Commit Graph

  • 0f5b2263f8 Delete powershell_using_memory_as_backing_store.yml tccontre 2021-06-16 12:55:02 +02:00
  • 9cc797894a Delete powershell_processing_stream_of_data.yml tccontre 2021-06-16 12:54:40 +02:00
  • c02c2583c0 Delete powershell_creating_thread_mutex.yml tccontre 2021-06-16 12:54:32 +02:00
  • 17745a60c6 Delete permission_modification_using_takeown_app.yml tccontre 2021-06-16 12:54:24 +02:00
  • 41f0d69190 Delete disable_logs_using_wevtutil.yml tccontre 2021-06-16 12:54:15 +02:00
  • 262786373b Delete clear_unallocated_sector_using_cipher_app.yml tccontre 2021-06-16 12:54:00 +02:00
  • c430efed7e Delete allow_operation_with_consent_admin.yml tccontre 2021-06-16 12:53:51 +02:00
  • 8effd5a258 endpoint_to_ssa tccontre 2021-06-16 12:52:15 +02:00
  • a1b27f125f Delete allow_operation_with_consent_admin.test.yml tccontre 2021-06-16 10:22:00 +02:00
  • 9a25b289c3 Delete clear_unallocated_sector_using_cipher_app.test.yml tccontre 2021-06-16 10:21:41 +02:00
  • de20af3ac5 Delete permission_modification_using_takeown_app.test.yml tccontre 2021-06-16 10:21:28 +02:00
  • 150d8c9f34 Delete prevent_automatic_repair_mode_using_bcdedit.test.yml tccontre 2021-06-16 10:21:05 +02:00
  • 32defb377a Delete start_up_during_safe_mode_boot.test.yml tccontre 2021-06-16 10:20:51 +02:00
  • b198eb9a22 Delete start_up_during_safe_mode_boot.yml tccontre 2021-06-16 10:20:32 +02:00
  • 6a92e68a08 Delete prevent_automatic_repair_mode_using_bcdedit.yml tccontre 2021-06-16 10:20:17 +02:00
  • 75189e2b1d Delete permission_modification_using_takeown_app.yml tccontre 2021-06-16 10:19:57 +02:00
  • e9e5c446f4 Delete clear_unallocated_sector_using_cipher_app.yml tccontre 2021-06-16 10:19:39 +02:00
  • c7c2b94d37 Delete allow_operation_with_consent_admin.yml tccontre 2021-06-16 10:19:27 +02:00
  • 878bf692fa Delete disable_logs_using_wevtutil.test.yml tccontre 2021-06-16 10:13:51 +02:00
  • ff8878ce3d Delete disable_logs_using_wevtutil.yml tccontre 2021-06-16 10:12:14 +02:00
  • 667396b4ce updated rba spec patel-bhavin 2021-06-15 17:04:51 -07:00
  • 1cf181772d Added detection testing service results inPowerShell Domain Enumeration root 2021-06-15 20:53:39 +00:00
  • 25b1087abc Domain enumeration mhaag-spl 2021-06-15 14:02:45 -06:00
  • b83ab2b8b5 Added detection testing service results inPowerShell Loading DotNET into Memory via System Reflection Assembly root 2021-06-15 19:53:56 +00:00
  • 4476dc1705 spec chars mhaag-spl 2021-06-15 13:28:27 -06:00
  • a169f1b226 Name fix mhaag-spl 2021-06-15 13:26:01 -06:00
  • a4d3947ee3 System.Reflection.Assembly mhaag-spl 2021-06-15 13:16:17 -06:00
  • ba31f2035d Merge branch 'den-haag' of https://github.com/splunk/security_content into den-haag Detection Testing Service 2021-06-15 18:08:49 +00:00
  • 67f8c9e0f2 Added detection testing service results inPowershell Fileless Script Contains Base64 Encoded Content root 2021-06-15 18:08:49 +00:00
  • 2a50ee7941 Merge branch 'den-haag' of https://github.com/splunk/security_content into den-haag Detection Testing Service 2021-06-15 18:00:41 +00:00
  • c9ee862dfb Added detection testing service results inPowershell Fileless Process Injection via GetProcAddress root 2021-06-15 18:00:40 +00:00
  • 05a3ee8d23 Merge branch 'den-haag' of https://github.com/splunk/security_content into den-haag Detection Testing Service 2021-06-15 18:00:00 +00:00
