admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • eb30f6c6fd Branch was auto-updated. pyth0n1c 2022-08-03 08:28:23 -07:00
  • d9649aeaf3 Branch was auto-updated. pyth0n1c 2022-08-03 08:28:22 -07:00
  • 0ded2877dd Merge pull request #2261 from splunk/security_content_automation pyth0n1c 2022-08-03 08:28:02 -07:00
  • 87a8bc0442 Merged develop into this branch and resolved merge conflicts. pyth0n1c 2022-08-03 06:47:22 -07:00
  • 544afe862c edit risk score gowthamarajr 2022-08-02 16:34:22 -04:00
  • 29a61f8cb6 Add detections for Awk, Node, Docker Lotl gowthamarajr 2022-08-02 16:23:31 -04:00
  • 66a679471c Merge branch 'develop' into faking_appcert d1vious 2022-08-02 11:36:23 -04:00
  • c9099e8a41 doing a fix to pass appcert d1vious 2022-08-02 11:28:58 -04:00
  • 99d0b47a14 Update active_directory_password_spraying.yml Jose Enrique Hernandez 2022-08-02 11:22:22 -04:00
  • 83e57921ad iscsi fix Michael Haag 2022-08-02 08:35:54 -06:00
  • 9cfa2151e7 Update windows_ingress_tool_transfer_using_explorer.yml tccontre 2022-08-02 14:01:38 +02:00
  • da230f6ed6 dcrat-analytics3 tccontre 2022-08-02 13:31:49 +02:00
  • e189299cf2 dcrat-analytics3 tccontre 2022-08-02 12:00:40 +02:00
  • 5e0ab9a5cc Updated regex to support fields which contain . in them. CleanUpDatamodelsAndRequiredFields pyth0n1c 2022-08-01 13:34:02 -07:00
  • c71b04a866 Updated detection files with recommended TA list. root 2022-08-01 18:43:39 +00:00
  • 4fb7bb3306 Merge branch 'dcrat-analytics3' of github.com:splunk/security_content into dcrat-analytics3 tccontre 2022-08-01 17:34:40 +02:00
  • 0fc18fcbdb dcrat-analytics3 tccontre 2022-08-01 17:34:21 +02:00
  • 2df3a64798 Rename windows_ingress_tool_transfer_using_explorer_exe.yml to windows_ingress_tool_transfer_using_explorer.yml tccontre 2022-08-01 14:23:01 +02:00
  • 44517188c1 Rename windows_ingress_tool_transfer_using_explorer_exe.test.yml to windows_ingress_tool_transfer_using_explorer.test.yml tccontre 2022-08-01 14:22:35 +02:00
  • f3f40edf9e Update windows_gather_victim_host_information_camera.yml tccontre 2022-08-01 14:22:03 +02:00
  • 7ef8d1dadf Update windows_ingress_tool_transfer_using_explorer_exe.test.yml tccontre 2022-08-01 14:18:38 +02:00
  • d8690a4386 Update windows_ingress_tool_transfer_using_explorer_exe.yml tccontre 2022-08-01 14:18:20 +02:00
  • b67f2c69a1 dcrat-analytics3 tccontre 2022-08-01 14:15:02 +02:00
  • 9dac698c46 solve merge conflicts P4T12ICK 2022-08-01 11:39:02 +02:00
  • bcb943d150 fix tests P4T12ICK 2022-08-01 11:31:23 +02:00
  • 1b3707932b Fixed known outstanding issue with process_name and parent_process_name pyth0n1c 2022-07-31 16:49:35 -07:00
  • cdbdc51033 Patched for a known outstanding issue - process_name to parent_process_name pyth0n1c 2022-07-31 16:47:59 -07:00
  • e2c3c7590d Changed process_name to parent_process_name Known issue pending a fix. pyth0n1c 2022-07-31 15:25:56 -07:00
  • 08107a940e Quoted strings in severity field. Fixed typo in severity field list from UNKNWON to UNKOWN. Removed the non-existent stats field 'user' (username exists) which was causing the test to fail, returning no results. pyth0n1c 2022-07-31 15:09:35 -07:00
  • bbd4b67e9d fixed query Michael Haag 2022-07-30 06:02:04 -06:00
  • 8bc3086675 iscsicpl Michael Haag 2022-07-29 17:39:55 -06:00
