admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • 43a6c3b87d More changes moving from detection filenames to detection objects. pyth0n1c 2022-09-09 10:20:32 -07:00
  • 5f9d6b0981 Fix whitespace difference pyth0n1c 2022-09-09 09:55:26 -07:00
  • f0324892d5 hunt Windows Event Triggered Image File Execution Options Injection Michael Haag 2022-09-09 06:50:43 -06:00
  • d5f9b56552 CICD Magic do your thing dluxtron 2022-09-09 11:44:59 +10:00
  • 9486fd8419 CICD Magic do your thing dluxtron 2022-09-09 10:43:29 +10:00
  • b207948975 Simplified diffing of changed content. pyth0n1c 2022-09-08 17:26:48 -07:00
  • 81f64410c7 Adding SID History Abuse Detection dluxtron 2022-09-09 10:08:35 +10:00
  • e43855c570 lolbas d1vious 2022-09-08 19:15:03 -04:00
  • e9e68ba82d tagging ba detection for insider threat d1vious 2022-09-08 19:00:01 -04:00
  • b3aa8b4bb4 working scripts d1vious 2022-09-08 18:01:46 -04:00
  • c973b3493c Check all files and accumulate all errors before raising any exceptions. pyth0n1c 2022-09-08 13:31:08 -07:00
  • 6f3a3746ab Simplifications for treating each detection as an object instead of as a file. This makes the logic for dealing with them much easier. pyth0n1c 2022-09-08 13:20:06 -07:00
  • 341b40aed4 Updates to make the detection testing more object-oriented instead of passing complicated dictionaries around pyth0n1c 2022-09-08 11:50:30 -07:00
  • 6174db54d9 working detection generation d1vious 2022-09-08 13:59:46 -04:00
  • 442955c826 chm fixes Michael Haag 2022-09-08 10:48:20 -06:00
  • 6531d4350e Update ssa___windows_system_binary_proxy_execution_compiled_html_file_url_in_command_line.test.yml Michael Haag 2022-09-08 10:34:08 -06:00
  • 1c928ebffe fixord Michael Haag 2022-09-08 10:27:54 -06:00
  • 6ea7428011 test test Michael Haag 2022-09-08 10:23:08 -06:00
  • 3399bc4288 Adding DSRM Account Changes dluxtron 2022-09-08 20:45:45 +10:00
  • 3d2301f161 Adding DSRM Passwod Reset dluxtron 2022-09-08 20:13:10 +10:00
  • 8ccec66c07 Adding Rogue DC Detection dluxtron 2022-09-08 19:43:23 +10:00
  • 66990b409d Adding Rogue DC Detection dluxtron 2022-09-08 19:39:52 +10:00
  • 1441cca790 Adding Rogue DC Detection dluxtron 2022-09-08 18:44:09 +10:00
  • 0b0b19f10d Adding Rogue DC Detection dluxtron 2022-09-08 18:39:38 +10:00
  • 32dd94c6ef Adding DCSync Attack dluxtron 2022-09-08 18:17:58 +10:00
  • 29da484365 Adding DCSync Attack dluxtron 2022-09-08 18:14:24 +10:00
  • 925b1eb2cd DCShadow Detection dluxtron 2022-09-08 16:08:36 +10:00
  • f9c3a86423 DCShadow Detection dluxtron 2022-09-08 15:49:03 +10:00
  • ab1ba478ae DCShadow Detection dluxtron 2022-09-08 14:41:16 +10:00
  • 56ddcbc15c DCShadow Detection dluxtron 2022-09-08 14:33:53 +10:00
  • 1d6c0d6350 DCShadow Detection dluxtron 2022-09-08 14:29:17 +10:00
  • bd4ab39e3c More huge updates to support testing multiple tests per file. dicts are getting hard to manage - it may make more sense to turn all of this state into objects instead. pyth0n1c 2022-09-07 17:06:38 -07:00
  • 83e9bad107 working on feedback d1vious 2022-09-07 18:49:22 -04:00
  • d317ffa394 Huge changes to restructure how tests are executed. Progress towards allowing multiple tests per detection to be executed. pyth0n1c 2022-09-07 14:24:49 -07:00
