admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • 134688feb1 Update windows_linked_policies_in_adsi_discovery.test.yml tccontre 2022-04-28 13:38:27 +02:00
  • abd4a762c9 Update windows_linked_policies_in_adsi_discovery.test.yml tccontre 2022-04-28 13:38:06 +02:00
  • 6c26474b2c industroyer2_PR3 tccontre 2022-04-28 10:39:40 +02:00
  • e918be1f59 Update windows_processes_killed_by_industroyer2_malware.yml tccontre 2022-04-28 09:31:33 +02:00
  • dc43dd29f7 industroyer2_PR3 tccontre 2022-04-28 09:18:58 +02:00
  • 00515112d1 industroyer2_PR3 tccontre 2022-04-28 09:05:31 +02:00
  • ba8de57131 Merge branch 'develop' into feature/PEX-63-api-version-error Danny Leung 2022-04-27 18:14:44 -07:00
  • 4b962f4bb8 Branch was auto-updated. pyth0n1c 2022-04-27 13:02:07 -07:00
  • 263455a380 Branch was auto-updated. pyth0n1c 2022-04-27 13:02:06 -07:00
  • 56d780c2ce Branch was auto-updated. pyth0n1c 2022-04-27 13:02:06 -07:00
  • 1b4a94bb73 Branch was auto-updated. pyth0n1c 2022-04-27 13:02:05 -07:00
  • 3817df920e Branch was auto-updated. pyth0n1c 2022-04-27 13:02:04 -07:00
  • 9113092b13 Branch was auto-updated. pyth0n1c 2022-04-27 13:02:03 -07:00
  • 2fcce9f49e Branch was auto-updated. pyth0n1c 2022-04-27 13:02:02 -07:00
  • ab74318614 Merge pull request #2178 from splunk/TR1807fix v3.38.2 Jose Enrique Hernandez 2022-04-27 16:01:35 -04:00
  • 28566660fa Removing false positives Lou Stella 2022-04-27 14:13:01 -05:00
  • 32ac037646 updated message Lou Stella 2022-04-27 13:37:29 -05:00
  • ee4153dbf0 Branch was auto-updated. pyth0n1c 2022-04-27 11:33:26 -07:00
  • f9f6f2e1d3 Branch was auto-updated. pyth0n1c 2022-04-27 11:33:25 -07:00
  • 429fc3f071 Branch was auto-updated. pyth0n1c 2022-04-27 11:33:25 -07:00
  • 118ea27630 Branch was auto-updated. pyth0n1c 2022-04-27 11:33:24 -07:00
  • af71ef8736 Branch was auto-updated. pyth0n1c 2022-04-27 11:33:23 -07:00
  • dd562570fe Branch was auto-updated. pyth0n1c 2022-04-27 11:33:22 -07:00
  • ff8b9dca6f Branch was auto-updated. pyth0n1c 2022-04-27 11:33:20 -07:00
  • 106e451aa5 Merge pull request #2174 from splunk/industroyer2 Michael Haag 2022-04-27 12:32:59 -06:00
  • de6ccbbf9c CVE-2022-27183 Lou Stella 2022-04-27 12:44:48 -05:00
  • 2ffbb6a244 industroyer2_PR3 tccontre 2022-04-27 12:19:45 +02:00
  • 3304969faa industroyer2_PR2 tccontre 2022-04-27 10:53:15 +02:00
  • f975394db8 PEX-63: derp Danny Leung 2022-04-26 13:17:54 -07:00
  • 96f743b705 PEX-63: debug Danny Leung 2022-04-26 13:08:04 -07:00
  • 2c1597e80f PEX-63: more debug Danny Leung 2022-04-26 13:01:41 -07:00
  • 74e4c6f9ca PEX-63: debug checkout separate branch Danny Leung 2022-04-26 12:52:39 -07:00
  • c9ecc29065 recon mhaag-spl 2022-04-26 12:06:47 -06:00
  • 63674d843f update mhaag-spl 2022-04-26 11:57:50 -06:00
  • dbcc2d6d5b Update powershell_fileless_script_contains_base64_encoded_content.yml mhaag-spl 2022-04-26 11:46:01 -06:00
  • 2b4a3b98fc Merge branch 'develop' into 4104allday mhaag-spl 2022-04-26 11:22:18 -06:00
  • ebe686fc1f Branch was auto-updated. pyth0n1c 2022-04-26 08:50:00 -07:00
  • aae5dd89e5 Branch was auto-updated. pyth0n1c 2022-04-26 08:49:59 -07:00
  • 22cc68f1cf Branch was auto-updated. pyth0n1c 2022-04-26 08:49:58 -07:00
  • f78dca101a Branch was auto-updated. pyth0n1c 2022-04-26 08:49:57 -07:00
  • 702550aa5e Branch was auto-updated. pyth0n1c 2022-04-26 08:49:55 -07:00
