admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • 37f4a32647 Added detection testing service results inServices.exe LOLBAS Execution Process Spawn root 2021-11-23 22:39:17 +00:00
  • dab746bb0c Save out a json file showing the config, to include the command line arguments with credentials removed, whenever a test is actually run. This makes it trivial to reproduce the test run on another machine or again on the same machine. pyth0n1c 2021-11-23 14:30:54 -08:00
  • c2fd0a4b29 adding dataset fields mvelazco 2021-11-23 17:15:06 -05:00
  • 190c0cba21 Merge branch 'TR-1085_LateralMovement_3' of github.com:splunk/security_content into TR-1085_LateralMovement_3 mvelazco 2021-11-23 16:00:06 -05:00
  • 5211a97f11 update detections mvelazco 2021-11-23 16:00:04 -05:00
  • 914f49d6f7 Delete intermediate testing artifacts/container config files in CI. Better job packaging all local apps, not just escu, into the same folder for --mock. pyth0n1c 2021-11-23 11:59:01 -08:00
  • c8c731e449 Added detection testing service results inWindows Service Created With Suspicious Service Path root 2021-11-23 19:20:48 +00:00
  • 4c696f9ad8 updating detections mvelazco 2021-11-23 14:01:28 -05:00
  • 9b944b67a2 adding 4 new detections mvelazco 2021-11-23 10:13:07 -05:00
  • 8cf8efb30f SSA anommalous usage of archive tools P4T12ICK 2021-11-23 13:05:00 +01:00
  • 4d6e83bd25 SSA anommalous usage of archive tools P4T12ICK 2021-11-23 12:46:02 +01:00
  • 83576ecb74 more_ioc_detections tccontre 2021-11-23 11:56:00 +01:00
  • e48bf8c257 SSA anommalous usage of archive tools P4T12ICK 2021-11-23 10:14:50 +01:00
  • 3cd1e42ada Huge refactor is almost complete. Able to launch and run multiple containers now as intended pyth0n1c 2021-11-22 16:36:21 -08:00
  • f2a7006482 Merge branch 'TR-1085_LateralMovement_3' of github.com:splunk/security_content into TR-1085_LateralMovement_3 mvelazco 2021-11-22 16:21:46 -05:00
  • 8c2baf103e creating an extra detection mvelazco 2021-11-22 16:21:43 -05:00
  • bbd0970404 Merge branch 'develop' of github.com:splunk/security-content into tf23 Xiao Lin 2021-11-22 12:54:48 -08:00
  • 8482d30656 Added detection testing service results inPossible Browser Pass View Parameter root 2021-11-22 14:44:57 +00:00
  • 04c433eedf more_ioc_detections tccontre 2021-11-22 15:09:53 +01:00
  • 3b2bb44e91 more_ioc_detections tccontre 2021-11-22 12:39:31 +01:00
  • a1bee25acb Branch was auto-updated. Bhavin Patel 2021-11-22 02:53:47 -08:00
  • 3f9f549d03 Branch was auto-updated. Bhavin Patel 2021-11-22 02:53:46 -08:00
  • fe491600d5 Branch was auto-updated. Bhavin Patel 2021-11-22 02:53:45 -08:00
  • 1449f7c6f1 Branch was auto-updated. Bhavin Patel 2021-11-22 02:53:44 -08:00
  • a60798b203 Branch was auto-updated. Bhavin Patel 2021-11-22 02:53:43 -08:00
  • 563f19fea1 Branch was auto-updated. Bhavin Patel 2021-11-22 02:53:40 -08:00
  • ae506e8798 Branch was auto-updated. Bhavin Patel 2021-11-22 02:53:39 -08:00
  • 2ee09fbceb Merge pull request #1836 from splunk/ssa_insider_secure_delete P4T12ICK 2021-11-22 11:53:20 +01:00
  • 8b174b9967 small change ssa_insider_secure_delete P4T12ICK 2021-11-22 11:07:10 +01:00
  • 45e691bd0d ssa_sdelete tccontre 2021-11-22 10:39:45 +01:00
  • 3fab3cd88e Merge branch 'develop' into ssa_minor_update P4T12ICK 2021-11-22 10:32:13 +01:00
  • 6d4afce3ea Branch was auto-updated. Bhavin Patel 2021-11-22 01:30:08 -08:00
