Commit Graph

  • 50d3f536e2 bug fixes detections P4T12ICK 2020-11-11 18:54:59 +01:00
  • 62319f88d4 Merge branch 'develop' into ryuktestsfiles P4T12ICK 2020-11-11 16:30:44 +01:00
  • d8e090d496 wip P4T12ICK 2020-11-11 16:27:14 +01:00
  • c274602e04 Bump urllib3 from 1.25.11 to 1.26.0 dependabot[bot] 2020-11-11 15:17:23 +00:00
  • 8b42328d2a Merge pull request #912 from splunk/dependabot/pip/boto3-1.16.15 dependabot[bot] 2020-11-11 15:13:04 +00:00
  • 8b93e8de76 Bump boto3 from 1.16.14 to 1.16.15 dependabot[bot] 2020-11-11 14:43:23 +00:00
  • b0b0456f93 Merge pull request #913 from splunk/dependabot/pip/botocore-1.19.15 dependabot[bot] 2020-11-11 14:42:51 +00:00
  • ae4d3ab24f Bump botocore from 1.19.12 to 1.19.15 dependabot[bot] 2020-11-11 14:03:11 +00:00
  • 2b64634e2f Fix - renaming and providing adequate test set for log deletion detection (this was Mimikatz detection, not PowerSploit one) Stanislav Miskovic 2020-11-10 19:01:01 -08:00
  • 6142d28147 Merge branch 'develop' of github.com:splunk/security-content into TR162 Xiao Lin 2020-11-11 01:58:20 +00:00
  • 7613e71990 Merge pull request #910 from splunk/fix_broken_links_readme Bhavin Patel 2020-11-10 17:38:07 -08:00
  • 3f83c1ef29 adding test files bpatel 2020-11-10 17:30:26 -08:00
  • 3539c2d2da Merge branch 'develop' of github.com:splunk/security-content into TR162 Xiao Lin 2020-11-11 01:15:35 +00:00
  • dc7d3bf9ea Merge branch 'develop' into misko_illegal_management Jose Enrique Hernandez 2020-11-10 19:21:33 -05:00
  • 205cfb92af Merge branch 'develop' into ssa-coverage Jose Enrique Hernandez 2020-11-10 18:26:42 -05:00
  • 238be2ac65 Merge pull request #898 from splunk/dependabot/pip/botocore-1.19.12 Jose Enrique Hernandez 2020-11-10 18:26:21 -05:00
  • aebfb6286f Merge branch 'develop' into dependabot/pip/botocore-1.19.12 Jose Enrique Hernandez 2020-11-10 18:26:12 -05:00
  • edbc2585f7 Merge pull request #904 from splunk/dependabot/pip/certifi-2020.11.8 Jose Enrique Hernandez 2020-11-10 18:25:26 -05:00
  • fb5f8faa76 Merge branch 'develop' into dependabot/pip/certifi-2020.11.8 Jose Enrique Hernandez 2020-11-10 18:24:52 -05:00
  • d026ba24d9 Merge branch 'develop' into fix_broken_links_readme Jose Enrique Hernandez 2020-11-10 18:24:15 -05:00
  • 0869243901 fixing broken links divious1 2020-11-10 18:23:26 -05:00
  • fb867b5697 Merge pull request #696 from splunk/mustang_beta Bhavin Patel 2020-11-10 15:05:55 -08:00
  • 1b253a8d4b Merge branch 'develop' of github.com:splunk/security-content into TR162 Xiao Lin 2020-11-10 21:35:09 +00:00
  • be86a838e4 Merge branch 'mustang_beta' of https://github.com/splunk/security-content into mustang_beta mustang_beta bpatel 2020-11-10 10:56:30 -08:00
  • 7c544b9446 deleteing test files bpatel 2020-11-10 10:56:13 -08:00
  • fe003db5d6 Merge branch 'develop' into mbjerkeland-develop inspired 2020-11-10 19:23:19 +01:00
  • 3aa06e82b6 Merge branch 'develop' into mustang_beta Bhavin Patel 2020-11-10 09:59:18 -08:00
  • 64bd08b5ff these macro files are not needed bpatel 2020-11-10 09:14:23 -08:00
  • 832ce6a2ae Update windows_security_account_manager_stopped.test.yml P4T12ICK 2020-11-10 16:49:19 +01:00
  • 20b9f7a784 Update windows_disableantispyware_reg.test.yml P4T12ICK 2020-11-10 16:49:02 +01:00
  • 7eabf717c0 Update windows_conhost_exe_force_flag.test.yml P4T12ICK 2020-11-10 16:48:47 +01:00
  • ac4bab5bee Update ryuk_test_files_detected.test.yml P4T12ICK 2020-11-10 16:48:28 +01:00
  • b7876411e2 Update ryuk_test_files_detected.test.yml P4T12ICK 2020-11-10 16:48:03 +01:00
  • cacd61039b Update windows_security_account_manager_stopped.test.yml P4T12ICK 2020-11-10 16:42:51 +01:00
