admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • 5dd3e34604 Branch was auto-updated. pyth0n1c 2022-06-29 12:59:30 -07:00
  • 5eda0215e4 Branch was auto-updated. pyth0n1c 2022-06-29 12:59:29 -07:00
  • 0d4dc0f212 Branch was auto-updated. pyth0n1c 2022-06-29 12:59:28 -07:00
  • dfcf4d5181 Branch was auto-updated. pyth0n1c 2022-06-29 12:59:27 -07:00
  • 394f3f81af Branch was auto-updated. pyth0n1c 2022-06-29 12:59:26 -07:00
  • 4a8c5d9a39 Branch was auto-updated. pyth0n1c 2022-06-29 12:59:25 -07:00
  • d060bfd5db Merge pull request #2192 from splunk/content_changer_improvements v3.44.0 Bhavin Patel 2022-06-29 12:59:06 -07:00
  • eb0fe08f1f Update remote_system_discovery_with_adsisearcher.yml mhaag-spl 2022-06-29 13:58:10 -06:00
  • db9c7a6e4c Merge branch '4104allday' of https://github.com/splunk/security_content into 4104allday mhaag-spl 2022-06-29 12:58:06 -06:00
  • 0468911676 fixes2 mhaag-spl 2022-06-29 12:57:59 -06:00
  • 60e9de7321 Branch was auto-updated. pyth0n1c 2022-06-29 11:55:58 -07:00
  • e12aa035ef Branch was auto-updated. pyth0n1c 2022-06-29 11:55:57 -07:00
  • 09d61774a3 Branch was auto-updated. pyth0n1c 2022-06-29 11:55:57 -07:00
  • 6ad18b12e4 Branch was auto-updated. pyth0n1c 2022-06-29 11:55:56 -07:00
  • 83bbfce55a Branch was auto-updated. pyth0n1c 2022-06-29 11:55:55 -07:00
  • 0fd1792d7b Branch was auto-updated. pyth0n1c 2022-06-29 11:55:54 -07:00
  • c24b800476 Branch was auto-updated. pyth0n1c 2022-06-29 11:55:53 -07:00
  • 73ea092e8d Merge pull request #2267 from splunk/deprecate_TR-2160_deprecated_complex_test_files Bhavin Patel 2022-06-29 11:55:32 -07:00
  • b75b56b81d removing test files d1vious 2022-06-29 14:18:47 -04:00
  • 2920c25c93 fixes mhaag-spl 2022-06-29 11:45:21 -06:00
  • 8da41163ae reflection mhaag-spl 2022-06-29 10:35:44 -06:00
  • 23d89687be win32proc mhaag-spl 2022-06-29 10:21:35 -06:00
  • ca93df0797 adsi mhaag-spl 2022-06-29 10:13:46 -06:00
  • 0ae31b8ef1 streamreader mhaag-spl 2022-06-29 10:00:23 -06:00
  • 0fac306bbc azorult-bomb2 tccontre 2022-06-29 11:15:09 +02:00
  • 6cfa2014d2 Remove ambiguity from the git checkout command used by the detection testing code. pyth0n1c 2022-06-28 16:46:51 -07:00
  • 06b446bf23 Branch was auto-updated. pyth0n1c 2022-06-28 15:14:01 -07:00
  • ea26b98186 Branch was auto-updated. pyth0n1c 2022-06-28 15:14:00 -07:00
  • b9d4ef1b3b Branch was auto-updated. pyth0n1c 2022-06-28 15:13:58 -07:00
  • b6e27e4043 Branch was auto-updated. pyth0n1c 2022-06-28 15:13:57 -07:00
  • ae16d4167c Branch was auto-updated. pyth0n1c 2022-06-28 15:13:56 -07:00
  • b8ab5ffe80 Branch was auto-updated. pyth0n1c 2022-06-28 15:13:54 -07:00
  • a208dacc98 Branch was auto-updated. pyth0n1c 2022-06-28 15:13:51 -07:00
  • 1d036b3af5 Merge pull request #2265 from splunk/DM_updates Bhavin Patel 2022-06-28 15:13:30 -07:00
  • 8a79086933 Missed one Lou Stella 2022-06-28 16:01:51 -05:00
  • 9290c8c03d Updated DM and fields Lou Stella 2022-06-28 14:59:51 -05:00
  • 12b174f7d7 Changed to Network_Traffic, joining on process_id Lou Stella 2022-06-28 14:53:32 -05:00
  • 8424c1fed1 Update getdomaincontroller_with_powershell_script_block.yml Michael Haag 2022-06-28 13:35:31 -06:00