  • 99e967252a Branch was auto-updated. Bhavin Patel 2021-11-22 01:30:04 -08:00
  • 6c8752431c Branch was auto-updated. Bhavin Patel 2021-11-22 01:30:03 -08:00
  • 07d7b120bf Branch was auto-updated. Bhavin Patel 2021-11-22 01:30:02 -08:00
  • 4d5e291714 Branch was auto-updated. Bhavin Patel 2021-11-22 01:30:00 -08:00
  • ff4c8a27d5 Merge pull request #1840 from splunk/ssa_improved_testing_pipeline P4T12ICK 2021-11-22 10:29:41 +01:00
  • 3f1b025908 Mock is now working and splits the tests as intended. Appropriate mock config.json files are created, validated, and written. pyth0n1c 2021-11-19 17:07:27 -08:00
  • 6a9b5504aa Converted the app listings in the jsonschema from arrays to dicts. they are easier to search for apps that way. also some more testing of the escu app building and persist_security_content. looking good. pyth0n1c 2021-11-19 16:06:04 -08:00
  • c0bdcc6c31 Successful behavior generating escu package regardless of whether --persist-security-content is passed pyth0n1c 2021-11-19 14:38:45 -08:00
  • bc4a4c0f45 More changes around the generation of the ESCU package and testing around persist_security_content option. pyth0n1c 2021-11-19 14:19:14 -08:00
  • afc5bf9a9a Added detection testing service results inImpacket Lateral Movement Commandline Parameters root 2021-11-19 22:16:55 +00:00
  • d679eeef45 Update ssa___sdelete_application_execution.yml mhaag-spl 2021-11-19 14:54:26 -07:00
  • 6df7df2622 adding first detection mvelazco 2021-11-19 16:40:04 -05:00
  • dab01c7d47 Update ssa___sdelete_application_execution.yml mhaag-spl 2021-11-19 14:29:11 -07:00
  • 53b01c192f More changes to the detection_testing_exeuction file and arg validation file to make it simpler. pyth0n1c 2021-11-19 13:00:23 -08:00
  • 844435a821 Added a field to the jsonschema and renamed another field (types and folders). Continuing to rework the main detection_testing file. pyth0n1c 2021-11-19 11:21:31 -08:00
  • a6ee98620d user login update patel-bhavin 2021-11-19 11:18:36 -08:00
  • bbc913faaa first 3 detections patel-bhavin 2021-11-19 11:16:11 -08:00
  • 902a20aa01 Branch was auto-updated. Bhavin Patel 2021-11-19 10:08:05 -08:00
  • 299fc9cece Branch was auto-updated. Bhavin Patel 2021-11-19 10:08:00 -08:00
  • cb5a91844b Branch was auto-updated. Bhavin Patel 2021-11-19 10:07:58 -08:00
  • 8bf462e1d5 Branch was auto-updated. Bhavin Patel 2021-11-19 10:07:57 -08:00
  • 12a90ea8dd Branch was auto-updated. Bhavin Patel 2021-11-19 10:07:56 -08:00
  • c23dd9d42f Branch was auto-updated. Bhavin Patel 2021-11-19 10:07:55 -08:00
  • 3d23351cf3 Branch was auto-updated. Bhavin Patel 2021-11-19 10:07:54 -08:00
  • 8ef8da6d06 Merge pull request #1834 from splunk/TR-1085_LateralMovement_2 pyth0n1c 2021-11-19 10:07:34 -08:00
  • 3c30d92096 Branch was auto-updated. Bhavin Patel 2021-11-19 10:01:26 -08:00
  • 9342a79271 Branch was auto-updated. Bhavin Patel 2021-11-19 10:01:25 -08:00
  • 92dbd495ed Branch was auto-updated. Bhavin Patel 2021-11-19 10:01:24 -08:00
  • dec78407c1 Branch was auto-updated. Bhavin Patel 2021-11-19 10:01:24 -08:00
  • 08f181d4d3 Branch was auto-updated. Bhavin Patel 2021-11-19 10:01:23 -08:00
  • 3d3f5836e7 Branch was auto-updated. Bhavin Patel 2021-11-19 10:01:21 -08:00
  • 0724c34ac3 Branch was auto-updated. Bhavin Patel 2021-11-19 10:01:16 -08:00
  • 568af8275c Branch was auto-updated. Bhavin Patel 2021-11-19 10:01:15 -08:00
