Commit Graph

  • eb6c1e22da change P4T12ICK 2020-11-24 10:54:02 +01:00
  • e5ae2a1f88 Merge branch 'develop' of github.com:splunk/security-content into tf23 Xiao Lin 2020-11-24 01:15:11 -08:00
  • 071df80eb7 adding new key to test file bpatel 2020-11-23 15:38:17 -08:00
  • ea4ce5d6db rename files bpatel 2020-11-23 12:44:32 -08:00
  • b349131740 one last test file bpatel 2020-11-23 12:23:45 -08:00
  • 5ea7944a5c Merge branch 'develop' into mustang_beta_test_files bpatel 2020-11-23 12:09:26 -08:00
  • ccfabb6f64 adding test files bpatel 2020-11-23 12:07:09 -08:00
  • 41053507a0 Merge branch 'develop' into testing-data-pulling P4T12ICK 2020-11-23 18:05:20 +01:00
  • 8f29a49084 Added detection testing service results inProcesses created by netsh root 2020-11-23 13:38:44 +00:00
  • 487bf254e9 bug fix P4T12ICK 2020-11-23 14:12:01 +01:00
  • 4a16856ea3 new test file P4T12ICK 2020-11-23 13:28:48 +01:00
  • bd46dd7952 new test file P4T12ICK 2020-11-23 13:19:32 +01:00
  • 2b226cd902 Added detection testing service results inOverwriting Accessibility Binaries root 2020-11-23 11:59:15 +00:00
  • eea56a42c7 new test file P4T12ICK 2020-11-23 12:41:19 +01:00
  • 3230ea0abf Added detection testing service results inMonitor Registry Keys for Print Monitors root 2020-11-23 10:55:34 +00:00
  • c50404646b new test file P4T12ICK 2020-11-23 11:37:22 +01:00
  • 54141c1de6 missing imports in ssa_validate Ignacio Bermudez Corrales 2020-11-20 09:34:06 -08:00
  • 0b93c814a0 missing sys in ssa_validate Ignacio Bermudez Corrales 2020-11-20 09:30:18 -08:00
  • dbcda3ca56 Bump botocore from 1.19.21 to 1.19.22 dependabot[bot] 2020-11-20 14:07:48 +00:00
  • 75da36c992 Bump boto3 from 1.16.21 to 1.16.22 dependabot[bot] 2020-11-20 14:02:55 +00:00
  • 15e747d27e Added detection testing service results inMalicious PowerShell Process - Execution Policy Bypass root 2020-11-20 14:56:44 +00:00
  • be6690a4d3 new test P4T12ICK 2020-11-20 15:39:01 +01:00
  • 41a5c35ba4 Merge pull request #947 from splunk/dependabot/pip/botocore-1.19.22 dependabot[bot] 2020-11-20 14:12:58 +00:00
  • 380437fa38 Bump botocore from 1.19.21 to 1.19.22 dependabot[bot] 2020-11-20 14:07:48 +00:00
  • f120a059ed Merge pull request #946 from splunk/dependabot/pip/boto3-1.16.22 dependabot[bot] 2020-11-20 14:07:01 +00:00
  • 35c2aab7f0 Bump boto3 from 1.16.21 to 1.16.22 dependabot[bot] 2020-11-20 14:02:55 +00:00
  • e880dc0eb3 new test P4T12ICK 2020-11-20 12:16:51 +01:00
  • 548f448774 Added detection testing service results inMalicious PowerShell Process - Connect To Internet With Hidden Window root 2020-11-20 10:24:45 +00:00
  • ed24233aa4 new test P4T12ICK 2020-11-20 11:06:14 +01:00
  • a7d74cc6c5 Merge branch 'develop' of github.com:splunk/security-content into tf23 Xiao Lin 2020-11-19 17:31:49 -08:00
  • fb6d8ac64f Merge branch 'develop' into testing-data-pulling Ignacio 2020-11-19 16:34:25 -08:00
  • 7187f2cef6 Refactored and pulls data only on ssa detections Ignacio Bermudez Corrales 2020-11-19 16:32:04 -08:00
  • b8bc6147a8 add pass conditions bpatel 2020-11-19 14:40:15 -08:00
  • 515756519b add test conditions bpatel 2020-11-19 12:29:40 -08:00
  • 9554c26145 Added detection testing service results inHiding Files And Directories With Attrib exe root 2020-11-19 15:49:55 +00:00
  • d531531ab6 Merge branch 'detection_testing_part_one' of github.com:splunk/security-content into detection_testing_part_one P4T12ICK 2020-11-19 16:30:47 +01:00
  • 5d69211334 update P4T12ICK 2020-11-19 16:30:27 +01:00
