admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • fa785a991f Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm mhaag-spl 2021-09-16 12:24:56 -06:00
  • fbc3185dbc Update processes_launching_netsh.yml mhaag-spl 2021-09-16 12:24:53 -06:00
  • 47db5dfd79 Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm Detection Testing Service 2021-09-16 18:19:16 +00:00
  • 4178c03b52 Added detection testing service results inDetect PsExec With accepteula Flag root 2021-09-16 18:19:16 +00:00
  • 6f9c536f8e error mhaag-spl 2021-09-16 12:15:53 -06:00
  • 9c08c1f2f4 fixes mhaag-spl 2021-09-16 12:14:26 -06:00
  • bd6a779b02 no longer need sysmon procdump - updated superior procdump mhaag-spl 2021-09-16 12:06:20 -06:00
  • 04e8fd24b2 Added detection testing service results inDomain Account Discovery With Net App root 2021-09-16 17:56:37 +00:00
  • 70fb8aaf78 fixes mhaag-spl 2021-09-16 11:36:51 -06:00
  • 583e962d23 Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm mhaag-spl 2021-09-16 11:13:16 -06:00
  • 695bd7236c hh, mshta, and psexec mhaag-spl 2021-09-16 11:13:15 -06:00
  • 325eb8e1c7 Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm Detection Testing Service 2021-09-16 17:08:16 +00:00
  • eeb3af0c16 Added detection testing service results inCredential Dumping via Symlink to Shadow Copy root 2021-09-16 17:08:15 +00:00
  • 644e571292 Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm Detection Testing Service 2021-09-16 17:07:21 +00:00
  • 6c467dbb80 Added detection testing service results inCredential Dumping via Copy Command from Shadow Copy root 2021-09-16 17:07:21 +00:00
  • c22058ceb4 Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm Detection Testing Service 2021-09-16 16:57:26 +00:00
  • 8fc4ca5e90 Added detection testing service results inCreation of Shadow Copy with wmic and powershell root 2021-09-16 16:57:25 +00:00
  • ee1ef1ecd6 Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm Detection Testing Service 2021-09-16 16:52:59 +00:00
  • 13a917ea62 Added detection testing service results inCreate or delete windows shares using net exe root 2021-09-16 16:52:59 +00:00
  • 9e32a32bdd Update credential_dumping_via_symlink_to_shadow_copy.yml mhaag-spl 2021-09-16 10:52:50 -06:00
  • ec15b54f16 Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm Detection Testing Service 2021-09-16 16:51:08 +00:00
  • 7acb54087f Added detection testing service results inCreate local admin accounts using net exe root 2021-09-16 16:51:07 +00:00
  • 261bdc4270 Update credential_dumping_via_copy_command_from_shadow_copy.yml mhaag-spl 2021-09-16 10:50:21 -06:00
  • 7bf85e6245 Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm Detection Testing Service 2021-09-16 16:45:19 +00:00
  • ddae4670bb Added detection testing service results inBITSAdmin Download File root 2021-09-16 16:45:19 +00:00
  • 85594da255 Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm Detection Testing Service 2021-09-16 16:41:30 +00:00
  • 6059b4e135 Added detection testing service results inBITS Job Persistence root 2021-09-16 16:41:29 +00:00
  • f43bffd899 Update creation_of_shadow_copy_with_wmic_and_powershell.yml mhaag-spl 2021-09-16 10:37:34 -06:00
  • 5fe3b8ad85 fixes mhaag-spl 2021-09-16 10:33:18 -06:00
  • c5cdccf1b4 Update create_local_admin_accounts_using_net_exe.yml mhaag-spl 2021-09-16 10:32:08 -06:00
  • 53806fe5f0 Update office_product_spawning_wmic.yml mhaag-spl 2021-09-16 10:28:52 -06:00
  • 4171a3cd63 Update bitsadmin_download_file.yml mhaag-spl 2021-09-16 10:23:55 -06:00
