admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • 493ad40df5 minor issue with playbooks linking divious1 2021-09-20 19:09:09 -04:00
  • 3f5b30a8b2 working stories divious1 2021-09-20 18:35:03 -04:00
  • a22ca80392 Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm Detection Testing Service 2021-09-20 18:59:09 +00:00
  • c904226897 Added detection testing service results inDetect Renamed RClone root 2021-09-20 18:59:08 +00:00
  • 3c072fa9bb Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm Detection Testing Service 2021-09-20 18:57:35 +00:00
  • e82ed3d21d Added detection testing service results inDetect Renamed 7-Zip root 2021-09-20 18:57:34 +00:00
  • 2694a29473 Added detection testing service results inDetect Renamed PSExec root 2021-09-20 18:57:27 +00:00
  • 628fe8f257 removing originalfilename artifacts mhaag-spl 2021-09-20 12:37:32 -06:00
  • 7384541200 working navigation, updated detection listing and index pages divious1 2021-09-20 14:30:43 -04:00
  • cd70758c21 Added detection testing service results inOffice Document Spawned Child Process To Download root 2021-09-20 18:21:07 +00:00
  • ea9cfddf1c Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm mhaag-spl 2021-09-20 12:05:19 -06:00
  • f30a4c6997 Re-added rebuild code for full test. pyth0n1c 2021-09-20 11:05:17 -07:00
  • 8a2401bedf Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm Detection Testing Service 2021-09-20 18:05:06 +00:00
  • 70e1c9a454 Update office_document_spawned_child_process_to_download.yml mhaag-spl 2021-09-20 12:05:05 -06:00
  • 7ed4be864e Added detection testing service results inSuspicious SearchProtocolHost no Command Line Arguments root 2021-09-20 18:05:05 +00:00
  • 0cd2cd850f Duplicate folder names were clobbering each other. Also commented around initial steps to speed up testing time. We will re use the docker containers that we initially built each time for testing. pyth0n1c 2021-09-20 11:01:06 -07:00
  • 479384a6c1 Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm Detection Testing Service 2021-09-20 17:58:13 +00:00
  • 28f03fcbcd Added detection testing service results inSuspicious Rundll32 with no Command Line Arguments root 2021-09-20 17:58:12 +00:00
  • 7d3c68faa1 Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm Detection Testing Service 2021-09-20 17:54:58 +00:00
  • 9373763ea3 Added detection testing service results inSuspicious GPUpdate no Command Line Arguments root 2021-09-20 17:54:58 +00:00
  • 583db3e726 Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm Detection Testing Service 2021-09-20 17:51:29 +00:00
  • 0a34def1b3 Added detection testing service results inSuspicious DLLHost no Command Line Arguments root 2021-09-20 17:51:28 +00:00
  • 0718d28f83 Update suspicious_searchprotocolhost_no_command_line_arguments.yml mhaag-spl 2021-09-20 11:42:34 -06:00
  • 14f9bea865 mwc hunting and rundll32 fix mhaag-spl 2021-09-20 11:39:40 -06:00
  • 4096b496a5 Update suspicious_gpupdate_no_command_line_arguments.yml mhaag-spl 2021-09-20 11:34:25 -06:00
  • 4320d4ab5b Update suspicious_dllhost_no_command_line_arguments.yml mhaag-spl 2021-09-20 11:32:31 -06:00
  • 5d2d0384e3 Added detection testing service results inDetect regsvcs with no Command Line Arguments root 2021-09-20 17:21:26 +00:00
  • 75109143ca Paths to new tests ... Stanislav Miskovic 2021-09-20 10:20:33 -07:00
  • e07d94f396 regsvcs regasm mhaag-spl 2021-09-20 11:02:20 -06:00
