admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • da49981e4d Branch was auto-updated. github-actions[bot] 2021-07-27 20:53:18 +00:00
  • 7f1e68eea6 Merge pull request #1536 from sec-researcher/optimized Bhavin Patel 2021-07-27 13:53:02 -07:00
  • 4d3c12cf26 Merge branch 'develop' into optimized Bhavin Patel 2021-07-27 13:02:37 -07:00
  • 78493550fd Bump distlib from 0.3.1 to 0.3.2 dependabot[bot] 2021-07-27 20:02:13 +00:00
  • 9a64d3f9a6 Branch was auto-updated. github-actions[bot] 2021-07-27 20:01:54 +00:00
  • 5dbf545f75 Branch was auto-updated. github-actions[bot] 2021-07-27 20:01:52 +00:00
  • 3807152d0a Merge pull request #1510 from splunk/dependabot/pip/splunk-sdk-1.6.16 Jose Enrique Hernandez 2021-07-27 16:01:33 -04:00
  • 2fd2af4d29 Added detection testing service results inDNS Query Length With High Standard Deviation root 2021-07-27 19:59:57 +00:00
  • 9f009ecfd0 Fix dockerfile typo peter-cg 2021-07-27 12:52:18 -05:00
  • 9bc9d1f803 Bump kubectl, qbec versions peter-cg 2021-07-27 12:45:13 -05:00
  • d8957ba06e Modify qbec verbosity peter-cg 2021-07-27 11:47:13 -05:00
  • 4eb9a75f80 Merge branch 'develop' into optimized Jose Enrique Hernandez 2021-07-27 10:54:35 -04:00
  • df4b290340 minor patel-bhavin 2021-07-26 18:40:35 -07:00
  • 27ada7b107 qbec env vars peter-cg 2021-07-26 16:42:17 -05:00
  • 9c17b26628 Bumping up qbec verbosity peter-cg 2021-07-26 16:32:18 -05:00
  • 32c955b30a Moving gitlab CI config to gstaging peter-cg 2021-07-26 14:56:10 -05:00
  • a1311a5cb5 Adding app=ba label peter-cg 2021-07-26 14:24:36 -05:00
  • 1d83a8e3ec Adding token validation peter-cg 2021-07-01 13:25:26 -05:00
  • de34c4ebc7 Move from stage to gstage peter-cg 2021-06-30 16:23:13 -05:00
  • 152562cca0 Uploading all data at once peter-cg 2021-06-25 17:26:19 -05:00
  • 5708578e59 Cleaning up some error reporting and adding activation-wait-loop peter-cg 2021-06-25 16:10:38 -05:00
  • 5ffddf539e Branch was auto-updated. github-actions[bot] 2021-07-26 16:11:51 +00:00
  • 46980ebd14 Branch was auto-updated. github-actions[bot] 2021-07-26 16:11:50 +00:00
  • d804875815 Branch was auto-updated. patrick_demo_branch_2 github-actions[bot] 2021-07-26 16:11:48 +00:00
  • 6278d12ded Branch was auto-updated. github-actions[bot] 2021-07-26 16:11:45 +00:00
  • 6fb05a1b9f Merge pull request #1542 from splunk/Shadowsinthecopy Bhavin Patel 2021-07-26 09:11:29 -07:00
  • c4ce0e8590 converted response_task to investigations P4T12ICK 2021-07-26 13:49:50 +02:00
  • 686b0b5ca4 converted response_task to investigations P4T12ICK 2021-07-26 13:39:17 +02:00
  • 48165c7e35 Merge branch 'develop' into Shadowsinthecopy Michael Haag 2021-07-23 14:10:05 -06:00
  • ba92a642a8 SAM I AM mhaag-spl 2021-07-23 14:06:27 -06:00
  • 197a91aee8 demo P4T12ICK 2021-07-23 19:40:11 +02:00
  • c69b8c1053 response tasks into investigations P4T12ICK 2021-07-23 19:34:01 +02:00
  • c6639226df Branch was auto-updated. github-actions[bot] 2021-07-22 19:42:29 +00:00
  • 26d6951080 Branch was auto-updated. github-actions[bot] 2021-07-22 19:42:28 +00:00
