admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
6,565 Commits 697 Branches 195 Tags
v3.20.0
Commit Graph

6565 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Jose Enrique Hernandez 0758c2da57 Merge pull request #1356 from splunk/stpooood_clam 
fix text
v3.20.0 untagged-230af650cf7898e77220 		2021-04-29 16:55:51 -04:00
bpatel b8c4992f82 fix text 2021-04-29 13:51:45 -07:00
Michael Haag fc82334017 Merge pull request #1353 from splunk/ssa_tbd 
We're Off To See The Haag
 2021-04-28 12:09:19 -06:00
divious1 a2e62c08b9 removed dest id from a body field since it is already part of the anomaly 2021-04-28 14:01:05 -04:00
Jose Enrique Hernandez e334484b1e Update ssa___illegal_service_and_process_control_via_mimikatz_modules.yml 2021-04-28 13:56:54 -04:00
Jose Enrique Hernandez 87d7cb0f4d Update ssa___illegal_privilege_elevation_via_mimikatz_modules.yml 2021-04-28 13:56:41 -04:00
Jose Enrique Hernandez 2bd7255d19 Update ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml 2021-04-28 13:56:30 -04:00
Jose Enrique Hernandez 5d7c94f508 Update ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml 2021-04-28 13:56:17 -04:00
Jose Enrique Hernandez 8f1e5f6a0e Update ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml 2021-04-28 13:56:03 -04:00
Jose Enrique Hernandez 3980104962 Update ssa___illegal_log_deletion_via_mimikatz_modules.yml 2021-04-28 13:55:52 -04:00
Jose Enrique Hernandez d0c21456ae Update ssa___illegal_account_enable_disable_via_dsinternals_modules.yml 2021-04-28 13:55:40 -04:00
Jose Enrique Hernandez df8c60d58f Update ssa___illegal_account_creation_via_powersploit_modules.yml 2021-04-28 13:55:07 -04:00
Jose Enrique Hernandez acae84ab62 Update ssa___illegal_access_user_content_via_powersploit_modules.yml 2021-04-28 13:54:52 -04:00
Jose Enrique Hernandez 5eec0c731a Update ssa___detect_pass_hash.yml 2021-04-28 13:54:35 -04:00
Jose Enrique Hernandez 2877c3679e Update ssa___credential_extraction_powersploit_modules.yml 2021-04-28 13:53:51 -04:00
Jose Enrique Hernandez 05f4acb4c2 Update ssa___credential_extraction_ms_debuggers_z_option.yml 2021-04-28 13:53:38 -04:00
Jose Enrique Hernandez 65dc6f1402 Update ssa___credential_extraction_ms_debuggers_kernel_peek.yml 2021-04-28 13:53:25 -04:00
Jose Enrique Hernandez 1a0c351e64 Update ssa___credential_extraction_mimikatz_modules.yml 2021-04-28 13:53:09 -04:00
Jose Enrique Hernandez 485af4308d Update ssa___credential_extraction_lazagne_command_options.yml 2021-04-28 13:52:55 -04:00
Jose Enrique Hernandez 5309d6546d Update ssa___credential_extraction_getaddbaccount_from_dump.yml 2021-04-28 13:52:05 -04:00
Jose Enrique Hernandez 1298161c3a Update ssa___credential_extraction_fgdump_cachedump_v_option.yml 2021-04-28 13:51:01 -04:00
Jose Enrique Hernandez c9953b5c8a Update ssa___credential_extraction_fgdump_cachedump_s_option.yml 2021-04-28 13:50:45 -04:00
Jose Enrique Hernandez ff215bb999 Update ssa___credential_extraction_dsinternals_modules.yml 2021-04-28 13:50:29 -04:00
Jose Enrique Hernandez 0ac46abe29 Update ssa___credential_extraction_dsinternals_conversion_modules.yml 2021-04-28 13:50:09 -04:00
Jose Enrique Hernandez f2953fe5ea Update ssa___attempted_credential_dump_from_registry_via_reg_exe.yml 2021-04-28 13:49:49 -04:00
Jose Enrique Hernandez 6e043a8e9a Update ssa___assess_credential_strength_via_dsinternals_modules.yml 2021-04-28 13:49:27 -04:00
Jose Enrique Hernandez 38706ea53e Update ssa___applying_stolen_credentials_via_powersploit_modules.yml 2021-04-28 13:49:01 -04:00
Jose Enrique Hernandez 76083b30b2 Update ssa___applying_stolen_credentials_via_mimikatz_modules.yml 2021-04-28 13:48:15 -04:00
Michael Haag 2b8ab04c98 Merge branch 'develop' into ssa_tbd 2021-04-28 10:28:39 -06:00
mhaag-spl 79dd8f833c all SSA TBD bodies Done 2021-04-28 10:25:26 -06:00
mhaag-spl 458147e1e7 SSA TBD 2021-04-27 14:32:30 -06:00
Bhavin Patel 82dea3c467 Merge pull request #1346 from splunk/Double-The-Haags 
Double The Haag's
 2021-04-27 10:55:50 -07:00
root ae67238718 Added detection testing service results inOffice Product Spawning MSHTA 2021-04-27 13:57:16 +00:00
Detection Testing Service ddf322cb1e Merge branch 'Double-The-Haags' of https://github.com/splunk/security_content into Double-The-Haags 2021-04-27 13:07:53 +00:00
root aa4fed6f4d Added detection testing service results inOffice Product Spawning BITSAdmin 2021-04-27 13:07:53 +00:00
Detection Testing Service e9e49a3548 Merge branch 'Double-The-Haags' of https://github.com/splunk/security_content into Double-The-Haags 2021-04-27 13:05:05 +00:00
root a6f2d71e81 Added detection testing service results inOffice Product Spawning Wmic 2021-04-27 13:05:04 +00:00
root d4470a8910 Added detection testing service results inOffice Product Spawning CertUtil 2021-04-27 13:04:46 +00:00
mhaag-spl f8b712c04e Office products spawning things 2021-04-27 06:39:12 -06:00
github-actions[bot] 05ed80eb3c Branch was auto-updated. 2021-04-27 10:32:59 +00:00
tccontre 0b662dbc75 Merge pull request #1344 from splunk/net_exfil 
net_exfil
 2021-04-27 12:32:41 +02:00
Bhavin Patel f2b6938726 Update dns_exfiltration_using_nslookup_app.yml 
fixing a minor typo
 2021-04-26 13:15:22 -07:00
mhaag-spl 2b5eb6fbc4 Masquerading - detections + analytic story 2021-04-26 13:38:52 -06:00
github-actions[bot] 6b93f0b356 Branch was auto-updated. 2021-04-26 16:34:31 +00:00
github-actions[bot] 800050d2db Branch was auto-updated. 2021-04-26 16:34:29 +00:00
Jose Enrique Hernandez 17d5918b10 Merge pull request #1350 from splunk/ssa_testing_user_doc 
ssa testing usage docs
 2021-04-26 12:34:03 -04:00
github-actions[bot] d573e43298 Branch was auto-updated. 2021-04-26 16:32:22 +00:00
github-actions[bot] 3243f202c1 Branch was auto-updated. 2021-04-26 16:32:20 +00:00
Jose Enrique Hernandez 02728eec00 Merge branch 'develop' into ssa_testing_user_doc 2021-04-26 12:32:08 -04:00
Bhavin Patel 0f401dd3bf Merge pull request #1341 from splunk/TR-593_fix_fp_in_system_process_running_unexpected_location 
upgrading detection to avoid FPs and also added bodies
 2021-04-26 09:32:02 -07:00