  • 2bf10d4a33 Added detection testing service results inDetect Regasm with no Command Line Arguments root 2021-09-20 16:58:10 +00:00
  • 81183b661c Update detect_regasm_with_no_command_line_arguments.yml mhaag-spl 2021-09-20 10:37:57 -06:00
  • 958e195593 Update searchprotocolhost_with_no_command_line_with_network.yml mhaag-spl 2021-09-20 10:05:07 -06:00
  • 8831bec3a3 detection page d1vious 2021-09-20 10:30:24 -04:00
  • 6515c861f5 Merge branch 'fancy_docs' of github.com:splunk/security_content into fancy_docs d1vious 2021-09-20 10:08:12 -04:00
  • 05d99143ef adding detection page generation d1vious 2021-09-20 10:08:05 -04:00
  • 74795ed35c Merge branch 'fin7' of https://github.com/splunk/security_content into fin7 Detection Testing Service 2021-09-20 13:42:55 +00:00
  • f4d532b6a2 Added detection testing service results inMS Scripting Process Loading Ldap Module root 2021-09-20 13:42:55 +00:00
  • 5d8af6f242 Added detection testing service results inMS Scripting Process Loading WMI Module root 2021-09-20 13:41:30 +00:00
  • 5a70382466 fin7 tccontre 2021-09-20 15:21:53 +02:00
  • f22bd1b018 Merge branch 'fin7' of github.com:splunk/security_content into fin7 tccontre 2021-09-20 12:22:34 +02:00
  • 4ed026fa35 fin7 tccontre 2021-09-20 12:22:12 +02:00
  • 42870099f3 Branch was auto-updated. Bhavin Patel 2021-09-20 02:43:17 -07:00
  • 6b21a64401 Branch was auto-updated. Bhavin Patel 2021-09-20 02:43:15 -07:00
  • ad20c36ef7 Branch was auto-updated. Bhavin Patel 2021-09-20 02:43:12 -07:00
  • bc4f3b9086 Branch was auto-updated. Bhavin Patel 2021-09-20 02:43:10 -07:00
  • 45540c2590 Branch was auto-updated. Bhavin Patel 2021-09-20 02:43:07 -07:00
  • 4fdabd1594 Branch was auto-updated. Bhavin Patel 2021-09-20 02:43:05 -07:00
  • df7d90e29b Branch was auto-updated. Bhavin Patel 2021-09-20 02:43:02 -07:00
  • 965fd8885c Branch was auto-updated. Bhavin Patel 2021-09-20 02:43:00 -07:00
  • 9a44abe15a Branch was auto-updated. Bhavin Patel 2021-09-20 02:42:59 -07:00
  • ef7b45ad57 Branch was auto-updated. Bhavin Patel 2021-09-20 02:42:56 -07:00
  • fe9b9ae95a Branch was auto-updated. Bhavin Patel 2021-09-20 02:42:55 -07:00
  • 4bc768a8c0 Branch was auto-updated. Bhavin Patel 2021-09-20 02:42:53 -07:00
  • 760328df2c Merge pull request #1644 from splunk/dev_sec_ops_work P4T12ICK 2021-09-20 11:42:33 +02:00
  • bbcaf7a93b fin7 tccontre 2021-09-20 11:37:07 +02:00
  • 6e0789be3e fin7 tccontre 2021-09-20 11:35:38 +02:00
  • 549b58e34c merged with develop P4T12ICK 2021-09-20 11:16:05 +02:00
  • 5b41aaaa58 merged with develop P4T12ICK 2021-09-20 11:15:23 +02:00
  • 0b7a836e43 fin7 tccontre 2021-09-20 10:33:09 +02:00
  • 15e5352e71 Merge branch 'develop' of github.com:splunk/security-content into tf23 Xiao Lin 2021-09-20 01:25:56 -07:00
  • ba78e372e2 Changed a port back to the original since it's run inside the docker container as part of a playbook pyth0n1c 2021-09-17 18:12:02 -07:00
  • 370ea6df6c cleaned up detection display, added testing notes divious1 2021-09-17 21:07:16 -04:00
  • 2a3e220249 Made the splunk management port dynamic for uploading replay data. pyth0n1c 2021-09-17 17:51:27 -07:00
  • 5588eeabe1 Fixed ugly multi line comment pyth0n1c 2021-09-17 17:35:50 -07:00
  • 94f05e573c Added some error handling so that the show can go on while we debug. Fixed another bad variable naming error pyth0n1c 2021-09-17 17:33:20 -07:00