  • ea30e047cf Added detection testing service results inUnloading AMSI via Reflection root 2021-06-15 17:59:59 +00:00
  • c4d68238e2 Merge branch 'den-haag' of https://github.com/splunk/security_content into den-haag Detection Testing Service 2021-06-15 17:59:41 +00:00
  • dc8fef0ae2 Added detection testing service results inDetect Mimikatz With PowerShell Script Block Logging root 2021-06-15 17:59:41 +00:00
  • 112dddf43c Added detection testing service results inDetect Empire with PowerShell Script Block Logging root 2021-06-15 17:53:06 +00:00
  • f57f0f22d6 Fixed queries mhaag-spl 2021-06-15 11:29:24 -06:00
  • 1deb552054 new detection testing P4T12ICK 2021-06-15 17:50:53 +02:00
  • 3381ce7205 Merge branch 'hpot_ttp' of https://github.com/splunk/security_content into hpot_ttp Detection Testing Service 2021-06-15 15:50:48 +00:00
  • 76023baae1 Added detection testing service results inWMI Recon Running Process Or Services root 2021-06-15 15:50:47 +00:00
  • b073d80bcf Merge branch 'hpot_ttp' of https://github.com/splunk/security_content into hpot_ttp Detection Testing Service 2021-06-15 15:43:44 +00:00
  • aa4fc9ddfa Added detection testing service results inRecon Using WMI Class root 2021-06-15 15:43:44 +00:00
  • 1f65e24932 Merge branch 'hpot_ttp' of https://github.com/splunk/security_content into hpot_ttp Detection Testing Service 2021-06-15 15:40:49 +00:00
  • 0ca1e7f708 Added detection testing service results inRecon AVProduct Through Pwh or WMI root 2021-06-15 15:40:48 +00:00
  • 58fd2b6756 Merge branch 'hpot_ttp' of https://github.com/splunk/security_content into hpot_ttp Detection Testing Service 2021-06-15 15:25:51 +00:00
  • 9c821aa984 Added detection testing service results inPowershell Using memory As Backing Store root 2021-06-15 15:25:51 +00:00
  • c8ad2a7428 Added detection testing service results inPowershell Processing Stream Of Data root 2021-06-15 15:20:44 +00:00
  • f581f7a93e Added detection testing service results inPowershell Creating Thread Mutex root 2021-06-15 15:04:14 +00:00
  • dc3083731c new detection testing P4T12ICK 2021-06-15 16:50:42 +02:00
  • 261182ca93 Merge branch 'hpot_ttp' of github.com:splunk/security_content into hpot_ttp tccontre 2021-06-15 16:43:50 +02:00
  • bed3227224 wild_check tccontre 2021-06-15 16:43:23 +02:00
  • aee6c5a38f Merge branch 'automated_detections_testing_2' of github.com:splunk/security_content into automated_detections_testing_2 P4T12ICK 2021-06-15 16:34:21 +02:00
  • 73e51ce108 new detection testing P4T12ICK 2021-06-15 16:28:59 +02:00
  • efe8d51365 Branch was auto-updated. github-actions[bot] 2021-06-15 14:23:42 +00:00
  • 6cd22b9b89 Branch was auto-updated. github-actions[bot] 2021-06-15 14:23:42 +00:00
  • 3c93eb4555 Branch was auto-updated. github-actions[bot] 2021-06-15 14:23:40 +00:00
  • 4cd4dbb8b7 Branch was auto-updated. github-actions[bot] 2021-06-15 14:23:39 +00:00
  • 1dd4e97a9d Branch was auto-updated. github-actions[bot] 2021-06-15 14:23:37 +00:00
  • b147603932 Branch was auto-updated. github-actions[bot] 2021-06-15 14:23:36 +00:00
  • 4292b82e6c Branch was auto-updated. github-actions[bot] 2021-06-15 14:23:36 +00:00
  • 6b3b3c5a26 Branch was auto-updated. github-actions[bot] 2021-06-15 14:23:35 +00:00