  • b435c6ce9c Update windows_disableantispyware_reg.test.yml P4T12ICK 2020-11-10 16:42:33 +01:00
  • 52993d830a Update windows_conhost_exe_force_flag.test.yml P4T12ICK 2020-11-10 16:42:16 +01:00
  • b1e4cccec2 Update ryuk_test_files_detected.test.yml P4T12ICK 2020-11-10 16:41:13 +01:00
  • 9cdca4e7b6 Merge branch 'detection_testing_part_one' of https://github.com/splunk/security-content into detection_testing_part_one Detection Testing Service 2020-11-10 15:15:19 +00:00
  • 9e6a855e6d Added detection testing service results inDetect PsExec With accepteula Flag root 2020-11-10 15:15:18 +00:00
  • 3a59c7734a Merge branch 'detection_testing_part_one' of https://github.com/splunk/security-content into detection_testing_part_one Detection Testing Service 2020-11-10 15:02:19 +00:00
  • ff4207b44c Added detection testing service results inDetect Use of cmd exe to Launch Script Interpreters root 2020-11-10 15:02:17 +00:00
  • 7867a6c825 new test file P4T12ICK 2020-11-10 15:59:50 +01:00
  • 3f6f8af783 new test file P4T12ICK 2020-11-10 15:44:07 +01:00
  • 47bd9e77f3 Merge pull request #909 from splunk/dependabot/pip/boto3-1.16.14 dependabot[bot] 2020-11-10 14:28:02 +00:00
  • 7f7933af05 Merge branch 'detection_testing_part_one' of https://github.com/splunk/security-content into detection_testing_part_one Detection Testing Service 2020-11-10 14:26:42 +00:00
  • 285a6f9860 Added detection testing service results inDetect processes used for System Network Configuration Discovery root 2020-11-10 14:26:41 +00:00
  • 2da2082b6a new test file P4T12ICK 2020-11-10 15:13:15 +01:00
  • f243ce0dc9 Bump boto3 from 1.16.13 to 1.16.14 dependabot[bot] 2020-11-10 14:05:09 +00:00
  • 4aa2af44d4 Fix adding a missing guid Stanislav Miskovic 2020-11-10 01:26:16 -08:00
  • 4dc12ac4da Fix a typo in name field Stanislav Miskovic 2020-11-10 01:21:39 -08:00
  • 1969d4a9ab Illegal control of compromised resources via Mimikatz, PowerSploit and DSInternals modules Stanislav Miskovic 2020-11-10 00:58:27 -08:00
  • 3675fa80ad Rename Mikael Bjerkeland 2020-11-10 09:37:33 +01:00
  • 3bf9acae8c Added detection testing service results inDetect Prohibited Applications Spawning cmd exe root 2020-11-10 08:35:10 +00:00
  • 4a29a71009 Dashes in references Mikael Bjerkeland 2020-11-10 09:30:50 +01:00
  • 1f3f1ae408 Merge branch 'develop' into mbjerkeland-develop P4T12ICK 2020-11-10 09:24:55 +01:00
  • 4059b769a2 new detection test P4T12ICK 2020-11-10 09:20:22 +01:00
  • 70466c9301 new detection test P4T12ICK 2020-11-10 09:02:24 +01:00
  • 941bbf9de7 Added enableSched = 1 to baseline searches David Dorsey 2020-11-09 22:23:43 -06:00
  • 6e14af85c6 changed image to one maintained by Splunk Ignacio Bermudez Corrales 2020-11-09 15:06:03 -08:00
  • d0aa011c20 updating docs and package bits [ci skip] research bot 2020-11-09 23:01:54 +00:00
  • 33561b084c Merge pull request #906 from splunk/jzsplunk-patch-1 Jose Enrique Hernandez 2020-11-09 17:51:44 -05:00
  • 49954af581 Merge branch 'develop' into jzsplunk-patch-1 Jose Enrique Hernandez 2020-11-09 17:51:36 -05:00
  • 2c9c0252c6 Merge branch 'develop' into dependabot/pip/botocore-1.19.12 Jose Enrique Hernandez 2020-11-09 17:51:15 -05:00
  • 41c3669d30 Merge branch 'develop' into dependabot/pip/certifi-2020.11.8 Jose Enrique Hernandez 2020-11-09 17:50:47 -05:00
  • c67d2e5944 Merge pull request #899 from splunk/ryuk-story v3.0.9 Jose Enrique Hernandez 2020-11-09 17:45:04 -05:00
  • d73c630bb0 removed samsam notes divious1 2020-11-09 17:38:09 -05:00
  • 30c6fa6606 fixing minor mistakes divious1 2020-11-09 17:32:13 -05:00
  • 6b8b2b61ec Revert "Merge remote-tracking branch 'origin/ryuktestsfiles' into ryuk-story" divious1 2020-11-09 14:55:16 -05:00