  • ebb00af725 Forgot to declare results_queue before using it. pyth0n1c 2021-09-17 16:58:14 -07:00
  • 4d1c456a33 Removed some aws calls which should no longer be made pyth0n1c 2021-09-17 16:49:05 -07:00
  • e5c87027c1 Lots more changes building out the skeleton of the docker testing framework. Needs testing, breakup into simpler files, documentation, etc. But a good start. pyth0n1c 2021-09-17 16:45:05 -07:00
  • dc8b704332 Initial changes and testing for local dockerized detection testing service pyth0n1c 2021-09-17 15:14:17 -07:00
  • 9119157f07 Update to test Lou Stella 2021-09-17 14:07:08 -05:00
  • 7d4f3aac2e touched up detections d1vious 2021-09-17 12:50:23 -04:00
  • 070d78fc60 adding generated _posts from detections d1vious 2021-09-17 11:19:08 -04:00
  • 3840ef8d20 Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm Detection Testing Service 2021-09-17 12:32:05 +00:00
  • 88a4494b69 Added detection testing service results inExtraction of Registry Hives root 2021-09-17 12:32:04 +00:00
  • 3723e0129e Branch was auto-updated. Bhavin Patel 2021-09-17 05:24:59 -07:00
  • 11e0118a98 Branch was auto-updated. Bhavin Patel 2021-09-17 05:24:58 -07:00
  • b6db6f357b Merge pull request #1667 from splunk/add_dataset_url Michael Haag 2021-09-17 06:24:41 -06:00
  • 3e996076c7 updates mhaag-spl 2021-09-17 05:56:19 -06:00
  • 93f706926b Merge branch 'develop' into The-Haag-of-The-Storm mhaag-spl 2021-09-17 05:52:44 -06:00
  • d646da8e70 Revert "Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm" mhaag-spl 2021-09-17 05:48:51 -06:00
  • 6747a30515 Update create_local_admin_accounts_using_net_exe.yml mhaag-spl 2021-09-17 05:46:53 -06:00
  • 9a5907c2b0 fin7 tccontre 2021-09-17 12:31:03 +02:00
  • 68ba204036 fin7 tccontre 2021-09-17 11:06:52 +02:00
  • 5b98c86ba9 change dataset P4T12ICK 2021-09-17 10:19:45 +02:00
  • f9360d8851 fin7 tccontre 2021-09-17 09:59:49 +02:00
  • bb3a0f2d88 fin7 tccontre 2021-09-17 09:55:04 +02:00
  • 12d15d17e3 fin7 tccontre 2021-09-17 09:49:27 +02:00
  • 68c31b3c31 fin7 tccontre 2021-09-17 09:39:45 +02:00
  • e5a7afa9a3 Adding Pth and PtT detections at logging devices and endpoints, tested on DSP Stanislav Miskovic 2021-09-16 22:15:58 -07:00
  • 784d940631 Returning signature_id into the detection Stanislav Miskovic 2021-09-16 20:44:41 -07:00
  • 5c1e02f436 Merge branch 'fancy_docs' of github.com:splunk/security_content into fancy_docs d1vious 2021-09-16 23:00:12 -04:00
  • 62a89f9acf working detection gen d1vious 2021-09-16 23:00:07 -04:00
  • f7befe61e6 Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm Detection Testing Service 2021-09-16 18:42:11 +00:00
  • 5b301ca9b6 Added detection testing service results inProcesses created by netsh root 2021-09-16 18:42:10 +00:00
  • f4162778e1 Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm Detection Testing Service 2021-09-16 18:36:03 +00:00
  • 9156fe65e7 Added detection testing service results inExtract SAM from Registry root 2021-09-16 18:36:02 +00:00
  • 5ec1bb98f0 Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm Detection Testing Service 2021-09-16 18:28:51 +00:00
  • e85e81804b Added detection testing service results inExtract SAM from Registry root 2021-09-16 18:28:50 +00:00
  • 9a7e13f858 Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm Detection Testing Service 2021-09-16 18:25:52 +00:00
  • 2056548702 Added detection testing service results inDump LSASS via procdump root 2021-09-16 18:25:52 +00:00