  • a8543c539f Merge pull request #943 from splunk/dependabot/pip/botocore-1.19.21 dependabot[bot] 2020-11-19 14:22:07 +00:00
  • 7bb0d714c8 Bump botocore from 1.19.20 to 1.19.21 dependabot[bot] 2020-11-19 14:09:26 +00:00
  • e39779f761 Merge pull request #944 from splunk/dependabot/pip/boto3-1.16.21 dependabot[bot] 2020-11-19 14:08:36 +00:00
  • 2d3e6ab43a Bump boto3 from 1.16.20 to 1.16.21 dependabot[bot] 2020-11-19 14:03:42 +00:00
  • 4509b3dadc Merge branch 'detection_testing_part_one' of https://github.com/splunk/security-content into detection_testing_part_one Detection Testing Service 2020-11-19 13:44:56 +00:00
  • 4fbde2e53d Added detection testing service results inFirst Time Seen Child Process of Zoom root 2020-11-19 13:44:55 +00:00
  • ecb63ccbe2 Merge branch 'detection_testing_part_one' of https://github.com/splunk/security-content into detection_testing_part_one Detection Testing Service 2020-11-19 13:30:31 +00:00
  • 0d974f1f5b Added detection testing service results inFile with Samsam Extension root 2020-11-19 13:30:29 +00:00
  • 36889141d3 new test file P4T12ICK 2020-11-19 14:28:31 +01:00
  • 3602c9f961 new test file P4T12ICK 2020-11-19 14:11:18 +01:00
  • 4ce47e6921 Added detection testing service results inExecution of File with Multiple Extensions root 2020-11-19 10:55:54 +00:00
  • c277a26f14 merge conflict P4T12ICK 2020-11-19 11:35:42 +01:00
  • bb6a5d9e75 Merge pull request #942 from splunk/issue_941 Bhavin Patel 2020-11-18 15:46:53 -08:00
  • 2772bf4559 Merge pull request #940 from wesinator/patch-1 Bhavin Patel 2020-11-18 15:28:33 -08:00
  • e0c267779f updating risk object bpatel 2020-11-18 15:23:13 -08:00
  • 0737c2538a testing file update bpatel 2020-11-18 15:20:31 -08:00
  • 0f2056149f add additional suspicious file extensions Ԝеѕ 2020-11-18 16:19:11 -05:00
  • 688b006ed0 Merge pull request #890 from splunk/misko_credential_probing Ignacio 2020-11-18 11:36:16 -08:00
  • 4e5b26e322 Merge branch 'develop' into misko_credential_probing Ignacio 2020-11-18 11:30:43 -08:00
  • c8710c17ad Merge pull request #893 from davisshannon/develop Bhavin Patel 2020-11-18 11:30:10 -08:00
  • 9b8bc3ceaf Merge branch 'develop' into misko_credential_probing Ignacio 2020-11-18 11:25:16 -08:00
  • fc8ab61ac0 Merge pull request #896 from splunk/misko_recon_use_cases Ignacio 2020-11-18 11:23:53 -08:00
  • 79403ad142 Merge branch 'develop' into misko_recon_use_cases Ignacio 2020-11-18 11:20:13 -08:00
  • 7cd18f2797 Merge pull request #931 from splunk/mustang_beta_drop3 Bhavin Patel 2020-11-18 11:07:16 -08:00
  • 732664fb23 Merge branch 'develop' into mustang_beta_drop3 Jose Enrique Hernandez 2020-11-18 14:02:35 -05:00
  • 7fa971386b Merge pull request #914 from splunk/minor_mispelling Jose Enrique Hernandez 2020-11-18 13:32:20 -05:00
  • 3c1cfbf4de Merge branch 'develop' into develop Jose Enrique Hernandez 2020-11-18 13:30:38 -05:00
  • b514c54c74 Merge pull request #929 from splunk/dependabot/pip/protobuf-3.14.0 Jose Enrique Hernandez 2020-11-18 13:30:22 -05:00
  • d57bcfbd5e Update ssa___recon_processes_and_services_via_mimikatz_modules.yml miskoSplunk 2020-11-18 10:25:24 -08:00
  • 44e4920121 Update ssa___recon_process_service_hijacking_via_mimikatz_modules.yml miskoSplunk 2020-11-18 10:24:37 -08:00
  • 67c0c759e9 Update ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml miskoSplunk 2020-11-18 10:24:01 -08:00
  • 42a66b6904 Update ssa___recon_defensive_tools_via_powersploit_modules.yml miskoSplunk 2020-11-18 10:23:05 -08:00
