admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • b886ffa10f Update windows_mshta_execution_in_registry.yml tccontre 2022-10-14 11:47:18 +02:00
  • 0295a489d4 Update windows_mshta_execution_in_registry.test.yml tccontre 2022-10-14 11:14:07 +02:00
  • b5cf28dff5 Update windows_mshta_execution_in_registry.yml tccontre 2022-10-14 11:13:52 +02:00
  • b67c3bf8ce Update windows_mshta_execution_in_registry.test.yml tccontre 2022-10-14 10:45:52 +02:00
  • 93cc5d602c Update windows_mshta_execution_in_registry.yml tccontre 2022-10-14 10:45:39 +02:00
  • 135e12500f mshta_reg tccontre 2022-10-14 10:28:30 +02:00
  • 56abcaeb12 new sourcetype patel-bhavin 2022-10-13 18:07:01 -07:00
  • 62b75ad9a4 ignore lookups.db.db files patel-bhavin 2022-10-13 16:52:13 -07:00
  • ab378d6705 addo_test patel-bhavin 2022-10-13 16:47:29 -07:00
  • 7ec46bd832 spl updates patel-bhavin 2022-10-13 16:33:32 -07:00
  • 92f0ff7f5f gcp_stdev patel-bhavin 2022-10-13 15:58:37 -07:00
  • 78c1d290c5 Update ssa___windows_exchange_powershell_module_usage.yml Michael Haag 2022-10-13 15:10:26 -06:00
  • 5ad0c5b3d6 BA Michael Haag 2022-10-13 14:59:54 -06:00
  • 08fa572d42 Bump all of the actions versions, if required fix_api_update_error pyth0n1c 2022-10-13 13:19:08 -07:00
  • 6b8d2ac69c Fixed missing creation of api archive pyth0n1c 2022-10-13 12:49:16 -07:00
  • 9a9b290f83 Ensure that all the folders in dist are updated on tag. Upload the API_Content artifact as well as part of a test and as part of a release pyth0n1c 2022-10-13 12:39:45 -07:00
  • 6adef20ca0 updated with the correct dataset d1vious 2022-10-13 14:57:17 -04:00
  • 43faff68da updated given feedback d1vious 2022-10-13 13:58:10 -04:00
  • 7056578d21 Fix generate API. Also, return nonzero error code when contentctl action raises an uncaught error pyth0n1c 2022-10-13 10:08:12 -07:00
  • 3872d183a9 yml is ready David Dorsey 2022-10-13 10:25:25 -05:00
  • c83fc61042 Updated comments on finding report David Dorsey 2022-10-13 10:21:47 -05:00
  • cd70fb50e7 adding gcp configs patel-bhavin 2022-10-12 18:09:41 -07:00
  • d3fe59a15c adding data_schema tag d1vious 2022-10-12 18:50:39 -04:00
  • 33fcbe4c2c adding test dataset d1vious 2022-10-12 17:45:04 -04:00
  • 571efe6385 analytics Michael Haag 2022-10-12 14:12:34 -06:00
  • 3dde416286 Update unified_messaging_service_spawning_a_process.yml Michael Haag 2022-10-10 14:55:26 -06:00
  • c9b12aa911 Update test_config_github_actions.json Michael Haag 2022-10-10 13:30:50 -06:00
  • 8f3fbdfcbf Update test_config_github_actions.json Michael Haag 2022-10-10 11:33:06 -06:00
  • 82387357eb Update proxyshell_proxynotshell_behavior_detected.yml Michael Haag 2022-10-10 10:09:11 -06:00
  • 46a125d20b Update windows_exchange_autodiscover_ssrf_abuse.yml Michael Haag 2022-10-10 09:48:59 -06:00
  • df804a8343 ProxyShell ProxyNotShell Behavior Detected Michael Haag 2022-10-09 07:31:02 -06:00
  • b726e4b685 Update detect_sharphound_file_modifications.yml Michael Haag 2022-10-09 07:09:29 -06:00
  • 8f9257f883 rename Michael Haag 2022-10-09 06:58:13 -06:00
  • f02432bacd Pretty up the README links Mike Radka (Splunk) 2022-10-07 14:26:10 -04:00
