admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • 2698937b7e Branch was auto-updated. Bhavin Patel 2021-10-14 16:19:37 -07:00
  • ce313d15a0 Branch was auto-updated. Bhavin Patel 2021-10-14 16:19:36 -07:00
  • 1ec3227295 Branch was auto-updated. Bhavin Patel 2021-10-14 16:19:36 -07:00
  • f12e3270bf Merge pull request #1728 from splunk/docs_add_playbooks Lou Stella 2021-10-14 18:19:21 -05:00
  • 19f07cfc45 gtags fixed docs_add_playbooks divious1 2021-10-14 19:16:54 -04:00
  • 835df1fe56 Branch was auto-updated. Bhavin Patel 2021-10-14 15:45:26 -07:00
  • 44f285cf17 Branch was auto-updated. Bhavin Patel 2021-10-14 15:45:22 -07:00
  • 11919fda59 Branch was auto-updated. Bhavin Patel 2021-10-14 15:45:21 -07:00
  • a6f9041334 Branch was auto-updated. Bhavin Patel 2021-10-14 15:45:19 -07:00
  • 0dfa950441 Branch was auto-updated. Bhavin Patel 2021-10-14 15:45:17 -07:00
  • c0a1518148 Branch was auto-updated. Bhavin Patel 2021-10-14 15:45:13 -07:00
  • 2c4b3a19b4 Branch was auto-updated. Bhavin Patel 2021-10-14 15:45:12 -07:00
  • b737ccaf5c Branch was auto-updated. Bhavin Patel 2021-10-14 15:45:11 -07:00
  • 690087dd13 Branch was auto-updated. Bhavin Patel 2021-10-14 15:45:09 -07:00
  • 8cb34cee47 Branch was auto-updated. Bhavin Patel 2021-10-14 15:45:08 -07:00
  • c615b82513 Branch was auto-updated. Bhavin Patel 2021-10-14 15:45:07 -07:00
  • 5c369e7cfa Branch was auto-updated. Bhavin Patel 2021-10-14 15:45:06 -07:00
  • bfd6315783 Branch was auto-updated. Bhavin Patel 2021-10-14 15:45:03 -07:00
  • dc63c73593 Branch was auto-updated. Bhavin Patel 2021-10-14 15:45:02 -07:00
  • d80e9fa3da Merge pull request #1727 from splunk/docs_add_playbooks Jose Enrique Hernandez 2021-10-14 18:44:42 -04:00
  • f93111eef9 Merge branch 'docs_add_playbooks' of github.com:splunk/security_content into docs_add_playbooks divious1 2021-10-14 18:40:21 -04:00
  • 1b708e87e2 adding dynamic index divious1 2021-10-14 18:40:15 -04:00
  • 7f25e5ba35 Branch was auto-updated. Bhavin Patel 2021-10-14 15:29:07 -07:00
  • 688bcfb2ff Branch was auto-updated. Bhavin Patel 2021-10-14 15:29:06 -07:00
  • 7d60473dcd Branch was auto-updated. Bhavin Patel 2021-10-14 15:29:05 -07:00
  • 9357940da8 Update CNAME Jose Enrique Hernandez 2021-10-14 18:28:48 -04:00
  • 9f91279c51 Changed affected Registry.registry_value_name fields to Registry.registry_value_data and changed value from DWORD(0x...) to 0x... This probably does not cover all the detections that will need to be addressed in this fix, but is a good initial pass to see if the fixes and new TA are working properly. pyth0n1c 2021-10-14 14:58:03 -07:00
  • 3f01dc7409 Touched a number of detections to see if they fail with the current sysmon TA before testing against the sysmon TA update. pyth0n1c 2021-10-14 14:24:25 -07:00
  • 03db53cbdf finished playbook examples divious1 2021-10-14 14:48:48 -04:00
  • d600e55190 Merge branch 'develop' of github.com:splunk/security-content into tf23 Xiao Lin 2021-10-14 08:11:30 -07:00
  • 7c7583a169 Process_id to Process_guid mhaag-spl 2021-10-14 08:56:19 -06:00
  • 63b2266c04 CARS_UPDATE_MITRE_ID_B7 tccontre 2021-10-14 10:24:20 +02:00
  • a18d1c9aec Merge branch 'develop' of github.com:splunk/security_content into develop tccontre 2021-10-14 10:11:16 +02:00