  • bcee720ef9 Branch was auto-updated. pyth0n1c 2022-06-28 11:33:28 -07:00
  • 2db77f52e6 Branch was auto-updated. pyth0n1c 2022-06-28 11:33:27 -07:00
  • f01f60d0e2 Branch was auto-updated. pyth0n1c 2022-06-28 11:33:26 -07:00
  • 3f6c96b5c2 Branch was auto-updated. pyth0n1c 2022-06-28 11:33:25 -07:00
  • 08dd21f4d8 Branch was auto-updated. pyth0n1c 2022-06-28 11:33:24 -07:00
  • ce7b96b31c Branch was auto-updated. pyth0n1c 2022-06-28 11:33:23 -07:00
  • a11c62e121 Branch was auto-updated. pyth0n1c 2022-06-28 11:33:22 -07:00
  • 926e4fcf50 Branch was auto-updated. pyth0n1c 2022-06-28 11:33:21 -07:00
  • c29b61b0d7 Merge pull request #2266 from splunk/TR-2160_deprecated_complex Jose Enrique Hernandez 2022-06-28 14:33:01 -04:00
  • 3bd6477ec7 moving complex pipelines to deprecated d1vious 2022-06-28 14:13:38 -04:00
  • 1403223486 small bug fix P4T12ICK 2022-06-28 20:12:46 +02:00
  • 27417d7cb6 Suppress more output for performance test pyth0n1c 2022-06-28 11:10:46 -07:00
  • f75b406a2f Suppress output of contentctl in CI/CD to test runtime constraints. pyth0n1c 2022-06-28 11:08:27 -07:00
  • 48f0708c59 wip P4T12ICK 2022-06-28 19:57:33 +02:00
  • cf86f899b6 Added Datamodel values Lou Stella 2022-06-28 12:03:12 -05:00
  • 4a99ae877a azorult-bomb2 tccontre 2022-06-28 11:09:24 +02:00
  • 0cc837a07a azorult-bomb2 tccontre 2022-06-28 11:00:01 +02:00
  • dcfebdea91 Merging latest develop into 4104allday branch in prep for opening PR. pyth0n1c 2022-06-27 17:07:31 -07:00
  • 3532991644 Updating other spellings of XmlWinEventLog to xmlwineventlog. At least in data ingest, this is case sensitive. pyth0n1c 2022-06-27 16:27:32 -07:00
  • 4d613e3aad default patel-bhavin 2022-06-27 16:18:47 -07:00
  • 047eafe9fa pytest patel-bhavin 2022-06-27 16:18:00 -07:00
  • bb3a73b0dd array patel-bhavin 2022-06-27 15:26:45 -07:00
  • 5c1e44eb32 adding more technologieas patel-bhavin 2022-06-27 13:49:44 -07:00
  • 51f77f9184 azorult-bomb2 tccontre 2022-06-27 11:16:39 +02:00
  • d5ab2bd9c8 CI patel-bhavin 2022-06-24 14:42:57 -07:00
  • 690021590a add MS windows patel-bhavin 2022-06-24 14:30:58 -07:00
  • e92699f315 st patel-bhavin 2022-06-24 14:27:27 -07:00
  • 01a50b9294 Branch was auto-updated. pyth0n1c 2022-06-24 10:16:00 -07:00
  • f5ec4b0500 Branch was auto-updated. pyth0n1c 2022-06-24 10:16:00 -07:00
  • 493a87e8ec Branch was auto-updated. pyth0n1c 2022-06-24 10:15:59 -07:00
  • 91d785bac6 Branch was auto-updated. pyth0n1c 2022-06-24 10:15:58 -07:00
  • bbeef84375 Branch was auto-updated. pyth0n1c 2022-06-24 10:15:57 -07:00
  • 73a76ac59a Merge pull request #2262 from splunk/TR-2113_New_Kerberoasting_detections mvelazco 2022-06-24 13:13:52 -04:00
  • 0df3dc5e51 updating fields mvelazco 2022-06-24 12:50:43 -04:00
  • 757e6b92b8 updating field name to use ScriptBlockText mvelazco 2022-06-24 11:18:28 -04:00
  • 2637c12014 updating sourcetype to xmlwineventlog mvelazco 2022-06-24 11:05:02 -04:00
  • fd78ddcb6f Merge branch 'TR-2113_New_Kerberoasting_detections' of https://github.com/splunk/security_content into TR-2113_New_Kerberoasting_detections gowthamarajr 2022-06-24 10:17:56 -04:00