  • 54eddbd393 Merge branch 'develop' into ryuktestsfiles Jose Enrique Hernandez 2020-11-09 14:12:10 -05:00
  • d71196915e Merge branch 'TR162' of github.com:splunk/security-content into TR162 Xiao Lin 2020-11-09 19:12:07 +00:00
  • 09c43eff66 Merge branch 'develop' of github.com:splunk/security-content into TR162 Xiao Lin 2020-11-09 18:10:02 +00:00
  • c1d01b4a46 Update README.md jzsplunk 2020-11-09 09:32:55 -08:00
  • 79a9a16809 updating with upstream divious1 2020-11-09 11:23:11 -05:00
  • 37dd447777 Merge pull request #884 from splunk/detection_testing_part_one Jose Enrique Hernandez 2020-11-09 11:21:16 -05:00
  • f51a8f5b10 Merge branch 'develop' into detection_testing_part_one P4T12ICK 2020-11-09 17:16:01 +01:00
  • f8fc4fa95d fixing warning on comparisons divious1 2020-11-09 11:10:10 -05:00
  • 31ec8a4bc3 Added detection testing service results inDetect mshta exe running scripts in command-line arguments root 2020-11-09 15:59:06 +00:00
  • 8c12dd3eee Merge branch 'develop' into dependabot/pip/botocore-1.19.12 Jose Enrique Hernandez 2020-11-09 10:56:44 -05:00
  • b1db736eb2 Merge remote-tracking branch 'origin/ryuktestsfiles' into ryuk-story divious1 2020-11-09 10:55:45 -05:00
  • b0a9af9bdb Bump certifi from 2020.6.20 to 2020.11.8 dependabot[bot] 2020-11-09 15:42:28 +00:00
  • 46d503405b Merge pull request #886 from splunk/dependabot/pip/ansible-2.10.3 dependabot[bot] 2020-11-09 15:41:35 +00:00
  • ca7c9c878e detection test P4T12ICK 2020-11-09 16:41:09 +01:00
  • 919b7236d8 Bump ansible from 2.10.2 to 2.10.3 dependabot[bot] 2020-11-09 15:31:19 +00:00
  • 1819339f4d Merge branch 'develop' into mbjerkeland-develop Jose Enrique Hernandez 2020-11-09 10:14:28 -05:00
  • 5a34ae63ae Merge branch 'develop' into detection_testing_part_one P4T12ICK 2020-11-09 15:56:23 +01:00
  • f053664217 Merge pull request #903 from splunk/dependabot/pip/boto3-1.16.13 dependabot[bot] 2020-11-09 14:38:33 +00:00
  • fc25eb7cb9 Bump boto3 from 1.16.11 to 1.16.13 dependabot[bot] 2020-11-09 14:05:25 +00:00
  • 97181a2276 detection review P4T12ICK 2020-11-09 14:36:48 +01:00
  • cfcaa4c0e8 Merge branch 'develop' into detection_testing_part_one P4T12ICK 2020-11-09 14:36:14 +01:00
  • 60dec9ea55 Merge branch 'detection_testing_part_one' of https://github.com/splunk/security-content into detection_testing_part_one Detection Testing Service 2020-11-09 12:43:38 +00:00
  • 89ede1f1f8 Added detection testing service results inDetect Excessive Account Lockouts From Endpoint root 2020-11-09 12:43:35 +00:00
  • a99d31c43a Added detection testing service results inDetect Excessive User Account Lockouts root 2020-11-09 12:43:26 +00:00
  • 53bc5414f9 Merge branch 'detection_testing_part_one' of github.com:splunk/security-content into detection_testing_part_one P4T12ICK 2020-11-09 13:25:41 +01:00
  • 87a7d64d66 new tests P4T12ICK 2020-11-09 13:25:27 +01:00
  • 1e5bbadd2b Added detection testing service results inDeleting Shadow Copies root 2020-11-09 09:56:18 +00:00
  • ff910fa590 Merge branch 'detection_testing_part_one' of github.com:splunk/security-content into detection_testing_part_one P4T12ICK 2020-11-09 10:38:50 +01:00
  • 079742338b deleting shadow copy test P4T12ICK 2020-11-09 10:38:40 +01:00
  • a9a17dee87 Merge branch 'develop' into mbjerkeland-develop inspired 2020-11-09 10:17:58 +01:00
  • fb0398fafb Added test Mikael Bjerkeland 2020-11-09 10:12:52 +01:00
  • fbccb2412c Merge branch 'detection_testing_part_one' of https://github.com/splunk/security-content into detection_testing_part_one Detection Testing Service 2020-11-09 08:51:53 +00:00