  • b607f8a99d Some small config updates pyth0n1c 2021-10-13 12:31:02 -07:00
  • b90aa993cf Branch was auto-updated. Bhavin Patel 2021-10-13 05:54:02 -07:00
  • 984771a696 Branch was auto-updated. Bhavin Patel 2021-10-13 05:53:58 -07:00
  • aa4d233119 Branch was auto-updated. Bhavin Patel 2021-10-13 05:53:56 -07:00
  • c9fe91cc03 Branch was auto-updated. Bhavin Patel 2021-10-13 05:53:55 -07:00
  • 598624ed74 Branch was auto-updated. Bhavin Patel 2021-10-13 05:53:54 -07:00
  • 6d4c7fd19e Branch was auto-updated. Bhavin Patel 2021-10-13 05:53:53 -07:00
  • fce06ed262 Merge pull request #1700 from splunk/pterodactyl tccontre 2021-10-13 14:53:35 +02:00
  • af7ff4052e CARS_UPDATE_MITRE_ID_B6 tccontre 2021-10-13 11:24:10 +02:00
  • e0299db411 CARS_UPDATE_MITRE_ID_B5 tccontre 2021-10-13 11:20:47 +02:00
  • 14e3597bf4 CARS_UPDATE_MITRE_ID_B4 tccontre 2021-10-13 11:13:24 +02:00
  • da17a2a938 CARS_UPDATE_MITRE_ID_B3 tccontre 2021-10-13 11:07:20 +02:00
  • 8d0daf1040 CARS_UPDATE_MITRE_ID_B2 CARS_UPDATE_MITRE_ID_B2 tccontre 2021-10-13 10:50:36 +02:00
  • 0323ec0401 Merge branch 'develop' of github.com:splunk/security_content into develop tccontre 2021-10-13 09:24:30 +02:00
  • 583f24f559 working playbook collection d1vious 2021-10-12 21:06:53 -04:00
  • 1a131ead59 More changes for testing. Prep for long-term test of all detection with results output to file. pyth0n1c 2021-10-12 17:22:10 -07:00
  • 3488a5ebac playbook skeleton divious1 2021-10-12 19:41:23 -04:00
  • faf8da0a15 Merge branch 'develop' into ssa_aws_saml patel-bhavin 2021-10-12 15:44:22 -07:00
  • da1beedc71 data patel-bhavin 2021-10-12 15:25:50 -07:00
  • 3ef378c14f test patel-bhavin 2021-10-12 14:59:22 -07:00
  • 5e4b299c43 aws data manipulation patel-bhavin 2021-10-12 14:44:24 -07:00
  • 5d7d741898 Branch was auto-updated. Bhavin Patel 2021-10-12 14:01:29 -07:00
  • be69d68150 Merge pull request #1718 from splunk/devsecops_bug Michael Haag 2021-10-12 15:01:12 -06:00
  • fdeab27703 Branch was auto-updated. Bhavin Patel 2021-10-12 13:11:00 -07:00
  • 46b7d220cc Branch was auto-updated. Bhavin Patel 2021-10-12 13:10:59 -07:00
  • 08d172d13b Merge pull request #1716 from splunk/CARS_UPDATE_MITRE_ID_B1 Bhavin Patel 2021-10-12 13:10:40 -07:00
  • f67ee09979 revert deployments: - Send to Phantom Bhavin Patel 2021-10-12 13:08:33 -07:00
  • 05972240f4 story name patel-bhavin 2021-10-12 13:03:43 -07:00
  • 7dbacd0674 errors and text updates patel-bhavin 2021-10-12 13:02:16 -07:00
  • 3b2cb3f2ee Merge branch 'develop' into CARS_UPDATE_MITRE_ID_B1 Bhavin Patel 2021-10-12 11:14:31 -07:00
  • d2719d316e Update gsuite_drive_share_in_external_email.yml tccontre 2021-10-12 11:12:12 +02:00
  • eb02a97423 Merge branch 'develop' of github.com:splunk/security_content into develop tccontre 2021-10-12 09:29:19 +02:00
  • 2f06facd23 Lots of testing changes.... lots of progress. Need to clean up and test entire set of detections properly with sleeps and diagnose how long sleep should be or if there is a way to block while input data is processed entirely. pyth0n1c 2021-10-11 17:05:28 -07:00
  • 3cc1eee594 fixing up base on feedback divious1 2021-10-11 18:18:23 -04:00
  • 8c114abc1f Branch was auto-updated. Bhavin Patel 2021-10-11 12:56:24 -07:00
