admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
8,029 Commits 697 Branches 195 Tags
e816e2c674e13715947667c19257f1833ec7909f
Commit Graph

610 Commits

Author SHA1 Message Date
github-actions[bot] 81b916991d Branch was auto-updated. 2021-06-22 21:32:16 +00:00
mvelazco e4f5a3894d fixing errors 
fixing filter name
 2021-06-21 17:10:54 -04:00
mvelazco 1b7f966a84 re-factoring windows event log cleared detections 2021-06-21 16:40:59 -04:00
mhaag-spl ad85879e89 Fixing descriptions 2021-06-18 13:41:54 -06:00
mhaag-spl 35492c75fb wrong data 2021-06-18 11:00:34 -06:00
mhaag-spl 2e9b99ecf1 Updates 2021-06-18 10:34:25 -06:00
mhaag-spl 9396034913 Remote WMI Command Attempt 2021-06-18 10:02:13 -06:00
mhaag-spl b51f291810 Update detect_wmi_event_subscription_persistence.test.yml 2021-06-18 08:22:36 -06:00
github-actions[bot] 30011967a1 Branch was auto-updated. 2021-06-18 07:45:38 +00:00
github-actions[bot] 2f325f074e Branch was auto-updated. 2021-06-17 13:27:09 +00:00
github-actions[bot] 817bee6359 Branch was auto-updated. 2021-06-17 13:27:01 +00:00
github-actions[bot] 8c3061f290 Branch was auto-updated. 2021-06-17 13:22:24 +00:00
github-actions[bot] 6ee17226c5 Branch was auto-updated. 2021-06-17 13:22:17 +00:00
github-actions[bot] 83bcadf468 Branch was auto-updated. 2021-06-17 13:22:14 +00:00
mhaag-spl 99e3af8d10 wmi event subscription 2021-06-16 13:48:07 -06:00
tccontre a1b27f125f Delete allow_operation_with_consent_admin.test.yml 
un-intended files. this is already in rttp PR
 2021-06-16 10:22:00 +02:00
tccontre 9a25b289c3 Delete clear_unallocated_sector_using_cipher_app.test.yml 
un-intended files. this is already in rttp PR
 2021-06-16 10:21:41 +02:00
tccontre de20af3ac5 Delete permission_modification_using_takeown_app.test.yml 
un-intended files. this is already in rttp PR
 2021-06-16 10:21:28 +02:00
tccontre 150d8c9f34 Delete prevent_automatic_repair_mode_using_bcdedit.test.yml 
un-intended files. this is already in rttp PR
 2021-06-16 10:21:05 +02:00
tccontre 32defb377a Delete start_up_during_safe_mode_boot.test.yml 
un-intended files. this is already in rttp PR
 2021-06-16 10:20:51 +02:00
tccontre 878bf692fa Delete disable_logs_using_wevtutil.test.yml 
un-intended files. this is already in rttp PR
 2021-06-16 10:13:51 +02:00
mhaag-spl 25b1087abc Domain enumeration 2021-06-15 14:02:45 -06:00
mhaag-spl 4476dc1705 spec chars 2021-06-15 13:28:27 -06:00
mhaag-spl a169f1b226 Name fix 2021-06-15 13:26:01 -06:00
mhaag-spl a4d3947ee3 System.Reflection.Assembly 
System.Reflection.Assembly
 2021-06-15 13:16:17 -06:00
github-actions[bot] 375416e0a4 Branch was auto-updated. 2021-06-15 13:44:14 +00:00
github-actions[bot] 85ecf75bb9 Branch was auto-updated. 2021-06-15 13:44:09 +00:00
github-actions[bot] b9adec82fb Branch was auto-updated. 2021-06-15 13:44:08 +00:00
github-actions[bot] 90f9bfabcc Branch was auto-updated. 2021-06-15 13:44:07 +00:00
mhart-splunk 6270837a4c Excessive win temp detection (#1438) 
Detects artifacts in windows event logs while meterpreter is operating on a remote host.
 2021-06-15 09:43:48 -04:00
github-actions[bot] 1a1963ea02 Branch was auto-updated. 2021-06-14 15:24:10 +00:00
tccontre 3b479c8af1 hpot 2021-06-14 11:55:13 +02:00
github-actions[bot] a0a9761ecc Branch was auto-updated. 2021-06-10 17:32:01 +00:00
github-actions[bot] 33ddcc1a5b Branch was auto-updated. 2021-06-10 17:32:00 +00:00
github-actions[bot] 7ba4c41c89 Branch was auto-updated. 2021-06-10 17:31:58 +00:00
tccontre ccf3080958 rttp 2021-06-10 15:18:16 +02:00
mhaag-spl f78ddd6777 formatting 2021-06-09 14:41:09 -06:00
mhaag-spl d8e3e4c2f7 special char remove 2021-06-09 14:36:18 -06:00
mhaag-spl 606876a98f PowerShell Script Block Initial Analytics 2021-06-09 14:26:05 -06:00
Michael Hart af4eff8cb5 Fixing file reference name 2021-06-09 14:57:17 -04:00
Michael Hart 7236281a42 Merge branch 'develop' of github.com:splunk/security_content into excessive_taskhost_process_detection 2021-06-09 14:24:41 -04:00
Michael Hart 144bcaff80 Adding in test file 2021-06-09 14:20:03 -04:00
github-actions[bot] 09068e6125 Branch was auto-updated. 2021-06-09 17:37:38 +00:00
github-actions[bot] 31c95ab515 Branch was auto-updated. 2021-06-08 19:00:29 +00:00
github-actions[bot] e547ad7395 Branch was auto-updated. 2021-06-08 19:00:26 +00:00
peter-cg 0599a3027f Fixing test data pointer 2021-06-07 22:37:23 -05:00
tccontre 2af2c59337 revil2 2021-06-04 16:41:23 +02:00
tccontre 1f8cf6ad4c Update revil_common_exec_parameter.test.yml 2021-06-04 16:14:09 +02:00
tccontre 1dc92ffce5 revil1 2021-06-04 16:10:57 +02:00
tccontre 09796e3f67 revil 2021-06-04 16:07:02 +02:00