  • c1ee926cac Branch was auto-updated. github-actions[bot] 2021-07-22 19:42:25 +00:00
  • d1ac094077 Merge pull request #1537 from splunk/Shadowsinthecopy Michael Haag 2021-07-22 13:42:08 -06:00
  • cfede36f8f Branch was auto-updated. github-actions[bot] 2021-07-22 19:12:58 +00:00
  • aeaabda3a6 Branch was auto-updated. github-actions[bot] 2021-07-22 19:12:55 +00:00
  • b7a650741d Branch was auto-updated. github-actions[bot] 2021-07-22 19:12:53 +00:00
  • f82a26bf8a Branch was auto-updated. github-actions[bot] 2021-07-22 19:12:52 +00:00
  • a761479f6f Merge pull request #1533 from splunk/aws_snap_exfil Bhavin Patel 2021-07-22 12:12:35 -07:00
  • ad44baef29 Update detect_shared_ec2_snapshot.yml Michael Haag 2021-07-22 13:06:23 -06:00
  • 48babd0a33 Branch was auto-updated. github-actions[bot] 2021-07-22 16:43:08 +00:00
  • 8e6ab78a8f Branch was auto-updated. github-actions[bot] 2021-07-22 16:43:07 +00:00
  • 4f5ec30fe0 Branch was auto-updated. github-actions[bot] 2021-07-22 16:43:06 +00:00
  • 599f9cf046 Branch was auto-updated. github-actions[bot] 2021-07-22 16:43:02 +00:00
  • d09c80c1cc Branch was auto-updated. github-actions[bot] 2021-07-22 16:42:56 +00:00
  • 225afaa035 Merge pull request #1540 from splunk/git-fix Bhavin Patel 2021-07-22 09:42:41 -07:00
  • afe1d8a286 Update detect_copy_of_shadowcopy_with_script_block_logging.yml mhaag-spl 2021-07-22 06:55:12 -06:00
  • 9acd9f32f7 Update detect_renamed_psexec.yml mhaag-spl 2021-07-22 06:20:47 -06:00
  • d207154de3 Update detect_renamed_winrar.yml mhaag-spl 2021-07-22 06:19:55 -06:00
  • 70dc0c1a59 Merge branch 'develop' into optimized Amir hossein Mahboubi 2021-07-22 16:35:02 +04:30
  • e5d24fba22 Update detect_copy_of_shadowcopy_with_script_block_logging.yml mhaag-spl 2021-07-21 15:48:36 -06:00
  • 28af2af96c Update detect_copy_of_shadowcopy_with_script_block_logging.yml mhaag-spl 2021-07-21 15:46:49 -06:00
  • e9e56493f8 Update detect_copy_of_shadowcopy_with_script_block_logging.test.yml mhaag-spl 2021-07-21 15:44:04 -06:00
  • b87f262923 test file mhaag-spl 2021-07-21 15:41:42 -06:00
  • bd69016d7e PowerShell 4104 copy of Security HIVES mhaag-spl 2021-07-21 13:57:10 -06:00
  • 0c5aeec30c update circle ci P4T12ICK 2021-07-21 16:38:01 +02:00
  • 8b1e40a546 update type P4T12ICK 2021-07-21 16:21:45 +02:00
  • 4821f5595e Branch was auto-updated. github-actions[bot] 2021-07-21 14:14:31 +00:00
  • 9a78b89f3b Branch was auto-updated. github-actions[bot] 2021-07-21 14:14:28 +00:00
  • 03a9e5f2ea Branch was auto-updated. github-actions[bot] 2021-07-21 14:14:26 +00:00
  • 94cc31cc64 Branch was auto-updated. github-actions[bot] 2021-07-21 14:14:23 +00:00
  • 0d8da0488e Merge pull request #1496 from splunk/uac_bypass P4T12ICK 2021-07-21 16:14:05 +02:00
  • ca8565c034 test circleci P4T12ICK 2021-07-21 16:09:28 +02:00
  • ee3f8638c4 As I know PTR requests can not be used for data exfiltration so having them in search result is just a false positive. Also they have effect on deviation calculation and lead to a lot of false positive in result, specially when PTR requests in the environment is about 20% or more. So I add this filter to the search 'where NOT DNS.message_type IN("Pointer","PTR")' sec-researcher 2021-07-21 18:20:15 +04:30