  • dd10927a50 Pretty up the README links Mike Radka (Splunk) 2022-10-07 14:25:47 -04:00
  • 8af13e340c event_id -> event_uid Michael Radka 2022-10-07 14:17:19 -04:00
  • b3d1f44ec4 event_id -> event_uid Michael Radka 2022-10-07 14:16:58 -04:00
  • 6e18005830 process -> process.cmd_line Michael Radka 2022-10-07 14:14:02 -04:00
  • 2da9b22df8 parent_process_name -> actor_process.file.name Michael Radka 2022-10-07 14:07:36 -04:00
  • ff545bac1b process_name -> process.file.name Michael Radka 2022-10-07 14:05:09 -04:00
  • 0d4312e4fb Update activity_id Michael Radka 2022-10-07 14:00:23 -04:00
  • 79068289f5 Update category_uid and class_uid Michael Radka 2022-10-07 13:58:31 -04:00
  • d8d79fa3d1 Update OCSF 4688 samples Michael Radka 2022-10-07 13:55:46 -04:00
  • 48772734ee Add links to old/new schemas Michael Radka 2022-10-07 13:51:51 -04:00
  • 2a525afb1e Add ocsf old and new samples for findings report exercise Michael Radka 2022-10-07 13:47:17 -04:00
  • 7c9ffa9cd1 More temp stashing David Dorsey 2022-10-07 11:27:12 -05:00
  • 1f29dd4bc4 Annotated finding report for meeting later David Dorsey 2022-10-07 08:33:12 -05:00
  • d898d955ae Just stashing large_mfa_attempts for now David Dorsey 2022-10-06 19:16:34 -05:00
  • 141e61ee4a Explicitly put auto as the distribution and updated How To Implement David Dorsey 2022-10-06 19:16:02 -05:00
  • f29367bf37 CISA and mimikatz add Michael Haag 2022-10-06 16:07:25 -06:00
  • 5ee454f22c Added legacyEventType=app.generic.unauth_app_access_attempt to Okta Failed SSO Attempts David Dorsey 2022-10-06 10:00:05 -05:00
  • bf350d671e adding BA test file d1vious 2022-10-05 23:30:57 -04:00
  • e5ab6e6df6 Created a baseline search that will use MLTK to create a model to determine the normal amount of MFA attempts for account in okta David Dorsey 2022-10-05 20:23:08 -05:00
  • 343a8d3698 Updates + new Michael Haag 2022-10-05 10:20:07 -06:00
  • 3941a240b2 Added missing nist and cis20 fields to 3 experimental detections. pyth0n1c 2022-10-04 16:54:34 -07:00
  • e033d17e23 add validation for missing detection tags cis20 and nist pyth0n1c 2022-10-04 16:51:23 -07:00
  • 4daefa51ac update datasets patel-bhavin 2022-10-04 15:02:43 -07:00
  • 9c1f8bccc4 new SFA detection patel-bhavin 2022-10-04 13:48:48 -07:00
  • 609cd1cea7 Merge branch 'detection_enrichment_project' of github.com:splunk/security_content into detection_enrichment_project d1vious 2022-10-04 16:17:58 -04:00
  • d154a2ef0d updating template d1vious 2022-10-04 16:17:53 -04:00
  • f9a3d09f9e Merge branch 'aws_mfa' of github.com:splunk/security_content into aws_mfa patel-bhavin 2022-10-04 11:50:13 -07:00
  • 47b0525a18 mfa_disabled patel-bhavin 2022-10-04 11:50:03 -07:00
  • d3a3d30ae6 Branch was auto-updated. srv-rr-gh-researchbt 2022-10-04 11:48:56 -07:00
  • 2d544633af Branch was auto-updated. srv-rr-gh-researchbt 2022-10-04 11:48:55 -07:00
  • 62783d43a6 Branch was auto-updated. srv-rr-gh-researchbt 2022-10-04 11:48:54 -07:00
  • e300766e5c Branch was auto-updated. srv-rr-gh-researchbt 2022-10-04 11:48:53 -07:00
