admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • 7d8e5e3973 fixrs Rod Soto 2022-01-12 08:03:39 -08:00
  • f4bcc6b1c4 fixedrisk Rod Soto 2022-01-12 07:59:08 -08:00
  • c263ef4ac5 Merge branch 'nixpost' of github.com:splunk/security_content into nixpost Rod Soto 2022-01-12 07:47:54 -08:00
  • 5f71b501f2 addedmacros Rod Soto 2022-01-12 07:47:14 -08:00
  • 3d75e6df52 Added detection testing service results inLinux NOPASSWD Entry In Sudoers File root 2022-01-12 09:22:22 +00:00
  • 6f09d650c8 Merge branch 'linux_persist_priv_batch_5' of https://github.com/splunk/security_content into linux_persist_priv_batch_5 Detection Testing Service 2022-01-12 08:55:53 +00:00
  • 0ac29166d0 Added detection testing service results inLinux Possible Access Or Modification Of sshd_config File root 2022-01-12 08:55:52 +00:00
  • fc0719eda4 Added detection testing service results inLinux Possible Ssh Key File Creation root 2022-01-12 08:52:58 +00:00
  • c67ba4f10c Branch was auto-updated. pyth0n1c 2022-01-12 00:13:37 -08:00
  • 7ae4e2e894 Branch was auto-updated. pyth0n1c 2022-01-12 00:13:36 -08:00
  • fee241a394 Branch was auto-updated. pyth0n1c 2022-01-12 00:13:35 -08:00
  • 9e969059d5 Branch was auto-updated. pyth0n1c 2022-01-12 00:13:34 -08:00
  • 0ead4203ba Branch was auto-updated. pyth0n1c 2022-01-12 00:13:33 -08:00
  • 3f82d075e1 Branch was auto-updated. pyth0n1c 2022-01-12 00:13:32 -08:00
  • 1ecc215773 Branch was auto-updated. pyth0n1c 2022-01-12 00:13:31 -08:00
  • ace2f35fd6 Branch was auto-updated. pyth0n1c 2022-01-12 00:13:31 -08:00
  • ec5b3ff482 Branch was auto-updated. pyth0n1c 2022-01-12 00:13:27 -08:00
  • 4eaf33adaa Branch was auto-updated. pyth0n1c 2022-01-12 00:13:25 -08:00
  • b24ec7dc20 Branch was auto-updated. pyth0n1c 2022-01-12 00:13:25 -08:00
  • 4073b95fae Merge pull request #1923 from splunk/linux_persist_priv_batch_4 tccontre 2022-01-12 09:13:04 +01:00
  • b9f44d9b2d linux_persist_priv_batch_5 tccontre 2022-01-12 09:12:43 +01:00
  • 4d9349084e Changed to run nightly on develop and changes on other branches for pushes and PRs. pyth0n1c 2022-01-11 16:37:03 -08:00
  • 7b3029b187 Removed splunkbase-only test_config file. Pushing to run a test on all. Will push again for changes only. pyth0n1c 2022-01-11 16:35:19 -08:00
  • 23da2f45d2 removing file that was accidentally added. pyth0n1c 2022-01-11 16:06:47 -08:00
  • e3ba9f0074 Finished removing dead code from DataManipulation. Added the new_sysmon as an additional default application. While it is not ideal to have the old and new sysmons installed side by side, there are some detection that only work with one and not the other. We will run both until we have moved all detections to the new sysmon. pyth0n1c 2022-01-11 16:03:04 -08:00
  • 6a6bd04819 Removing some dead code from DataManipulation.py pyth0n1c 2022-01-11 15:46:38 -08:00
  • e8b6be29c7 yml changes and testing patel-bhavin 2022-01-11 15:44:16 -08:00
  • 14461f46ff modifying window Lou Stella 2022-01-11 16:44:49 -06:00
  • 79d13fccef Converted DataManipulation from using FileInput to with open, readline, etc. We needed to do this because FileInput with inplace=True remaps the print command, which may be called by several parallel threads running DataManipulation or to output status info, will cause a crash if multiple threads write to it. pyth0n1c 2022-01-11 14:18:04 -08:00
  • 29cb276dec control_rundll32 update mhaag-spl 2022-01-11 13:16:22 -07:00
  • d4b1b48d5d Cred Dump mhaag-spl 2022-01-11 13:14:35 -07:00
