admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,503 Commits 697 Branches 195 Tags
e3d6b11ac399e94de1778d537c52c733db45d00d
Commit Graph

60 Commits

Author SHA1 Message Date
Rod Soto 187a00cd71 addedmacros 2020-02-27 17:09:50 -05:00
Bhavin Patel 6b2c9e4172 Merge pull request #327 from splunk/supicious_email_updates 
updating boiler plate, detection not working out of box against T1193…
 2020-02-07 10:35:35 -08:00
Bhavin Patel 556efc4a78 Merge pull request #325 from splunk/dns_query_updates 
Update version info and macros
 2020-02-07 10:33:05 -08:00
Bhavin Patel 98195728fc Merge pull request #324 from splunk/first_time_seen_cmd_updates 
update version info, add macros for first time seen cmd line detection
 2020-02-07 10:07:18 -08:00
Bhavin Patel 0432161688 Merge pull request #326 from splunk/smb_detection_updates 
update smb related content.
 2020-02-07 10:05:44 -08:00
Bhavin Patel 9849b76aff Merge branch 'develop' into first_time_seen_cmd_updates 2020-02-07 10:02:26 -08:00
bpatel 92768472e0 updating files as per Dons feedback 2020-02-04 09:15:39 -08:00
jzsplunk c92d097eac updating boiler plate, detection not working out of box against T1193 but this may be due to error loading lookup table for supicious file extensions. 2020-01-27 03:04:55 -08:00
jzsplunk d4aa6bc9ea update smb related content. The outbound_smb_connections detection works out of the box against attack ID T1110 when testing in the attack range. 2020-01-27 02:33:26 -08:00
jzsplunk b762034a4b update version info and macros, attack range freezing on testing detection against attack ID T1071 so query is untested against atomic red team test for now 2020-01-27 01:44:53 -08:00
jzsplunk 6406cfbc32 update version info, add macros for first time seen cmd line detection 2020-01-27 01:08:53 -08:00
bpatel 9e6becda1f adding definitions 2020-01-23 13:31:43 -08:00
Jose Enrique Hernandez 2fd12b9155 Merge pull request #320 from splunk/don_young_bug 
updating the manifest to reflect correct details
 2020-01-22 17:26:54 -08:00
Bhavin Patel 75485ef666 Merge pull request #316 from splunk/CRL-1717_addMacroDefinitionsWhereMissing 
CRL-1717 - Added "search *" definitions to the macros without them… resolves #292
 2020-01-22 14:59:44 -08:00
Bhavin Patel dd5b1ee344 Merge pull request #319 from splunk/dns_hijack_story_update 
CRL-1718 updated fields and added macros and lookup entries
 2020-01-22 14:58:40 -08:00
Bhavin Patel 38b84113bf Merge pull request #318 from splunk/CRL-1495-update_share_creation_and_deletion 
CRL-1495 update share creation and deletion
 2020-01-22 09:19:43 -08:00
Bhavin Patel 0cef2e73b1 Merge pull request #315 from splunk/CRL-1716-FixPowerShellObfusc 
CRL-1716 - Fixing by clause to allow searching Processes.process for …
 2020-01-22 09:18:42 -08:00
bpatel 5d6ef5ce60 renaming files 2020-01-22 09:14:51 -08:00
Jason Brewer b85543e0b5 CRL-1717 - Addressing comments by removing unnecessary output_filter macros from investigation searches and removing references to those in the investigation definitions. 2020-01-22 08:40:30 -08:00
Jason Brewer b62ce205b8 CRL-1716 - Updating per code review requests. Adding output macro file and reference within the detection search. 2020-01-22 08:26:16 -08:00
bpatel 14f54a12e8 removing incorrect macro file 2020-01-21 17:29:55 -08:00
Jose Enrique Hernandez c6a904b36f Merge pull request #314 from splunk/CRL-1712_netsh_abuse 
CRL-1712 Disabling Security Tools
 2020-01-21 11:42:42 -08:00
Jose Enrique Hernandez 7b976f25f7 Update investigate_user_activities_in_all_cloud_region_output_filter.yml 2020-01-21 11:34:38 -08:00
jzsplunk 6eed922214 testing commented search 2020-01-21 01:58:30 -08:00
divious1 0ac15cb563 updated fields and added macros and lookup entries 2020-01-19 21:37:45 -05:00
Jason Brewer 56e7182720 CRL-1717 - Added "search *" definitions to the macros without definitions. 2020-01-17 17:09:01 -08:00
bpatel 629badf7e7 macros file, still not liking this practice 2020-01-14 15:58:38 -08:00
Patrick Bareiss 4a0bf015e8 tested and updates searches for lateral movement story 2020-01-13 11:18:54 +01:00
Patrick Bareiss ce3b152832 WIP: testing lateral movement analytics story 2020-01-10 12:47:12 +01:00
divious1 f178e41e12 updated create hidden shares 2020-01-09 16:59:04 -05:00
bpatel 652d7f3fd0 updating macros to use sourcetype 2019-12-18 17:49:09 -08:00
bpatel 2701ad2049 remove def key from macro yml 2019-12-18 16:15:51 -08:00
bpatel 142d74b174 remove def key from macro yml 2019-12-18 14:54:48 -08:00
bpatel 9afa020d06 empty defs 2019-12-18 14:48:24 -08:00
bpatel 151be9217b removing index and keeping source 2019-12-18 14:21:36 -08:00
Patrick Bareiss 5c775ec15a Worked on the feedback 2019-12-18 20:08:10 +01:00
Patrick Bareiss 1cdf09802c Worked on the feedback 2019-12-18 20:03:19 +01:00
Patrick Bareiss be0fc0b66a Worked on the feedback 2019-12-18 10:29:40 +01:00
Patrick Bareiss fc12a232a1 Merge branch 'develop' into CRL-1698_new_version_credential_dumping 2019-12-18 10:24:52 +01:00
Patrick Bareiss 4e8427cff4 Worked on the feedback 2019-12-18 10:23:55 +01:00
Patrick Bareiss 3f03c5392c New version of Credential Dumping Story 2019-12-17 18:08:09 +01:00
Patrick Bareiss 761812a675 WIP: Exception Handling test 2019-12-17 13:15:51 +01:00
Patrick Bareiss 2ea8d2b020 fixed security_content_ctime macro 2019-12-17 09:33:35 +01:00
Patrick Bareiss 2ed8b32696 Merged with develop 2019-12-17 09:13:43 +01:00
bpatel 8ae3ebdbf5 naming updates, jinja macros updates 2019-12-16 13:05:17 -08:00
Patrick Bareiss de84f9822c WIP: liche check disabled 2019-12-16 12:07:40 +01:00
Patrick Bareiss c873fc8363 WIP: pre and post macros 2019-12-16 10:28:47 +01:00
divious1 89e8cc1faf found a bug with how generate was producing the file, needs to be a string 2019-12-11 15:28:26 -05:00
divious1 f8e3113412 added summariesonly and fixed ctime 2019-12-11 15:14:49 -05:00
divious1 f9bdf7e0e4 introduced security_content_ctime as a macro, renamed all our searches to use this new macro, removing ES dependecy 2019-12-11 14:59:03 -05:00