Commit Graph

  • fe8d16e4a5 Merge branch 'develop' into rba_poc Bhavin Patel 2021-06-21 12:06:38 -07:00
  • 400d591059 minor patel-bhavin 2021-06-21 14:06:25 -05:00
  • 812cc46e65 Fix for TR-763 David Dorsey 2021-06-21 13:21:30 -05:00
  • d6a3edaa38 small change P4T12ICK 2021-06-21 08:53:48 +02:00
  • ba2fa59b5e adding 3 rba examples divious1 2021-06-19 22:15:49 -04:00
  • ad85879e89 Fixing descriptions mhaag-spl 2021-06-18 13:41:54 -06:00
  • f612fd6d3e Added detection testing service results inRemote WMI Command Attempt root 2021-06-18 17:22:24 +00:00
  • 35492c75fb wrong data mhaag-spl 2021-06-18 11:00:34 -06:00
  • a7b838d473 Update script_execution_via_wmi.yml mhaag-spl 2021-06-18 10:58:38 -06:00
  • f39a270c0e Merge branch 'den-haag' of https://github.com/splunk/security_content into den-haag mhaag-spl 2021-06-18 10:55:03 -06:00
  • 2b9f393585 Update script_execution_via_wmi.yml mhaag-spl 2021-06-18 10:54:52 -06:00
  • ca4ad15654 Merge branch 'den-haag' of https://github.com/splunk/security_content into den-haag Detection Testing Service 2021-06-18 16:53:51 +00:00
  • 7d543761b6 Added detection testing service results inDetect WMI Event Subscription Persistence root 2021-06-18 16:53:50 +00:00
  • 1d95339bbd Update script_execution_via_wmi.yml mhaag-spl 2021-06-18 10:52:51 -06:00
  • 8e9ad3a42b Update script_execution_via_wmi.yml mhaag-spl 2021-06-18 10:49:34 -06:00
  • 37bd2897bb Update wmi_permanent_event_subscription___sysmon.yml mhaag-spl 2021-06-18 10:37:47 -06:00
  • 2e9b99ecf1 Updates mhaag-spl 2021-06-18 10:34:25 -06:00
  • 9396034913 Remote WMI Command Attempt mhaag-spl 2021-06-18 10:02:13 -06:00
  • f1abd7b538 Update detect_wmi_event_subscription_persistence.yml mhaag-spl 2021-06-18 08:59:35 -06:00
  • b51f291810 Update detect_wmi_event_subscription_persistence.test.yml mhaag-spl 2021-06-18 08:22:36 -06:00
  • 4f55be64a0 ssa6 tccontre 2021-06-18 15:28:08 +02:00
  • 68a3ee162d increased timeout P4T12ICK 2021-06-18 14:52:53 +02:00
  • 865a488f45 wip P4T12ICK 2021-06-18 14:43:34 +02:00
  • 4a1d53b749 wip P4T12ICK 2021-06-18 14:13:07 +02:00
  • f474be39f6 Merge branch 'develop' into labeled_data_for_ml P4T12ICK 2021-06-18 14:12:44 +02:00
  • 0106cc56be ssa5 tccontre 2021-06-18 13:46:01 +02:00
  • dfe21c1da8 wip labeled data P4T12ICK 2021-06-18 13:24:50 +02:00
  • 57a3dbc5a3 ssa4 tccontre 2021-06-18 13:10:16 +02:00
  • 2492795204 ssa3 tccontre 2021-06-18 13:04:26 +02:00
  • 8ce2dd9993 Branch was auto-updated. github-actions[bot] 2021-06-18 07:45:46 +00:00
  • 0cacbf100a Branch was auto-updated. github-actions[bot] 2021-06-18 07:45:44 +00:00
  • 5185dd40b6 Branch was auto-updated. github-actions[bot] 2021-06-18 07:45:43 +00:00
  • 6d77362dff Branch was auto-updated. github-actions[bot] 2021-06-18 07:45:42 +00:00
  • 193089f6c5 Branch was auto-updated. github-actions[bot] 2021-06-18 07:45:41 +00:00