  • 43c6e7e644 Branch was auto-updated. srv-rr-gh-researchbt 2022-10-04 11:48:52 -07:00
  • 476fca8245 Branch was auto-updated. srv-rr-gh-researchbt 2022-10-04 11:48:51 -07:00
  • a415268d03 Branch was auto-updated. srv-rr-gh-researchbt 2022-10-04 11:48:50 -07:00
  • bd33952e56 Branch was auto-updated. srv-rr-gh-researchbt 2022-10-04 11:48:49 -07:00
  • 6c41efdfcd Branch was auto-updated. srv-rr-gh-researchbt 2022-10-04 11:48:48 -07:00
  • 7a6cada737 Merge pull request #2391 from splunk/MovingOkta TR-2531_migrate_lateral_movement_to_XML Bhavin Patel 2022-10-04 11:48:18 -07:00
  • 90431ca751 updates Michael Haag 2022-10-04 11:37:24 -06:00
  • 517048e2b8 Merge branch 'develop' into exchange2shell Michael Haag 2022-10-04 04:43:34 -06:00
  • 60310f355b Windows Exchange Autodiscover Abuse Michael Haag 2022-10-03 22:07:25 -06:00
  • 2e57a73d89 Merge branch 'exchange2shell' of https://github.com/splunk/security_content into exchange2shell Michael Haag 2022-10-03 20:39:22 -06:00
  • edd5db1f63 Update unified_messaging_service_spawning_a_process.yml Michael Haag 2022-10-03 20:39:20 -06:00
  • 01260af9ca Merge branch 'aws_mfa' of github.com:splunk/security_content into aws_mfa patel-bhavin 2022-10-03 17:41:52 -07:00
  • 3447eeae8e fixed risk message d1vious 2022-10-03 20:37:44 -04:00
  • f983b06345 Merge branch 'detection_enrichment_project' of github.com:splunk/security_content into detection_enrichment_project d1vious 2022-10-03 20:28:03 -04:00
  • f1969a7a48 adding BA template d1vious 2022-10-03 20:27:56 -04:00
  • ad0e59da0e yaml error patel-bhavin 2022-10-03 17:11:20 -07:00
  • 575abdf1d2 Branch was auto-updated. srv-rr-gh-researchbt 2022-10-03 17:04:16 -07:00
  • f77bbd84fc Branch was auto-updated. srv-rr-gh-researchbt 2022-10-03 17:04:15 -07:00
  • 9a30a90fea Branch was auto-updated. srv-rr-gh-researchbt 2022-10-03 17:04:14 -07:00
  • 5d599a00a0 Branch was auto-updated. srv-rr-gh-researchbt 2022-10-03 17:04:13 -07:00
  • 5bf686bae8 Branch was auto-updated. srv-rr-gh-researchbt 2022-10-03 17:04:12 -07:00
  • 5c6af6f9c6 Branch was auto-updated. srv-rr-gh-researchbt 2022-10-03 17:04:11 -07:00
  • 9daccac060 Branch was auto-updated. srv-rr-gh-researchbt 2022-10-03 17:04:10 -07:00
  • 84992f0134 Branch was auto-updated. srv-rr-gh-researchbt 2022-10-03 17:04:09 -07:00
  • 5f93886f62 Branch was auto-updated. srv-rr-gh-researchbt 2022-10-03 17:04:07 -07:00
  • 811ac220d3 Merge pull request #2369 from splunk/aws_account_takeover_rename Bhavin Patel 2022-10-03 17:03:51 -07:00
  • 089360cee2 mionr patel-bhavin 2022-10-03 16:53:35 -07:00
  • 73d060d0af updated metadata patel-bhavin 2022-10-03 16:53:18 -07:00
  • 07a9ec11c9 new detectoion patel-bhavin 2022-10-03 16:48:23 -07:00
  • e39385fb34 new_mfa_Detections patel-bhavin 2022-10-03 15:42:16 -07:00
  • 6855e7aea0 Update aws_multiple_users_failing_to_authenticate_from_ip.yml Bhavin Patel 2022-10-03 13:37:28 -07:00
  • 95263c62ea Branch was auto-updated. srv-rr-gh-researchbt 2022-10-03 13:18:12 -07:00
  • 15cb1f3f84 Branch was auto-updated. srv-rr-gh-researchbt 2022-10-03 13:18:09 -07:00
  • 1ae202b567 Branch was auto-updated. srv-rr-gh-researchbt 2022-10-03 13:18:08 -07:00