedump_s_option_ssa.test.yml to ssa___credential_extraction_fgdump_cachedump_s_option.test.yml 2020-10-28 01:26:40 -07:00
miskoSplunk 3185517716 Update and rename credential_extraction_powersploit_modules_ssa.test.yml to ssa___credential_extraction_powersploit_modules.test.yml 2020-10-27 15:17:41 -07:00
miskoSplunk 575fd73422 Update and rename credential_extraction_mimikatz_modules_ssa.test.yml to ssa___credential_extraction_mimikatz_modules.test.yml 2020-10-27 15:16:05 -07:00
miskoSplunk 8ec9c06f2e Update and rename credential_extraction_getaddbaccount_from_dump_ssa.test.yml to ssa___credential_extraction_getaddbaccount_from_dump.test.yml 2020-10-27 11:36:01 -07:00
miskoSplunk abf692795d Update and rename credential_extraction_dsinternals_modules_ssa.test.yml to ssa___credential_extraction_dsinternals_modules.test.yml 2020-10-27 11:34:40 -07:00
miskoSplunk 2cd4512d65 Update and rename credential_extraction_dsinternals_conversion_modules_ssa.test.yml to ssa___credential_extraction_dsinternals_conversion_modules.test.yml 2020-10-27 11:32:33 -07:00
Stanislav Miskovic 922559d436 Credential Extraction: Adding tests, second try to push 2020-10-27 11:04:31 -07:00
Ignacio Bermudez Corrales a19a43c2f9 fixed test and detection 2020-10-26 14:47:50 -07:00
Ignacio Bermudez Corrales aec8ad9712 Removed tests that had issues they should be in branch add_gitlab_ci-all-tests 
- phishing use case (mutliple syntax errors in detection)
- prohibited locations (lack of testing dataset)
 2020-10-23 13:40:33 -07:00
Ignacio Bermudez Corrales ab646c1c36 fixed pass condition 2020-10-22 16:30:17 -07:00
Ignacio Bermudez Corrales 9d139764bf fixed tests 2020-10-22 14:30:14 -07:00
Ignacio Bermudez Corrales 51c8df5f21 multiple tests supported + output validation 2020-10-22 12:47:15 -07:00
Bhavin Patel 8fef4fe2fe Merge pull request #775 from splunk/improved_kerberoasting_attack 
Automated Detection Testing PR improved_kerberoasting_attack
 2020-10-20 11:01:40 -07:00
Bhavin Patel 7a45ca7143 Merge pull request #774 from splunk/pass_the_hash_detection 
Automated Detection Testing PR pass_the_hash_detection
 2020-10-20 10:55:43 -07:00
Jose Enrique Hernandez ca119d7cb5 Merge branch 'develop' into improved_kerberoasting_attack 2020-10-19 17:29:03 -04:00
Ignacio Bermudez Corrales ebb0554cea test files for ssa detections 2020-10-16 14:08:23 -07:00
Ignacio Bermudez Corrales 3f8b95f6cd adding tests per detection 2020-10-16 12:45:14 -07:00
P4T12ICK d788863bca fixed kerberoasting detection 2020-10-16 11:29:46 +02:00
P4T12ICK 7fe760cf54 rebased with develop 2020-10-16 09:52:08 +02:00
divious1 3a384454ac updated to point to the right file 2020-10-15 15:55:36 -04:00
divious1 015514ee1e notebook for prohibited apps spawning 2020-10-15 15:43:22 -04:00
P4T12ICK 2f9fe75f9c Improved and tested pass the hash detection 2020-10-15 14:35:53 +02:00
P4T12ICK 6938154a94 ready for PR 2020-10-14 16:13:55 +02:00
P4T12ICK c9ead8f05b updates to new testing structure 2020-10-14 11:30:24 +02:00
P4T12ICK bf18c1514d updates 2020-10-13 13:50:28 +02:00
P4T12ICK c9875509d4 new test file 2020-10-09 12:54:09 +02:00
P4T12ICK e48567ac56 new test file 2020-10-09 12:28:07 +02:00
P4T12ICK 389e25b2e3 new test file 2020-10-09 12:12:06 +02:00
P4T12ICK e30c83593a new test file 2020-10-09 11:32:38 +02:00