  • f9771fa90e Branch was auto-updated. pyth0n1c 2022-07-29 15:44:09 -07:00
  • be2e0dfc61 Branch was auto-updated. pyth0n1c 2022-07-29 15:44:06 -07:00
  • f58e086d92 Branch was auto-updated. pyth0n1c 2022-07-29 15:44:04 -07:00
  • 9b9ee9b2bf Branch was auto-updated. pyth0n1c 2022-07-29 15:44:01 -07:00
  • 014ea9855d Merge pull request #2311 from splunk/0729_playbooks Jose Enrique Hernandez 2022-07-29 18:43:40 -04:00
  • d1f890a4e9 Adding hunting playbook Lou Stella 2022-07-29 17:12:35 -05:00
  • 44a58cb582 Merge pull request #2310 from splunk/FixDetectExcessiveLockoutDetections pyth0n1c 2022-07-29 14:25:56 -07:00
  • aafee44783 Temporary fix to outstanding, known issue with field naming pyth0n1c 2022-07-29 14:23:49 -07:00
  • 07d72ad142 Fixed a number of detections around anomalous aws console logins from different areas. These include city, country, and region. They are all built around the same template and could still use some discussion. pyth0n1c 2022-07-29 14:22:50 -07:00
  • 978e4c3ef7 Update linux_ingress_tool_transfer_hunting.yml Michael Haag 2022-07-29 11:19:42 -06:00
  • 8ad83a0b5f Haag It Michael Haag 2022-07-29 11:17:19 -06:00
  • a0336d013a dcrat-analytics3 tccontre 2022-07-29 10:12:22 +02:00
  • bcb5aab4ee dcrat-analytics3 tccontre 2022-07-29 10:06:40 +02:00
  • 3dfd3c6ed6 Updated search strings from "lockout" to "*locked out*" to reflect the string that actually appears in the logs. Also, removed the nodename from the seach since it was not required. pyth0n1c 2022-07-28 17:17:21 -07:00
  • b622c65def updating docs and package bits [ci skip] research bot 2022-07-28 22:52:59 +00:00
  • c91c29bc75 Fix more datamodel quoting conflicts FixUnquotedValues pyth0n1c 2022-07-28 14:58:49 -07:00
  • 0bc4b38406 Analytic was referencing a CIM field that did not exist. Fixed that field to reference the intended field. pyth0n1c 2022-07-28 14:51:06 -07:00
  • 1423e955d7 Branch was auto-updated. pyth0n1c 2022-07-28 14:33:11 -07:00
  • 32cbdc3c88 Branch was auto-updated. pyth0n1c 2022-07-28 14:33:09 -07:00
  • 7bf7bfe134 Merge pull request #2278 from splunk/TR-2219_AzureAD_Password_Srapying v3.46.0 Bhavin Patel 2022-07-28 14:32:50 -07:00
  • 114df09d78 meta updates patel-bhavin 2022-07-28 14:18:45 -07:00
  • 1b645a499c Update azure_ad_successful_single_factor_authentication.yml Bhavin Patel 2022-07-28 14:12:18 -07:00
  • 95e47b7fd4 Update azure_ad_unusual_number_of_failed_authentications_from_ip.yml Bhavin Patel 2022-07-28 14:11:40 -07:00
  • 22f3d9bfee Update azure_ad_successful_powershell_authentication.yml Bhavin Patel 2022-07-28 14:09:17 -07:00
  • 07290ffeb7 Update azure_ad_successful_powershell_authentication.yml Bhavin Patel 2022-07-28 14:08:32 -07:00
  • 42241b1b2e Update azure_ad_multiple_users_failing_to_authenticate_from_ip.yml Bhavin Patel 2022-07-28 14:07:47 -07:00
  • 72d0a37a12 Update azure_ad_authentication_failed_during_mfa_challenge.yml Bhavin Patel 2022-07-28 14:05:57 -07:00
  • f22813da22 Update azure_active_directory_high_risk_sign_in.yml Bhavin Patel 2022-07-28 14:05:14 -07:00
  • 280d6aed18 Branch was auto-updated. pyth0n1c 2022-07-28 13:50:33 -07:00
  • faf01969d7 Branch was auto-updated. pyth0n1c 2022-07-28 13:50:30 -07:00
  • 204bf3192b Branch was auto-updated. pyth0n1c 2022-07-28 13:50:29 -07:00
  • 21278f8d68 Merge pull request #2305 from splunk/dcrat-analytics2 Bhavin Patel 2022-07-28 13:50:05 -07:00