  • 4fd7970e19 Branch was auto-updated. github-actions[bot] 2021-06-18 07:45:40 +00:00
  • 65cc768c3a Branch was auto-updated. github-actions[bot] 2021-06-18 07:45:39 +00:00
  • 4debdfb17e Branch was auto-updated. github-actions[bot] 2021-06-18 07:45:39 +00:00
  • 30011967a1 Branch was auto-updated. github-actions[bot] 2021-06-18 07:45:38 +00:00
  • 1a8410d76f Branch was auto-updated. github-actions[bot] 2021-06-18 07:45:37 +00:00
  • 40d9c220cd Branch was auto-updated. github-actions[bot] 2021-06-18 07:45:36 +00:00
  • 68ee41c11e Merge pull request #1423 from splunk/ssa_gitlabci_clear_old_pipelines TR-745 P4T12ICK 2021-06-18 09:45:23 +02:00
  • be3519aeac small change to triiger ci P4T12ICK 2021-06-18 09:19:02 +02:00
  • c90b2093ce wip P4T12ICK 2021-06-18 09:17:36 +02:00
  • 6c518294ed minor update divious1 2021-06-17 21:44:20 -04:00
  • c1f4cae5b6 working example of risk object as well as threat object with ses annotations divious1 2021-06-17 21:43:50 -04:00
  • 12792fb6fd Branch was auto-updated. github-actions[bot] 2021-06-17 13:27:11 +00:00
  • 758cd6fad0 Branch was auto-updated. github-actions[bot] 2021-06-17 13:27:10 +00:00
  • 2f325f074e Branch was auto-updated. github-actions[bot] 2021-06-17 13:27:09 +00:00
  • 4b1578a547 Branch was auto-updated. github-actions[bot] 2021-06-17 13:27:08 +00:00
  • 3a80c7e260 Branch was auto-updated. github-actions[bot] 2021-06-17 13:27:07 +00:00
  • 7e83e6fd14 Branch was auto-updated. github-actions[bot] 2021-06-17 13:27:07 +00:00
  • 2d7679a2b5 Branch was auto-updated. github-actions[bot] 2021-06-17 13:27:06 +00:00
  • e3d65e92b3 Branch was auto-updated. github-actions[bot] 2021-06-17 13:27:04 +00:00
  • 9e9f583691 Branch was auto-updated. github-actions[bot] 2021-06-17 13:27:03 +00:00
  • 817bee6359 Branch was auto-updated. github-actions[bot] 2021-06-17 13:27:01 +00:00
  • 56365b6efc Branch was auto-updated. github-actions[bot] 2021-06-17 13:26:59 +00:00
  • 52c06fbcbe Branch was auto-updated. github-actions[bot] 2021-06-17 13:26:58 +00:00
  • d67359635f Merge pull request #1440 from splunk/hpot_ttp tccontre 2021-06-17 15:26:40 +02:00
  • 8f8d2a38b7 Branch was auto-updated. github-actions[bot] 2021-06-17 13:22:27 +00:00
  • 0439c7d22b Branch was auto-updated. github-actions[bot] 2021-06-17 13:22:25 +00:00
  • 8c3061f290 Branch was auto-updated. github-actions[bot] 2021-06-17 13:22:24 +00:00
  • ca3025f0f2 Branch was auto-updated. github-actions[bot] 2021-06-17 13:22:22 +00:00
  • ab0e043823 Branch was auto-updated. github-actions[bot] 2021-06-17 13:22:21 +00:00
  • 204fdaf31e Branch was auto-updated. github-actions[bot] 2021-06-17 13:22:20 +00:00
  • 1a788a30b0 Branch was auto-updated. github-actions[bot] 2021-06-17 13:22:19 +00:00
  • f62a56a03a Branch was auto-updated. github-actions[bot] 2021-06-17 13:22:18 +00:00