  • bea77daf5f Update ssa___recon_connectivity_via_powersploit_modules.yml miskoSplunk 2020-11-18 10:22:24 -08:00
  • 2ddba5f54c Update ssa___recon_and_use_shares_via_powersploit_modules.yml miskoSplunk 2020-11-18 10:21:45 -08:00
  • 5cd3af9fd0 Update ssa___recon_and_use_shares_via_mimikatz_modules.yml miskoSplunk 2020-11-18 10:20:56 -08:00
  • bd3fd3ada6 Update ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml miskoSplunk 2020-11-18 10:19:56 -08:00
  • ef440012b8 Update ssa___recon_and_use_computers_via_mimikatz_modules.yml miskoSplunk 2020-11-18 10:19:17 -08:00
  • 3812bbdb6c Update ssa___recon_and_use_computers_domains_via_powersploit_modules.yml miskoSplunk 2020-11-18 10:18:26 -08:00
  • 6d315d1469 Update ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml miskoSplunk 2020-11-18 10:17:35 -08:00
  • 0cf86f14f3 Update ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml miskoSplunk 2020-11-18 10:12:17 -08:00
  • 66eefe026c Update ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml miskoSplunk 2020-11-18 10:11:40 -08:00
  • d4688cc394 Update ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml miskoSplunk 2020-11-18 10:10:57 -08:00
  • b4f3e260c5 Update ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml miskoSplunk 2020-11-18 10:09:35 -08:00
  • 7b2b17f497 Update ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml miskoSplunk 2020-11-18 10:08:45 -08:00
  • 5a28f4aeae Update ssa___assess_credential_strength_via_dsinternals_modules.yml miskoSplunk 2020-11-18 10:07:53 -08:00
  • 90d33ffda4 Update ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml miskoSplunk 2020-11-18 10:04:43 -08:00
  • 42661d0f8c Update ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml miskoSplunk 2020-11-18 10:03:28 -08:00
  • b1716386e8 Update ssa___assess_credential_strength_via_dsinternals_modules.yml miskoSplunk 2020-11-18 10:01:18 -08:00
  • fea5096cad Merge branch 'develop' into dependabot/pip/protobuf-3.14.0 Jose Enrique Hernandez 2020-11-18 12:35:53 -05:00
  • 7c0795beb7 Merge pull request #935 from splunk/TR-278 Jose Enrique Hernandez 2020-11-18 12:34:54 -05:00
  • 7d64ec2884 Merge branch 'develop' into misko_recon_use_cases Jose Enrique Hernandez 2020-11-18 12:22:12 -05:00
  • 023e57056f Merge branch 'develop' into misko_credential_probing Jose Enrique Hernandez 2020-11-18 12:22:08 -05:00
  • ba8b9c9b75 Merge branch 'develop' into mustang_beta_drop3 Jose Enrique Hernandez 2020-11-18 12:20:54 -05:00
  • 77bc2e7a78 Added detection testing service results inDisabling Remote User Account Control root 2020-11-18 14:55:01 +00:00
  • f10ee1c906 new detection test P4T12ICK 2020-11-18 15:38:17 +01:00
  • add321abd2 Bump protobuf from 3.13.0 to 3.14.0 dependabot[bot] 2020-11-18 14:25:23 +00:00
  • bc1d33add5 Merge pull request #938 from splunk/dependabot/pip/boto3-1.16.20 dependabot[bot] 2020-11-18 14:24:36 +00:00
  • b0f36aba0b Bump boto3 from 1.16.19 to 1.16.20 dependabot[bot] 2020-11-18 14:07:45 +00:00
  • 8529c0e664 Merge pull request #937 from splunk/dependabot/pip/botocore-1.19.20 dependabot[bot] 2020-11-18 14:06:55 +00:00
  • 029edcc184 Bump botocore from 1.19.19 to 1.19.20 dependabot[bot] 2020-11-18 14:02:50 +00:00
  • 1a77b13d95 new detection test P4T12ICK 2020-11-18 11:28:25 +01:00
  • 6681a6f59a Merge pull request #936 from splunk/deprecate_broken_detection P4T12ICK 2020-11-18 10:04:14 +01:00
  • 253faa4dfd Merge branch 'develop' into deprecate_broken_detection Jose Enrique Hernandez 2020-11-17 16:34:34 -05:00