  • 46dbe66fff removing duplicate d1vious 2022-09-07 11:29:01 -04:00
  • 7692e55d9d DCShadow Detection dluxtron 2022-09-07 17:05:40 +10:00
  • 82f9945128 Changes to testing_service.py to support multiple tests per test file. Still have not tested or worked out how this will all be reported in the summary, though. pyth0n1c 2022-09-06 17:07:27 -07:00
  • 4810926509 enhancing descriptions mvelazco 2022-09-06 18:08:16 -04:00
  • 4cd8633876 Merge branch 'TR-2361_Azure_AD_Persistence' of github.com:splunk/security_content into TR-2361_Azure_AD_Persistence mvelazco 2022-09-06 17:26:08 -04:00
  • d81df080b6 updating descriptions mvelazco 2022-09-06 17:26:06 -04:00
  • 981e2a64cc Branch was auto-updated. pyth0n1c 2022-09-06 14:07:54 -07:00
  • e8006472c2 Branch was auto-updated. pyth0n1c 2022-09-06 14:07:53 -07:00
  • 7208f63c96 Branch was auto-updated. pyth0n1c 2022-09-06 14:07:51 -07:00
  • e807d51570 Branch was auto-updated. pyth0n1c 2022-09-06 14:07:50 -07:00
  • 0ecef3ae3d Branch was auto-updated. pyth0n1c 2022-09-06 14:07:49 -07:00
  • 1be4026031 Branch was auto-updated. pyth0n1c 2022-09-06 14:07:47 -07:00
  • d83cb15609 Branch was auto-updated. pyth0n1c 2022-09-06 14:07:46 -07:00
  • 698474a101 Branch was auto-updated. pyth0n1c 2022-09-06 14:07:45 -07:00
  • 958ede2a2b Branch was auto-updated. pyth0n1c 2022-09-06 14:07:43 -07:00
  • 97bfacffc2 Branch was auto-updated. pyth0n1c 2022-09-06 14:07:42 -07:00
  • ae92b16c0a Merge pull request #2351 from splunk/fixdescriptionpt Rod Soto 2022-09-06 14:07:21 -07:00
  • 73e84a326d fixedpathlog Rod Soto 2022-09-06 13:40:08 -07:00
  • 6b333e5c9a Merge branch 'TR-2361_Azure_AD_Persistence' of github.com:splunk/security_content into TR-2361_Azure_AD_Persistence mvelazco 2022-09-06 16:08:37 -04:00
  • d8cce69644 adding new detection mvelazco 2022-09-06 16:08:35 -04:00
  • 385bc45c5d Update windows_phishing_recent_iso_exec_registry.yml tccontre 2022-09-05 10:56:24 +02:00
  • 2dc78584a0 Update windows_phishing_recent_iso_exec_registry.yml tccontre 2022-09-05 10:56:01 +02:00
  • 4e393e9509 Update windows_defacement_modify_transcodedwallpaper_file.yml tccontre 2022-09-05 10:29:49 +02:00
  • 85fc55b281 brute-rate-3 tccontre 2022-09-05 10:26:55 +02:00
  • cca076f667 Branch was auto-updated. pyth0n1c 2022-09-02 19:15:41 -04:00
  • 7ec4b9e936 Branch was auto-updated. pyth0n1c 2022-09-02 19:15:41 -04:00
  • 3880a4f1cf Branch was auto-updated. pyth0n1c 2022-09-02 19:15:38 -04:00
  • 6d6c132937 Branch was auto-updated. pyth0n1c 2022-09-02 19:15:36 -04:00
  • e701306956 Branch was auto-updated. pyth0n1c 2022-09-02 19:15:35 -04:00
  • 9894bf1583 Branch was auto-updated. pyth0n1c 2022-09-02 19:15:34 -04:00
  • 7879f6b016 Branch was auto-updated. pyth0n1c 2022-09-02 19:15:33 -04:00
  • 57028a0345 Branch was auto-updated. pyth0n1c 2022-09-02 19:15:32 -04:00
  • 585f0a407e Branch was auto-updated. pyth0n1c 2022-09-02 19:15:31 -04:00
  • 5946b4adfa Branch was auto-updated. pyth0n1c 2022-09-02 19:15:30 -04:00
  • ca65ddd817 Branch was auto-updated. pyth0n1c 2022-09-02 19:15:29 -04:00
  • 95e4eb048c Merge pull request #2359 from splunk/fix_sourcetype_for_linux_kernel_module_detection pyth0n1c 2022-09-02 19:15:12 -04:00