  • 0be2434332 Merge pull request #1717 from splunk/stay-haag Michael Haag 2021-10-11 13:56:06 -06:00
  • 95ad76f9ba Update suspicious_wevtutil_usage.yml mhaag-spl 2021-10-11 12:17:40 -06:00
  • 06a9c0f15e Lots more changes to how we run. Now based off of the splunk/splunk container on docker hub as much as possible. We use ENV arguments to install required apps. Still only at 50% pass rate, so we need more troubleshooting to figure out why. pyth0n1c 2021-10-11 10:23:42 -07:00
  • b6f201a846 Branch was auto-updated. Bhavin Patel 2021-10-11 03:30:23 -07:00
  • ff5189357c Merge pull request #1690 from splunk/privilege_escalation_persistence tccontre 2021-10-11 12:29:56 +02:00
  • e564e5a9f2 Delete screensaver_event_trigger_execution.test.yml tccontre 2021-10-11 11:05:42 +02:00
  • cd46d4cf61 Delete screensaver_event_trigger_execution.yml tccontre 2021-10-11 11:05:34 +02:00
  • 8a1bed2fb9 CARS_UPDATE_MITRE_ID_B1 tccontre 2021-10-11 11:03:20 +02:00
  • 4df1fbd911 cars_mitre_id_update_1 cars_mitre_id_update_1 tccontre 2021-10-11 10:35:14 +02:00
  • 0dd192b623 Delete screensaver_event_trigger_execution.yml es_mitre_id_update-cars tccontre 2021-10-11 10:27:40 +02:00
  • 93172e8214 Delete registry_keys_used_for_persistence.yml tccontre 2021-10-11 10:27:26 +02:00
  • 4abd3cbd7d Delete screensaver_event_trigger_execution.test.yml tccontre 2021-10-11 10:27:12 +02:00
  • 22d00df56a cars_mitre_id_update_1 tccontre 2021-10-11 09:58:33 +02:00
  • 50c45da030 Merge branch 'develop' of github.com:splunk/security-content into tf23 Xiao Lin 2021-10-09 08:22:12 -07:00
  • 69d72deb15 Delete powershell_reflective_load.test.yml mhaag-spl 2021-10-08 12:37:20 -06:00
  • f6804d708b Fixes and removed duplicate mhaag-spl 2021-10-08 12:33:23 -06:00
  • b371bc5b5d Merge branch 'develop' of github.com:splunk/security_content into develop tccontre 2021-10-08 14:49:55 +02:00
  • 5226dbd99c privilege_escalation_persistence tccontre 2021-10-08 14:23:55 +02:00
  • 393aad02aa Added detection testing service results inETW Registry Disabled root 2021-10-08 07:55:48 +00:00
  • 3f161640cc Bump protobuf from 3.17.0 to 3.18.1 dependabot[bot] 2021-10-07 22:33:56 +00:00
  • 8a09315e93 Merge pull request #1694 from splunk/dependabot/pip/jsonschema-4.0.1 Bhavin Patel 2021-10-07 15:33:28 -07:00
  • 1d21924935 Merge pull request #1708 from splunk/removing_my_name_from_docs Bhavin Patel 2021-10-07 15:33:03 -07:00
  • 038206d836 Branch was auto-updated. removing_my_name_from_docs Bhavin Patel 2021-10-07 15:26:33 -07:00
  • 735883dc0a Merge pull request #1703 from splunk/sec-researcher_duplicate Bhavin Patel 2021-10-07 15:26:17 -07:00
  • 6da13a75c5 Merge branch 'develop' into removing_my_name_from_docs patel-bhavin 2021-10-07 15:22:55 -07:00
  • 9478681c7f removing name divious1 2021-10-07 14:54:45 -04:00
  • 87e17c3505 privilege_escalation_persistence tccontre 2021-10-07 14:53:56 +02:00
  • a9a2c05c9c Branch was auto-updated. Bhavin Patel 2021-10-06 16:03:18 -07:00
  • 24b0173f44 Branch was auto-updated. Bhavin Patel 2021-10-06 16:03:17 -07:00
  • 87018e6d13 Branch was auto-updated. Bhavin Patel 2021-10-06 16:03:16 -07:00
  • 1fc61adef1 Branch was auto-updated. Bhavin Patel 2021-10-06 16:03:16 -07:00
  • e32c95a93b Branch was auto-updated. Bhavin Patel 2021-10-06 16:03:15 -07:00