  • f4f375113e Branch was auto-updated. pyth0n1c 2022-07-28 13:47:25 -07:00
  • d963ff033c Branch was auto-updated. pyth0n1c 2022-07-28 13:47:24 -07:00
  • 7262660bd6 Branch was auto-updated. pyth0n1c 2022-07-28 13:47:22 -07:00
  • b3c8645b06 Branch was auto-updated. pyth0n1c 2022-07-28 13:47:21 -07:00
  • 19dfced28f Merge pull request #2301 from splunk/haagonymous Bhavin Patel 2022-07-28 13:47:00 -07:00
  • f2731454b1 Update windows_system_time_discovery_w32tm_delay.yml Bhavin Patel 2022-07-28 13:30:37 -07:00
  • 979dd80466 Update windows_system_shutdown_commandline.yml Bhavin Patel 2022-07-28 13:28:00 -07:00
  • d71ddb7e26 Update windows_system_reboot_commandline.yml Bhavin Patel 2022-07-28 13:26:54 -07:00
  • c0427508a9 Update windows_command_shell_dcrat_forkbomb_payload.yml Bhavin Patel 2022-07-28 13:25:36 -07:00
  • 8f78e18334 Update windows_system_logoff_commandline.yml Bhavin Patel 2022-07-28 13:24:39 -07:00
  • 1498d090fe Update windows_system_reboot_commandline.yml Bhavin Patel 2022-07-28 13:23:33 -07:00
  • b2d1bdb62e Update windows_system_shutdown_commandline.yml Bhavin Patel 2022-07-28 13:23:07 -07:00
  • 197a576579 More updates to prevent decimal numbers from being recognized as fields. pyth0n1c 2022-07-28 13:22:46 -07:00
  • adafd65fa2 Updating more detections with quote issues pyth0n1c 2022-07-28 13:22:18 -07:00
  • 319530efa2 Branch was auto-updated. pyth0n1c 2022-07-28 13:11:04 -07:00
  • 5977a676f3 Branch was auto-updated. pyth0n1c 2022-07-28 13:11:03 -07:00
  • 53fb29f36e Branch was auto-updated. pyth0n1c 2022-07-28 13:11:00 -07:00
  • 82b586c77e Branch was auto-updated. pyth0n1c 2022-07-28 13:10:59 -07:00
  • e35f6dc30a Branch was auto-updated. pyth0n1c 2022-07-28 13:10:57 -07:00
  • 099a7d029a Merge pull request #2293 from splunk/TR-2222_AWS_defense_evasion_story Bhavin Patel 2022-07-28 13:10:40 -07:00
  • e0bdf82ff3 Fix Michael Haag 2022-07-28 13:37:50 -06:00
  • 1a05cd9c25 Fixing more unbalanced quotes pyth0n1c 2022-07-28 11:43:15 -07:00
  • 26ec278785 More quoting fixes pyth0n1c 2022-07-28 11:40:05 -07:00
  • 508424da99 Updates Michael Haag 2022-07-28 12:07:05 -06:00
  • f5a53d0a64 fixing base on feedback from users d1vious 2022-07-28 13:48:29 -04:00
  • 6c0c4f75ca Branch was auto-updated. pyth0n1c 2022-07-28 10:37:48 -07:00
  • 1e03d0fddf Branch was auto-updated. pyth0n1c 2022-07-28 10:37:47 -07:00
  • dff3e408d7 Branch was auto-updated. pyth0n1c 2022-07-28 10:37:46 -07:00
  • d14bb84a81 Branch was auto-updated. pyth0n1c 2022-07-28 10:37:44 -07:00
  • 1bad5cc933 Branch was auto-updated. pyth0n1c 2022-07-28 10:37:43 -07:00
  • 32b7d880eb Merge pull request #2298 from splunk/fix-git-issue-req Bhavin Patel 2022-07-28 10:37:26 -07:00
  • 15147d6aa7 clipboard Michael Haag 2022-07-28 11:27:19 -06:00
  • 972bd7b176 Update windows_system_logoff_commandline.yml tccontre 2022-07-28 16:12:20 +02:00
  • c9611980c2 Update windows_system_time_discovery_w32tm_delay.yml tccontre 2022-07-28 15:31:45 +02:00
  • 12ab56093b Merge branch 'dcrat-analytics2' of github.com:splunk/security_content into dcrat-analytics2 tccontre 2022-07-28 15:29:44 +02:00
  • e99ab33a15 dcrat-analytics2 tccontre 2022-07-28 15:29:25 +02:00
  • 9982cb2c78 Branch was auto-updated. pyth0n1c 2022-07-28 06:13:24 -07:00