  • 5c4d054652 Update linux_kernel_module_enumeration.test.yml pyth0n1c 2022-09-02 18:50:48 -04:00
  • 3d308b862f adding new detection mvelazco 2022-09-02 18:25:34 -04:00
  • 441a1542bd adding new detection. fixing types. adding line to lookup mvelazco 2022-09-02 18:03:14 -04:00
  • f0601e4f9d Update ssa___windows_system_binary_proxy_execution_compiled_html_file_decompile.yml Michael Haag 2022-09-02 15:04:47 -06:00
  • 6287645f48 BA Michael Haag 2022-09-02 14:44:39 -06:00
  • 24c2b5cf82 Adding DCShadow detection dluxtron 2022-09-02 13:57:00 +10:00
  • ec35919294 Adding DCShadow detection dluxtron 2022-09-02 13:45:46 +10:00
  • e22b274004 Adding DCShadow detection dluxtron 2022-09-02 13:41:15 +10:00
  • 39083d5a00 Adding DCShadow detection dluxtron 2022-09-02 13:32:06 +10:00
  • 6ae65351f5 Adding DCShadow detection dluxtron 2022-09-02 13:01:05 +10:00
  • 171f7e2b80 id fix Michael Haag 2022-09-01 15:10:29 -06:00
  • affae7229d SSA all things Michael Haag 2022-09-01 15:02:44 -06:00
  • 31cd39763b Remove a number of updated files which don't yet exist in develop and should not have been in this branch to begin with. They will be merged as part of a separate PR. pyth0n1c 2022-09-01 12:34:12 -04:00
  • fc1db0c161 Fixing modified detection so that it has its original value. pyth0n1c 2022-09-01 12:25:53 -04:00
  • e80c5c4e85 Update windows_access_token_manipulation_winlogon_duplicate_token_handle.yml tccontre 2022-09-01 18:06:44 +02:00
  • 640f932419 Added bubbling up errors so that they can be handled by higher level functions. pyth0n1c 2022-09-01 11:47:29 -04:00
  • 6da8bc32c1 INTENTIONALLY INTRODUCES AN ERROR TO TEST UPDATED VALIDATION AND PYTEST WORKFLOWS. REMOVE THIS CHANGE BEFORE MERGING THIS PR. pyth0n1c 2022-09-01 11:00:02 -04:00
  • f68b07ff28 Merge branch 'brute-ratel-3' of github.com:splunk/security_content into brute-ratel-3 tccontre 2022-09-01 16:42:45 +02:00
  • a482779b41 brute-ratel-3 tccontre 2022-09-01 16:42:25 +02:00
  • 324b58bf12 Update windows_service_deletion_in_registry.yml tccontre 2022-09-01 15:40:48 +02:00
  • d764f48a29 Update windows_input_capture_using_credential_ui_dll.yml tccontre 2022-09-01 15:39:08 +02:00
  • 8abf778411 Update windows_gather_victim_identity_sam_info.yml tccontre 2022-09-01 15:38:42 +02:00
  • 25ec32f85d Merge branch 'brute-ratel-3' of github.com:splunk/security_content into brute-ratel-3 tccontre 2022-09-01 15:18:54 +02:00
  • c1491e38d1 brute-ratel-3 tccontre 2022-09-01 15:18:30 +02:00
  • bfee7c9b0a Delete windows_phishing_recent_iso_exec_registry.yml tccontre 2022-09-01 13:20:57 +02:00
  • d06f714dbb Delete windows_input_capture_using_credential_ui_dll.yml tccontre 2022-09-01 13:20:48 +02:00
  • c1b7d97eb3 Delete windows_hijack_execution_flow_version_dll_side_load.yml tccontre 2022-09-01 13:20:39 +02:00
  • 5bcc2edeeb Delete windows_remote_access_software_brc4_loaded_dll.yml tccontre 2022-09-01 13:20:25 +02:00
  • a04fd01b34 Delete windows_gather_victim_identity_sam_info.test.yml tccontre 2022-09-01 13:20:14 +02:00
  • 42cf9d4d02 Delete windows_hijack_execution_flow_version_dll_side_load.test.yml tccontre 2022-09-01 13:20:04 +02:00