  • 0f23640526 Updating test file for PowerView SPN detection gowthamarajr 2022-06-24 10:17:52 -04:00
  • f1f1ef47c7 Update windows_application_layer_protocol_rms_radmin_tool_namedpipe.yml tccontre 2022-06-24 14:29:36 +02:00
  • e9137cc822 azorult-bomb2 tccontre 2022-06-24 14:20:37 +02:00
  • e818a0d1ed Fixing print statement that was was not obeying the verbose argument. pyth0n1c 2022-06-23 15:35:56 -07:00
  • 050491a1cc Forgot to include a print statement, causing lines to be jumbled together. pyth0n1c 2022-06-23 15:28:24 -07:00
  • ca40738c75 Merge branch 'risky-spl-detector' of github.com:splunk/security_content into risky-spl-detector patel-bhavin 2022-06-23 15:21:43 -07:00
  • cb150c258e minor edits for yml validation and test file name update patel-bhavin 2022-06-23 15:21:30 -07:00
  • 0181c9fd63 Update the docker detection testing code to use the latest contentctl from develop as well as skip enrichment. pyth0n1c 2022-06-23 15:18:56 -07:00
  • 4931458ff9 Updated one broken reference link. pyth0n1c 2022-06-23 15:02:26 -07:00
  • d40ca09d61 Merged develop into content_changer_improvements to resolve merge conflict. this was making it impossible to merge the PR in the GitHub Interface. pyth0n1c 2022-06-23 14:19:17 -07:00
  • 4ee336631d Merge branch 'risky-spl-detector' of github.com:splunk/security_content into risky-spl-detector Kumar Sharad 2022-06-23 23:03:13 +02:00
  • 967bc6e113 model to detect risky commands Kumar Sharad 2022-06-23 23:02:44 +02:00
  • a133549d6c Fixing a call to content_ctl generate. This passes initial testing using nektos act on my own system! pyth0n1c 2022-06-23 13:58:13 -07:00
  • 09364401cf Branch was auto-updated. pyth0n1c 2022-06-23 13:55:32 -07:00
  • 3f7cd8dcc3 Branch was auto-updated. pyth0n1c 2022-06-23 13:55:29 -07:00
  • 6f30962fd6 Branch was auto-updated. pyth0n1c 2022-06-23 13:55:27 -07:00
  • 83f52ea26d Branch was auto-updated. pyth0n1c 2022-06-23 13:55:25 -07:00
  • 1272dc827a Merge pull request #2251 from splunk/exec-the-msi Bhavin Patel 2022-06-23 13:55:03 -07:00
  • b7955f84b9 Typo naming new variable in workflow. pyth0n1c 2022-06-23 13:51:56 -07:00
  • 82af76d67f Added ability to add or remove the --skip_enrichment argument to content_ctl based on whether or not we are running CI/CD workflow on a tagged release pyth0n1c 2022-06-23 13:50:15 -07:00
  • 8d568ae416 model to detect risky commands Kumar Sharad 2022-06-23 22:43:22 +02:00
  • 056b07a686 remove detection mhaag-spl 2022-06-23 11:09:07 -06:00
  • 54a23a2a77 Update and rename windows_modify_registry_suppress_win_defender_notifs.test.yml to windows_modify_registry_suppress_win_defender_notif.test.yml tccontre 2022-06-23 15:25:17 +02:00
  • 5c85507b8f Update and rename windows_modify_registry_disable_windows_security_center_notifs.test.yml to windows_modify_registry_disable_windows_security_center_notif.test.yml tccontre 2022-06-23 15:24:51 +02:00
  • edbf2c86b3 Update and rename windows_modify_registry_suppress_win_defender_notifs.yml to windows_modify_registry_suppress_win_defender_notif.yml tccontre 2022-06-23 15:24:21 +02:00