  • e8ddb9aadc Update bits_job_persistence.yml mhaag-spl 2021-09-16 10:23:11 -06:00
  • 3844ad4bcb Update batch_file_write_to_system32.yml mhaag-spl 2021-09-16 10:22:24 -06:00
  • 3dc11fae91 Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm Detection Testing Service 2021-09-16 16:18:21 +00:00
  • 2e2f4546df Added detection testing service results inBatch File Write to System32 root 2021-09-16 16:18:21 +00:00
  • 8f17362947 Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm Detection Testing Service 2021-09-16 16:07:37 +00:00
  • abc6aa1eb7 Added detection testing service results inAttempted Credential Dump From Registry via Reg exe root 2021-09-16 16:07:36 +00:00
  • 6fd71dfec2 Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm Detection Testing Service 2021-09-16 16:03:34 +00:00
  • 48f5786538 Added detection testing service results inAttempt To Add Certificate To Untrusted Store root 2021-09-16 16:03:33 +00:00
  • 89265b45e7 Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm Detection Testing Service 2021-09-16 16:02:24 +00:00
  • f68371cc3f Added detection testing service results inAccount Discovery With Net App root 2021-09-16 16:02:23 +00:00
  • 9111b9a0a5 Update batch_file_write_to_system32.yml mhaag-spl 2021-09-16 09:58:07 -06:00
  • 46c20ccb77 Update attempted_credential_dump_from_registry_via_reg_exe.yml mhaag-spl 2021-09-16 09:47:25 -06:00
  • dc90473679 Added detection testing service results inCmdline Tool Not Executed In CMD Shell root 2021-09-16 15:43:53 +00:00
  • 217d7fd23e updates mhaag-spl 2021-09-16 09:42:56 -06:00
  • 9c31c30fde Added png for GSuite_DevSecops Lou Stella 2021-09-16 10:29:47 -05:00
  • c7c7583ec8 Added demo playbook for development Lou Stella 2021-09-16 10:21:27 -05:00
  • 1daee13b11 Added detection testing service results inCheck Elevated CMD using whoami root 2021-09-16 15:17:07 +00:00
  • 13062c170a Merge branch 'fin7' of github.com:splunk/security_content into fin7 tccontre 2021-09-16 16:57:15 +02:00
  • d03f534e68 fin7 tccontre 2021-09-16 16:56:51 +02:00
  • 907cce2415 Merge branch 'fin7' of https://github.com/splunk/security_content into fin7 Detection Testing Service 2021-09-16 14:48:11 +00:00
  • cbb2198d65 Added detection testing service results inOffice Application Drop Executable root 2021-09-16 14:48:10 +00:00
  • 2480f3c4b7 fin7 tccontre 2021-09-16 16:45:49 +02:00
  • f764f730ec fin7 tccontre 2021-09-16 16:04:40 +02:00
  • ad6761f6b9 Merge branch 'fin7' of github.com:splunk/security_content into fin7 tccontre 2021-09-16 16:00:27 +02:00
  • b869a0de99 fin7 tccontre 2021-09-16 15:54:32 +02:00
  • 9db514182b added phase to detection P4T12ICK 2021-09-16 15:39:29 +02:00
  • a30c746aeb Added detection testing service results inNon Chrome Process Accessing Chrome Default Dir root 2021-09-16 10:03:01 +00:00
  • 05820da35d Adding SLP confirmed in DSP Stanislav Miskovic 2021-09-15 16:11:02 -07:00
  • 9e22174115 revert patel-bhavin 2021-09-15 15:48:01 -07:00
  • aec4f7c772 adding dataset url Jose Enrique Hernandez 2021-09-15 17:34:51 -04:00
  • a110285399 deprecate patel-bhavin 2021-09-15 13:13:38 -07:00
  • afe7e98f06 Added DevSecOps demo playbook Lou Stella 2021-09-15 14:21:50 -05:00
  • 4cf2ec6437 Branch was auto-updated. Bhavin Patel 2021-09-15 11:36:21 -07:00
  • 23f2c7d20e Branch was auto-updated. Bhavin Patel 2021-09-15 11:36:20 -07:00
  • 80a6bb877f Branch was auto-updated. hvalidate Bhavin Patel 2021-09-15 11:36:19 -07:00
  • 3f5b996824 Merge pull request #1664 from splunk/TR-851 pyth0n1c 2021-09-15 11:36:01 -07:00