  • 81df4e0eec A bunch of changes to support parallel testing and waiting to ensure data has been properly ingested/indexed before running a test. Still double-checking edge cases for this. Also improved some error printouts and status printouts. When a test completes, it now includes its runtime in its pass/fail/error print. pyth0n1c 2022-01-11 11:59:26 -08:00
  • e7f1eff711 fixing field names Lou Stella 2022-01-11 13:16:19 -06:00
  • 0535389f23 Tweaked detection Lou Stella 2022-01-11 12:44:08 -06:00
  • b1a285b483 Renamed test Lou Stella 2022-01-11 11:34:26 -06:00
  • ffb734456a Merge branch 'develop' into refactored_security_content P4T12ICK 2022-01-11 16:01:07 +01:00
  • a8f1d083f8 WIP rewrite scripts P4T12ICK 2022-01-11 15:59:57 +01:00
  • 1bffb74009 Update linux_possible_append_command_to_profile_config_file.yml tccontre 2022-01-11 12:03:24 +01:00
  • 95be27a041 Update linux_nopasswd_entry_in_sudoers_file.yml tccontre 2022-01-11 12:01:47 +01:00
  • 8a3b86d5c2 linux_persist_priv_batch_5 tccontre 2022-01-11 11:57:38 +01:00
  • 60edc89fdc Added detection testing service results inLinux Common Process For Elevation Control root 2022-01-11 10:30:16 +00:00
  • 0770e7b2a1 Merge branch 'linux_persist_priv_batch_4' of github.com:splunk/security_content into linux_persist_priv_batch_4 tccontre 2022-01-11 11:09:54 +01:00
  • ec7e006abb linux_persist_priv_batch_4 tccontre 2022-01-11 11:09:41 +01:00
  • d4259f39ef Added detection testing service results inLinux Possible Access To Sudoers File root 2022-01-11 09:12:52 +00:00
  • c8204ce55c Branch was auto-updated. pyth0n1c 2022-01-10 17:05:41 -08:00
  • 9b4d5c826d Branch was auto-updated. pyth0n1c 2022-01-10 17:05:40 -08:00
  • d6887793f5 Branch was auto-updated. DetectionTestingDocker pyth0n1c 2022-01-10 17:05:39 -08:00
  • f90a1e0d2e Branch was auto-updated. pyth0n1c 2022-01-10 17:05:38 -08:00
  • fc8c2ed9d8 Branch was auto-updated. pyth0n1c 2022-01-10 17:05:36 -08:00
  • ddb9addb69 Branch was auto-updated. pyth0n1c 2022-01-10 17:05:35 -08:00
  • 83d36b4f12 Branch was auto-updated. pyth0n1c 2022-01-10 17:05:33 -08:00
  • e4265d014b Branch was auto-updated. pyth0n1c 2022-01-10 17:05:30 -08:00
  • 9efdb65b73 Branch was auto-updated. pyth0n1c 2022-01-10 17:05:29 -08:00
  • c11cb4e5e8 Branch was auto-updated. pyth0n1c 2022-01-10 17:05:27 -08:00
  • 68af8de4fe Branch was auto-updated. pyth0n1c 2022-01-10 17:05:26 -08:00
  • dccafa2887 Merge pull request #1902 from splunk/linux_persist_priv_batch_1 Bhavin Patel 2022-01-10 17:05:10 -08:00
  • b44fe4b8d8 text and yml updates patel-bhavin 2022-01-10 16:59:08 -08:00
  • 14a775b185 Merge branch 'linux_persist_priv_batch_4' of https://github.com/splunk/security_content into linux_persist_priv_batch_4 Detection Testing Service 2022-01-11 00:54:52 +00:00
  • d7d8acaced Added detection testing service results inLinux Sudo OR Su Execution root 2022-01-11 00:54:51 +00:00
  • ba46f791bb Added detection testing service results inLinux Possible Access To Credential Files root 2022-01-11 00:51:50 +00:00
  • d2e1c021c1 Merge branch 'develop' of github.com:splunk/security-content into tf23 Xiao Lin 2022-01-10 16:50:28 -08:00
  • 3a82eaf972 Merge branch 'linux_persist_priv_batch_4' of https://github.com/splunk/security_content into linux_persist_priv_batch_4 Detection Testing Service 2022-01-11 00:12:46 +00:00
  • fbc5e53407 Added detection testing service results inLinux Doas Tool Execution root 2022-01-11 00:12:45 +00:00