  • f123e73be6 Merge pull request #1800 from splunk/TR-1085_LateralMovement pyth0n1c 2021-11-19 10:00:57 -08:00
  • e94ed3f223 Branch was auto-updated. Bhavin Patel 2021-11-19 03:56:35 -08:00
  • 7f1521b24e Branch was auto-updated. Bhavin Patel 2021-11-19 03:56:34 -08:00
  • 284dccd8f6 Branch was auto-updated. Bhavin Patel 2021-11-19 03:56:33 -08:00
  • 94c941342e Branch was auto-updated. Bhavin Patel 2021-11-19 03:56:29 -08:00
  • efc1ec4d91 Branch was auto-updated. Bhavin Patel 2021-11-19 03:56:27 -08:00
  • 0d904638f7 Branch was auto-updated. Bhavin Patel 2021-11-19 03:56:26 -08:00
  • ec1c5d9d54 Branch was auto-updated. Bhavin Patel 2021-11-19 03:56:25 -08:00
  • 63ea949fa9 Branch was auto-updated. Bhavin Patel 2021-11-19 03:56:24 -08:00
  • 6404c7f7a3 Branch was auto-updated. Bhavin Patel 2021-11-19 03:56:23 -08:00
  • de15a819bb Merge pull request #1842 from splunk/ssa_fix_datasets P4T12ICK 2021-11-19 12:56:04 +01:00
  • 27d981717d fix broken dataset links P4T12ICK 2021-11-19 12:49:53 +01:00
  • 126a514ab3 Added detection testing service results inSystem Info Gathering Using Dxdiag Application root 2021-11-19 11:24:14 +00:00
  • ce6318c87b more_ioc_detections tccontre 2021-11-19 12:01:45 +01:00
  • 04cbf7beaa improved testing P4T12ICK 2021-11-19 11:30:43 +01:00
  • 7223d1167a improved testing P4T12ICK 2021-11-19 10:43:59 +01:00
  • 697b15e41b improved testing P4T12ICK 2021-11-19 10:18:36 +01:00
  • 4d32809923 improved testing P4T12ICK 2021-11-19 09:58:55 +01:00
  • 3d3fe05447 improved testing P4T12ICK 2021-11-19 09:56:54 +01:00
  • 05657d48df Branch was auto-updated. Bhavin Patel 2021-11-19 00:38:45 -08:00
  • f9b37ff8ab Branch was auto-updated. Bhavin Patel 2021-11-19 00:38:44 -08:00
  • 8493dca184 Branch was auto-updated. Bhavin Patel 2021-11-19 00:38:43 -08:00
  • b67d5cdc84 Branch was auto-updated. Bhavin Patel 2021-11-19 00:38:41 -08:00
  • e1bd020e51 Branch was auto-updated. Bhavin Patel 2021-11-19 00:38:36 -08:00
  • 63eaf77d49 Branch was auto-updated. Bhavin Patel 2021-11-19 00:38:35 -08:00
  • 2f534f53d9 Branch was auto-updated. Bhavin Patel 2021-11-19 00:38:34 -08:00
  • dda5f844f0 Merge pull request #1838 from splunk/ioc_detections tccontre 2021-11-19 09:38:15 +01:00
  • 1f5386b776 Mostly done with overhaul to arguments. Initial testing show that it looks good. Now to integrate the newly parsed arguments in with the rewritten run behavior. pyth0n1c 2021-11-18 16:56:46 -08:00
  • aca21ef285 Changes to the interface used to construct the config file and perform additional validation of the file pyth0n1c 2021-11-18 15:44:01 -08:00
  • a9f6b03646 Merge branch 'TR-1085_LateralMovement_2' of github.com:splunk/security_content into TR-1085_LateralMovement_2 mvelazco 2021-11-18 16:26:34 -05:00
  • 399ebb4e7f adding extra detection mvelazco 2021-11-18 16:26:32 -05:00
  • 0b568f6169 Merge branch 'TR-1085_LateralMovement_2' of https://github.com/splunk/security_content into TR-1085_LateralMovement_2 Detection Testing Service 2021-11-18 21:05:53 +00:00
  • f18afbbd8c Added detection testing service results inExecutable File Written in Administrative SMB Share root 2021-11-18 21:05:53 +00:00
  • cf8d5f2dff Much better configuration parsing, validation, and substitution of defaults using jsonschema. pyth0n1c 2021-11-18 13:01:55 -08:00
  • a86c908630 Branch was auto-updated. Bhavin Patel 2021-11-18 12:58:51 -08:00