  • d6e145ee52 Branch was auto-updated. pyth0n1c 2022-04-26 08:49:53 -07:00
  • a229f866c0 Merge pull request #2173 from splunk/ci/ssa-builds-upload Bhavin Patel 2022-04-26 11:49:31 -04:00
  • 56559ca950 Update linux_adding_crontab_using_list_parameter.yml tccontre 2022-04-26 15:26:23 +02:00
  • c67850b27c Update linux_deleting_critical_directory_using_rm_command.yml tccontre 2022-04-26 15:24:40 +02:00
  • 9b8679905b Update linux_shred_overwrite_command.yml tccontre 2022-04-26 15:23:11 +02:00
  • 0be159039e Update linux_stop_services.yml tccontre 2022-04-26 15:22:44 +02:00
  • 12c36c56f3 Update linux_shred_overwrite_command.yml tccontre 2022-04-26 12:10:15 +02:00
  • 7b4836f253 industroyer2_PR2 tccontre 2022-04-26 12:01:00 +02:00
  • de23d01c89 industroyer2_PR2 tccontre 2022-04-26 10:06:53 +02:00
  • 4aeb43540a Non working... yet... deploy function. pyth0n1c 2022-04-25 16:30:21 -07:00
  • 1e0fdb2690 Branch was auto-updated. pyth0n1c 2022-04-25 11:32:08 -07:00
  • 21f96b251f Branch was auto-updated. pyth0n1c 2022-04-25 11:32:07 -07:00
  • 464128821a Branch was auto-updated. pyth0n1c 2022-04-25 11:32:05 -07:00
  • a883400bbf Branch was auto-updated. pyth0n1c 2022-04-25 11:32:04 -07:00
  • 7e11914dc3 Branch was auto-updated. pyth0n1c 2022-04-25 11:32:03 -07:00
  • 46fcfbdf7c Branch was auto-updated. pyth0n1c 2022-04-25 11:32:00 -07:00
  • e0958d88e9 Merge pull request #2139 from splunk/inthewild Bhavin Patel 2022-04-25 14:31:36 -04:00
  • 93b1f025dc Update windows_registry_modification_for_safe_mode_persistence.yml Bhavin Patel 2022-04-25 13:46:43 -04:00
  • 324b7b9dfc Update windows_iso_lnk_file_creation.yml Bhavin Patel 2022-04-25 13:44:30 -04:00
  • 6a8867dcda Updated detection files with recommended TA list. security_content_automation_test_enrich_1 akhunti 2022-04-25 17:25:55 +05:50
  • 1acfac609c industroyer2 tccontre 2022-04-25 12:03:54 +02:00
  • 912f23fc7b Updated detection files with recommended TA list. security_content_automation_test_enrich_3 truptilangalia-crest 2022-04-25 15:26:56 +05:50
  • 0ac2e88349 Updated detection files with recommended TA list. security_content_automation_test_enrich_2 truptilangalia-crest 2022-04-25 15:26:27 +05:50
  • 11d372b63c industroyer2 tccontre 2022-04-25 09:36:55 +02:00
  • 6694a5f659 building and appinspecting of the package are now working. removed an errorneous comma from lookups/attack_tools.csv that caused errors during appinspect and resulted in a badly cormatted csv. pyth0n1c 2022-04-23 10:22:56 -07:00
  • 0db105e00c More progress toward build and inspect of the app. pyth0n1c 2022-04-23 09:27:41 -07:00
  • aecd70e74d Now support building the app. Added requirements to support CLI-based appinspect. pyth0n1c 2022-04-23 07:39:31 -07:00
  • 814a13c522 Stubs for building an application with slim and inspecting with command line version of appinspect. pyth0n1c 2022-04-23 06:44:18 -07:00
  • d6e09d3c1b Actually calling clean now instead of just passing over it. pyth0n1c 2022-04-22 13:39:09 -07:00
  • 760242e45b Included basic implementation of clean, which is yet to be tested. pyth0n1c 2022-04-22 13:25:53 -07:00
  • 804123257e Small change - renamed a caraible from type to content_type. It is better not to overwrite python builtins. pyth0n1c 2022-04-22 12:04:43 -07:00