  • 4bb5b1c8ad Branch was auto-updated. github-actions[bot] 2021-06-17 13:22:18 +00:00
  • 6ee17226c5 Branch was auto-updated. github-actions[bot] 2021-06-17 13:22:17 +00:00
  • 144f8f7c1c Branch was auto-updated. github-actions[bot] 2021-06-17 13:22:16 +00:00
  • 8f58b91da6 Branch was auto-updated. github-actions[bot] 2021-06-17 13:22:15 +00:00
  • 83bcadf468 Branch was auto-updated. hpot_ttp github-actions[bot] 2021-06-17 13:22:14 +00:00
  • 882f1eafd0 Merge pull request #1436 from splunk/ransom_ttps tccontre 2021-06-17 15:21:56 +02:00
  • 1199c7f423 ssa3 tccontre 2021-06-17 14:17:36 +02:00
  • 175ad3f59e test detection P4T12ICK 2021-06-17 09:39:57 +02:00
  • fd796727ce test detection P4T12ICK 2021-06-17 09:15:22 +02:00
  • 8144275f34 making it a correct yml divious1 2021-06-16 18:06:36 -04:00
  • 981d238d42 Merge branch 'develop' of github.com:splunk/security-content into tf23 Xiao Lin 2021-06-16 15:02:36 -07:00
  • 1b076b9809 observables divious1 2021-06-16 18:02:29 -04:00
  • 90bf8bb996 Update detect_wmi_event_subscription_persistence.yml mhaag-spl 2021-06-16 15:55:58 -06:00
  • 56e77dccfb Update ssa___detect_kerberoasting.yml Jose Enrique Hernandez 2021-06-16 16:15:33 -04:00
  • bfa0daabd4 fixe dv Jose Enrique Hernandez 2021-06-16 15:50:19 -04:00
  • 99e3af8d10 wmi event subscription mhaag-spl 2021-06-16 13:48:07 -06:00
  • e0446a8ebf adding risk score divious1 2021-06-16 13:52:16 -04:00
  • 942c5c7702 [TR-605] write json output after mixing data. TR-605-dll-detections jzsplunk 2021-06-16 10:46:43 -07:00
  • 66c4215805 first test divious1 2021-06-16 13:46:22 -04:00
  • 95c88a2388 [TR-605] windows events template logic. jzsplunk 2021-06-16 10:24:45 -07:00
  • ce920e67fe [TR-605] data generator workflow. jzsplunk 2021-06-16 10:15:31 -07:00
  • c85fc0e1c2 Update malicious_powershell.yml mhaag-spl 2021-06-16 10:41:49 -06:00
  • d35abc5689 moved around location of label divious1 2021-06-16 12:06:49 -04:00
  • 3134df2380 added deprecated label as well as description annotation divious1 2021-06-16 11:59:31 -04:00
  • b6ab35397a ssa2 tccontre 2021-06-16 17:11:08 +02:00
  • fb1ce4133b ssa2 tccontre 2021-06-16 17:01:00 +02:00
  • 06fbc3c476 Merge branch 'develop' into deprecation_of_detections divious1 2021-06-16 10:42:00 -04:00
  • 59ffaf8c25 adding deprecation to generate divious1 2021-06-16 10:31:30 -04:00
  • 79c86ce0fd ssa tccontre 2021-06-16 16:19:55 +02:00
  • 26e91b6e1e Merge branch 'develop' into TR-605-dll-detections jzsplunk 2021-06-16 07:06:37 -07:00
  • 856e170c6c Delete ssa___wevtutil_usage_to_clear_logs.yml ssa tccontre 2021-06-16 12:55:39 +02:00
  • ed2527d488 Delete recon_using__wmi_class.yml tccontre 2021-06-16 12:55:31 +02:00
  • fb287ba8a4 Delete recon_avproduct_through_pwh_or_wmi.yml tccontre 2021-06-16 12:55:23 +02:00
  • 95f24e5923 Delete prevent_automatic_repair_mode_using_bcdedit.yml tccontre 2021-06-16 12:55:14 +02:00