  • c7d5193225 Added detection testing service results inOffice Product Writing cab or inf root 2021-09-15 18:03:01 +00:00
  • e3a84e4840 removed submodule Lou Stella 2021-09-15 12:54:05 -05:00
  • e44c3c4be7 testing mhaag-spl 2021-09-15 10:36:10 -06:00
  • b23dbeed08 Added detection testing service results inNon Firefox Process Access Firefox Profile Dir root 2021-09-15 16:00:56 +00:00
  • 50c9e38337 Added detection testing service results inJscript Execution Using Cscript App root 2021-09-15 13:59:55 +00:00
  • f42e2cd255 Added detection testing service results inOffice Application Drop Executable root 2021-09-15 13:03:19 +00:00
  • 8422a53a20 Added detection testing service results inXSL Script Execution With WMIC root 2021-09-15 12:43:04 +00:00
  • d0eff26cde fin7 tccontre 2021-09-15 13:48:22 +02:00
  • d96f70cf8e fin7 tccontre 2021-09-15 13:45:42 +02:00
  • ce06e8fe5b add cloudtrail patel-bhavin 2021-09-14 14:16:43 -07:00
  • 685efa7c38 test patel-bhavin 2021-09-14 14:01:46 -07:00
  • aecfbe57b7 uuid patel-bhavin 2021-09-14 12:47:44 -07:00
  • 80fe0dfcfd SSA test 1 patel-bhavin 2021-09-14 12:39:58 -07:00
  • ceb2b3b0fb Branch was auto-updated. Bhavin Patel 2021-09-14 12:34:49 -07:00
  • 1fde288203 Merge pull request #1662 from splunk/AD_Discovery_TR-789_5 mvelazco 2021-09-14 15:34:29 -04:00
  • 575377d312 Added detection testing service results inPowerShell Get LocalGroup Discovery root 2021-09-14 18:46:53 +00:00
  • 6bed1bdc71 Merge branch 'AD_Discovery_TR-789_5' of https://github.com/splunk/security_content into AD_Discovery_TR-789_5 Detection Testing Service 2021-09-14 18:20:58 +00:00
  • 70dfb3b5d1 Added detection testing service results inWmic Group Discovery root 2021-09-14 18:20:57 +00:00
  • 1a5e50fbec Merge branch 'AD_Discovery_TR-789_5' of https://github.com/splunk/security_content into AD_Discovery_TR-789_5 Detection Testing Service 2021-09-14 18:14:29 +00:00
  • eaacec47db Added detection testing service results inPowershell Get LocalGroup Discovery with Script Block Logging root 2021-09-14 18:14:29 +00:00
  • 84f5346fdf Merge branch 'AD_Discovery_TR-789_5' of https://github.com/splunk/security_content into AD_Discovery_TR-789_5 Detection Testing Service 2021-09-14 18:02:07 +00:00
  • c514bf1361 Added detection testing service results inNet Localgroup Discovery root 2021-09-14 18:02:07 +00:00
  • 5cf90f60b2 Merge branch 'AD_Discovery_TR-789_5' of https://github.com/splunk/security_content into AD_Discovery_TR-789_5 Detection Testing Service 2021-09-14 17:55:42 +00:00
  • 7ccd84ccfd Added detection testing service results inGet WMIObject Group Discovery with Script Block Logging root 2021-09-14 17:55:41 +00:00
  • 9836d8c263 Added detection testing service results inGet WMIObject Group Discovery root 2021-09-14 17:52:46 +00:00
  • 358917d733 May The Haag Be With You mhaag-spl 2021-09-14 11:05:59 -06:00
  • 29051d9cd3 Branch was auto-updated. Bhavin Patel 2021-09-14 09:02:32 -07:00
  • cd5bbf6cca Merge pull request #1660 from splunk/AD_Discovery_TR-789_9 Michael Haag 2021-09-14 10:02:13 -06:00
  • 47e3c2bf9e fixing message field mvelazco 2021-09-14 11:54:58 -04:00
  • 2e6bb4886b Merge branch 'AD_Discovery_TR-789_9' of github.com:splunk/security_content into AD_Discovery_TR-789_9 mvelazco 2021-09-14 10:01:54 -04:00
  • 379f8e82c1 adding required_fields mvelazco 2021-09-14 10:01:52 -04:00
  • 042f7e0c74 Merge branch 'AD_Discovery_TR-789_9' of https://github.com/splunk/security_content into AD_Discovery_TR-789_9 Detection Testing Service 2021-09-14 13:35:29 +00:00