  • 8cc82a9d0d Added modes and stub functions to the contentctl.py as an entry point for cleaning and deploying. pyth0n1c 2022-04-22 11:59:10 -07:00
  • e04e3690f8 Update windows_registry_delete_task_sd.yml Michael Haag 2022-04-22 11:37:08 -06:00
  • 7d4e75523f Update windows_drivers_loaded_by_signature.yml Michael Haag 2022-04-22 10:32:33 -06:00
  • abd668b260 updates and story mhaag-spl 2022-04-22 10:21:29 -06:00
  • f1a8bf36d9 PEX-63: debug Danny Leung 2022-04-18 16:54:41 -07:00
  • 0cdb1df1a3 PEX-63: debug more Danny Leung 2022-04-18 15:51:16 -07:00
  • f0886d2063 Branch was auto-updated. pyth0n1c 2022-04-18 14:42:29 -07:00
  • 165a986a30 Branch was auto-updated. pyth0n1c 2022-04-18 14:42:28 -07:00
  • 92ebc22060 Branch was auto-updated. pyth0n1c 2022-04-18 14:42:27 -07:00
  • 3e96701688 Branch was auto-updated. pyth0n1c 2022-04-18 14:42:26 -07:00
  • a6bbd112d8 Branch was auto-updated. pyth0n1c 2022-04-18 14:42:24 -07:00
  • f23595695b Branch was auto-updated. pyth0n1c 2022-04-18 14:42:23 -07:00
  • 9eb9e7a88b Merge pull request #2154 from splunk/TR-1735 Bhavin Patel 2022-04-18 14:42:05 -07:00
  • f901aa5f94 PEX-63: debug Danny Leung 2022-04-18 13:15:34 -07:00
  • e35fdf63df Updated a number of other detections that were missing the submodel from the declared datamodel in the search. pyth0n1c 2022-04-18 10:49:52 -07:00
  • 6ba1225077 SD Delete mhaag-spl 2022-04-18 10:55:08 -06:00
  • c4a905398e Updated format of search from a long list of ORs to the IN syntax for two fields. pyth0n1c 2022-04-18 09:53:20 -07:00
  • 12350f451e Update nltest_domain_trust_discovery.yml mhaag-spl 2022-04-18 10:01:25 -06:00
  • 2cb867a185 Updated the vast majority of detections which use strings, not field names, that contain a dot. This caused issues with the search parser and made it difficult to map those fields to the proper model.submodel.fieldname. We will examine the results of a CI/CD test to make sure these edits did not alter any of the searches. pyth0n1c 2022-04-15 16:34:49 -07:00
  • f679263212 Moving over from a really old branch to one with current detections. This will let us keep the update tool and updated detections together. pyth0n1c 2022-04-15 15:40:29 -07:00
  • e3725e5d22 Quoted large number of strings in detections to address the problem of these strings, which are values, being misidentified by the tool as submodel.fieldname format. Committing these changes and reviewing automated testing to make sure none of these changes broke the detections. pyth0n1c 2022-04-15 15:23:04 -07:00
  • 403348f895 Progress towards validating individual fields. Huge number of false positives due to unquoted strings which will be addressed in the next series of commits. pyth0n1c 2022-04-15 14:46:23 -07:00
  • 12645e62db Properly pulling out and checking models and submodels. Properly pulling out fields, but not fully validating them yet. pyth0n1c 2022-04-15 13:58:12 -07:00
  • 66c316157b Remove newline char for readability Michael Radka 2022-04-15 11:46:01 -04:00
  • a8718b43ca test: added code to run pre-qa on schedule truptilangalia-crest 2022-04-14 17:40:52 +05:30
  • 91ba823a79 More progress towards properly architecting the required_fields_cleaner. pyth0n1c 2022-04-14 16:14:14 -07:00
  • 1df940a5e9 updating docs and package bits [ci skip] research bot 2022-04-14 22:03:48 +00:00
  • 13f572dd0f Branch was auto-updated. pyth0n1c 2022-04-14 13:55:52 -07:00