  • eeff9d94b2 Added detection testing service results inLinux Doas Conf File Creation root 2022-01-11 00:11:47 +00:00
  • 2670d58f50 Massive commit - the field and datamodel update tool has updated almost all of our detections. We will commit and then run a test on everything to see if we broke any searches. pyth0n1c 2022-01-10 15:58:14 -08:00
  • 745e918176 Added detection testing service results inLinux Add User Account root 2022-01-10 23:51:42 +00:00
  • 7effe85ae2 Previous commit overwrote things we did not want to, like fields besides required_fields in the tags section. Now we are more careful. pyth0n1c 2022-01-10 15:50:17 -08:00
  • 3df196b43d Updated code to make changes to files after scanning. pyth0n1c 2022-01-10 15:43:23 -08:00
  • 2d3acc2019 moved detections to deprecated d1vious 2022-01-10 18:11:10 -05:00
  • ede5fd35af moving ssa detection deprecated d1vious 2022-01-10 18:06:45 -05:00
  • 17d7312bc6 excluding experimental detections from the package d1vious 2022-01-10 18:00:59 -05:00
  • 97e9cda0ca We now properly complete the required_fields under tags. We just need to write this data back out to the relevant files. pyth0n1c 2022-01-10 14:52:02 -08:00
  • ce2f362f6e Merge branch 're-org-ssa' of github.com:splunk/security_content into re-org-ssa d1vious 2022-01-10 17:46:03 -05:00
  • 2197a6986c removed deprecated detections from ssa package d1vious 2022-01-10 17:45:57 -05:00
  • be8e1fcf20 Branch was auto-updated. pyth0n1c 2022-01-10 14:37:38 -08:00
  • d6f11d7b10 Branch was auto-updated. pyth0n1c 2022-01-10 14:37:37 -08:00
  • 7950965990 Branch was auto-updated. pyth0n1c 2022-01-10 14:37:36 -08:00
  • 3c78109648 Branch was auto-updated. pyth0n1c 2022-01-10 14:37:35 -08:00
  • db7ed0bde3 Branch was auto-updated. pyth0n1c 2022-01-10 14:37:34 -08:00
  • e4ff3a1f20 Branch was auto-updated. pyth0n1c 2022-01-10 14:37:33 -08:00
  • f11db775c7 Branch was auto-updated. pyth0n1c 2022-01-10 14:37:32 -08:00
  • c508820126 Branch was auto-updated. pyth0n1c 2022-01-10 14:37:31 -08:00
  • b309725945 Branch was auto-updated. pyth0n1c 2022-01-10 14:37:29 -08:00
  • c92ea748b9 Branch was auto-updated. pyth0n1c 2022-01-10 14:37:28 -08:00
  • 2a0e8ca13d Branch was auto-updated. pyth0n1c 2022-01-10 14:37:27 -08:00
  • 626f228bb6 Branch was auto-updated. pyth0n1c 2022-01-10 14:37:26 -08:00
  • 2b00ccf154 Merge pull request #1918 from splunk/linux_persist_priv_batch_3 Bhavin Patel 2022-01-10 14:37:05 -08:00
  • a8d236c1c2 test results passed from CI patel-bhavin 2022-01-10 13:22:24 -08:00
  • 69c2787e51 text updates patel-bhavin 2022-01-10 13:21:39 -08:00
  • 233a5670c8 Branch was auto-updated. pyth0n1c 2022-01-10 13:06:35 -08:00
  • d322408d84 Branch was auto-updated. pyth0n1c 2022-01-10 13:06:33 -08:00
  • 8082c5b031 Branch was auto-updated. pyth0n1c 2022-01-10 13:06:32 -08:00
  • a27af2372b Branch was auto-updated. pyth0n1c 2022-01-10 13:06:29 -08:00
  • 4bc8539d78 Branch was auto-updated. pyth0n1c 2022-01-10 13:06:27 -08:00
  • 4a4f99e7a9 Branch was auto-updated. pyth0n1c 2022-01-10 13:06:26 -08:00
  • c76e167d05 Branch was auto-updated. pyth0n1c 2022-01-10 13:06:25 -08:00
  • a2732c6644 Branch was auto-updated. pyth0n1c 2022-01-10 13:06:24 -08:00
  • eff3b414f5 Branch was auto-updated. pyth0n1c 2022-01-10 13:06:23 -08:00
  • efe19be3e0 Branch was auto-updated. pyth0n1c 2022-01-10 13:06:21 -08:00
  • 416b961f10 Branch was auto-updated. pyth0n1c 2022-01-10 13:06:20 -08:00