  • 618e2fbf21 test circleci P4T12ICK 2021-07-21 15:32:25 +02:00
  • d3db4a0b1b Merge branch 'develop' into uac_bypass P4T12ICK 2021-07-21 14:59:18 +02:00
  • d6db4af59f Merge branch 'uac_bypass' of https://github.com/splunk/security_content into uac_bypass Detection Testing Service 2021-07-21 10:46:45 +00:00
  • bbfcfb9aac Added detection testing service results inUAC Bypass MMC Load Unsigned Dll root 2021-07-21 10:46:45 +00:00
  • 21f8ef2990 updated stories P4T12ICK 2021-07-21 12:41:06 +02:00
  • f3501d056e uac tccontre 2021-07-21 12:33:33 +02:00
  • 80be6029de updated stories P4T12ICK 2021-07-21 12:26:15 +02:00
  • a6fb638b9c Update mshta_spawning_rundll32_or_regsvr32_process.yml tccontre 2021-07-21 12:23:36 +02:00
  • 87a46e76cb Update wsreset_uac_bypass.yml tccontre 2021-07-21 12:22:24 +02:00
  • 76bbbe4609 add deployments to baselines P4T12ICK 2021-07-21 11:31:40 +02:00
  • d633c92513 bug fix P4T12ICK 2021-07-21 09:24:07 +02:00
  • 5e6e987fb7 resolved merge conflicts P4T12ICK 2021-07-21 09:22:09 +02:00
  • 0dbf7fdab6 Added detection testing service results inDetect shared ec2 snapshot root 2021-07-20 23:41:56 +00:00
  • 4a1841fbed updates patel-bhavin 2021-07-20 15:37:36 -07:00
  • 8d8bdaeaab Merge branch 'develop' into aws_snap_exfil Bhavin Patel 2021-07-20 15:16:07 -07:00
  • 44ea56053d updating docs and package bits [ci skip] research bot 2021-07-20 21:12:30 +00:00
  • df6e6c6a5e Branch was auto-updated. github-actions[bot] 2021-07-20 20:41:12 +00:00
  • 51b30268b5 Branch was auto-updated. github-actions[bot] 2021-07-20 20:41:11 +00:00
  • 53cf748600 Branch was auto-updated. github-actions[bot] 2021-07-20 20:41:09 +00:00
  • 2a81a8400a Branch was auto-updated. github-actions[bot] 2021-07-20 20:41:05 +00:00
  • 0872f02a13 Merge pull request #1511 from splunk/Risky v3.25.2 Bhavin Patel 2021-07-20 13:40:49 -07:00
  • c8cdf9162e Branch was auto-updated. github-actions[bot] 2021-07-20 20:34:50 +00:00
  • 182c556dbb Branch was auto-updated. github-actions[bot] 2021-07-20 20:34:47 +00:00
  • 82e9884b93 Branch was auto-updated. github-actions[bot] 2021-07-20 20:34:45 +00:00
  • 14c82ee203 Branch was auto-updated. github-actions[bot] 2021-07-20 20:34:45 +00:00
  • 8b83e2a888 Branch was auto-updated. github-actions[bot] 2021-07-20 20:34:44 +00:00
  • 9560018229 Merge pull request #1534 from splunk/fixes Bhavin Patel 2021-07-20 13:34:27 -07:00
  • 23adb90bdc validate fix: patel-bhavin 2021-07-20 13:20:31 -07:00
  • ce0ffe6cb8 Update office_application_spawn_rundll32_process.yml mhaag-spl 2021-07-20 14:08:10 -06:00
  • 4d714cd6f6 snap patel-bhavin 2021-07-20 12:55:18 -07:00
  • 2f33b99816 Merge branch 'develop' into Risky Michael Haag 2021-07-20 13:47:15 -06:00
  • 780ac5f61c Branch was auto-updated. github-actions[bot] 2021-07-20 19:45:26 +00:00
  • 696f032e21 Branch was auto-updated. github-actions[bot] 2021-07-20 19:45:24 +00:00
  • f4164d845a Branch was auto-updated. github-actions[bot] 2021-07-20 19:45:20 +00:00