  • 3b39911a2d Branch was auto-updated. github-actions[bot] 2021-06-15 14:23:34 +00:00
  • ec1a205bb5 Merge pull request #1442 from splunk/data_exfil P4T12ICK 2021-06-15 16:23:17 +02:00
  • 94636cb2c2 new detection testing P4T12ICK 2021-06-15 16:22:34 +02:00
  • 62ce70ce18 Merge branch 'develop' into data_exfil P4T12ICK 2021-06-15 16:18:22 +02:00
  • 61a105ade8 Added detection testing service results inDisable Logs Using WevtUtil root 2021-06-15 14:14:45 +00:00
  • 20ad04aee4 new detection testing P4T12ICK 2021-06-15 16:05:10 +02:00
  • c4c35025de Merge branch 'ransom_ttps' of github.com:splunk/security_content into ransom_ttps tccontre 2021-06-15 15:54:26 +02:00
  • 5fe7b16036 sl tccontre 2021-06-15 15:54:02 +02:00
  • 197e73cd61 de tccontre 2021-06-15 15:51:08 +02:00
  • cffd071964 Merge branch 'automated_detections_testing_2' of github.com:splunk/security_content into automated_detections_testing_2 P4T12ICK 2021-06-15 15:47:46 +02:00
  • 9f8dc333b7 new detection testing P4T12ICK 2021-06-15 15:47:24 +02:00
  • 375416e0a4 Branch was auto-updated. github-actions[bot] 2021-06-15 13:44:14 +00:00
  • 99b9fefea9 Branch was auto-updated. github-actions[bot] 2021-06-15 13:44:13 +00:00
  • 7285f927c2 Branch was auto-updated. github-actions[bot] 2021-06-15 13:44:11 +00:00
  • 85ecf75bb9 Branch was auto-updated. github-actions[bot] 2021-06-15 13:44:09 +00:00
  • b9adec82fb Branch was auto-updated. github-actions[bot] 2021-06-15 13:44:08 +00:00
  • 90f9bfabcc Branch was auto-updated. endp_ssa github-actions[bot] 2021-06-15 13:44:07 +00:00
  • 9efbd25a69 Branch was auto-updated. github-actions[bot] 2021-06-15 13:44:05 +00:00
  • 7186c1f6d7 Branch was auto-updated. github-actions[bot] 2021-06-15 13:44:04 +00:00
  • 399c342009 Branch was auto-updated. github-actions[bot] 2021-06-15 13:44:02 +00:00
  • 6270837a4c Excessive win temp detection (#1438) mhart-splunk 2021-06-15 09:43:48 -04:00
  • 9e009e50b7 data_exfil tccontre 2021-06-15 15:36:41 +02:00
  • ab9ff3c9ec new detection testing P4T12ICK 2021-06-15 11:23:07 +02:00
  • fed9efe117 new detection testing P4T12ICK 2021-06-15 10:24:53 +02:00
  • 206acdfeb9 new detection testing P4T12ICK 2021-06-15 10:18:44 +02:00
  • 24d9b15c73 new detection testing P4T12ICK 2021-06-15 10:10:42 +02:00
  • 1d4be26bb3 new detection testing P4T12ICK 2021-06-15 10:02:34 +02:00
  • 8f26cbf75a new detection testing P4T12ICK 2021-06-15 10:01:48 +02:00
  • c9c8acbb55 new detection testing P4T12ICK 2021-06-15 10:01:23 +02:00
  • 2646db328f new detection testing P4T12ICK 2021-06-15 09:54:17 +02:00
  • 383c4e2201 new detection testing P4T12ICK 2021-06-15 09:25:38 +02:00
  • 76ddb4b47e new detection testing P4T12ICK 2021-06-15 09:19:19 +02:00
  • 81288ad369 new detection testing P4T12ICK 2021-06-15 09:04:24 +02:00
  • 31cc739c3a Merge branch 'develop' of github.com:splunk/security-content into tf23 Xiao Lin 2021-06-14 17:35:05 -07:00
  • 9a8b163449 new detection testing P4T12ICK 2021-06-14 19:28:21 +02:00
  • d69a108558 new detection testing P4T12ICK 2021-06-14 19:24:27 +02:00
  • 9fb06a9ad1 new detection testing P4T12ICK 2021-06-14 18:40:57 +02:00
  • 801d68b1f1 new detection testing P4T12ICK 2021-06-14 18:30:41 +02:00
  • 69691013fa new detection testing P4T12ICK 2021-06-14 18:22:36 +02:00