Commit Graph

  • ffb6fb5409 Added detection testing service results inCommon Ransomware Notes root 2020-11-09 08:51:52 +00:00
  • 69d8c00af3 Merge branch 'detection_testing_part_one' of https://github.com/splunk/security-content into detection_testing_part_one Detection Testing Service 2020-11-09 08:43:18 +00:00
  • ede365c015 Added detection testing service results inCommon Ransomware Extensions root 2020-11-09 08:43:16 +00:00
  • f7fad21b02 ransomware notes test P4T12ICK 2020-11-09 09:36:01 +01:00
  • 66e2341012 ransomware extension P4T12ICK 2020-11-09 09:26:04 +01:00
  • b25ef1a4cb ransomware extension P4T12ICK 2020-11-09 09:24:14 +01:00
  • f8a131528d widowswsecuritysamsearch Rod Soto 2020-11-08 11:30:34 -05:00
  • e21455a145 fixnamedaddedantispyware Rod Soto 2020-11-08 11:10:49 -05:00
  • 2fd9f07c75 winconhostryuksearch Rod Soto 2020-11-08 10:57:02 -05:00
  • 7af33cfd4f ryuktestfilestestfile Rod Soto 2020-11-08 10:27:03 -05:00
  • fbb5ee4c7f Reconnaissance - adding detections for AD infrastructure, network connectivity, computers, domains, processes, services, registry, shares, etc. Stanislav Miskovic 2020-11-06 18:15:45 -08:00
  • 026bb228a0 Merge branch 'ryuk-story' of github.com:splunk/security-content into ryuk-story divious1 2020-11-06 19:08:00 -05:00
  • 2d37dc2e26 fixed validation errors divious1 2020-11-06 19:07:54 -05:00
  • 2ecead4232 added additional checks to validate divious1 2020-11-06 18:32:56 -05:00
  • b6fe73df7d Merge branch 'develop' into ryuk-story Jose Enrique Hernandez 2020-11-06 18:03:20 -05:00
  • 6eadeb857b Fix: Slip in renaming of tests Stanislav Miskovic 2020-11-06 15:01:54 -08:00
  • 301c13f7fa new detections divious1 2020-11-06 17:34:40 -05:00
  • f786d10f41 fixes bpatel 2020-11-06 13:50:51 -08:00
  • c1c3923941 Merge branch 'develop' into issue_#850 Ignacio 2020-11-06 13:06:59 -08:00
  • c1f56e36f1 Showing number of passed tests in info, since it was confusing Ignacio Bermudez Corrales 2020-11-06 12:48:46 -08:00
  • ebd7e678a1 Adding min coverage 100% for SSA detections Ignacio Bermudez Corrales 2020-11-06 12:19:19 -08:00
  • 391bb12781 Fix: File names of recon and use detections Stanislav Miskovic 2020-11-06 11:48:29 -08:00
  • 26d787daa2 support for types, and min-coverage testing with throwing error code for CI Ignacio Bermudez Corrales 2020-11-06 11:38:57 -08:00
  • 3ef46f17f7 Merge branch 'develop' into misko_recon_use_cases miskoSplunk 2020-11-06 11:09:18 -08:00
  • 884372729c Merge branch 'develop' into dependabot/pip/botocore-1.19.12 Jose Enrique Hernandez 2020-11-06 14:02:48 -05:00
  • 05eef5af56 Merge pull request #894 from splunk/dependabot_auto_merges Jose Enrique Hernandez 2020-11-06 14:02:36 -05:00
  • d14703fa3c Merge branch 'develop' into dependabot_auto_merges Jose Enrique Hernandez 2020-11-06 13:57:58 -05:00
  • afe64bdb3e detection/experimental folder for untested detections Ignacio Bermudez Corrales 2020-11-06 10:37:11 -08:00
  • 15bcf0bde3 Merge branch 'develop' into ryuk-story Jose Enrique Hernandez 2020-11-06 12:36:01 -05:00
  • 77af8684bc ryuk story and detections divious1 2020-11-06 12:32:48 -05:00
  • 2f8ea360f4 Merge branch 'develop' into TR162 Ignacio 2020-11-06 08:59:31 -08:00
  • 6459b1f637 Merge branch 'develop' into issue_#850 Ignacio 2020-11-06 08:58:51 -08:00
  • 9c3cbf193b Merge branch 'develop' into detection_testing_part_one Ignacio 2020-11-06 08:58:12 -08:00
  • c3398357d7 Merge branch 'develop' into misko_recon_use_cases Ignacio 2020-11-06 08:54:25 -08:00
  • 52898f78aa Merge pull request #895 from splunk/TR-281 Ignacio 2020-11-06 08:46:17 -08:00
  • ac7d92eda1 Bump botocore from 1.19.11 to 1.19.12 dependabot[bot] 2020-11-06 14:03:33 +00:00
  • 39c6a6c1e8 Added detection testing service results inBatch File Write to System32 root 2020-11-06 12:58:46 +00:00
  • afc2ee1777 Merge branch 'detection_testing_part_one' of https://github.com/splunk/security-content into detection_testing_part_one Detection Testing Service 2020-11-06 12:44:39 +00:00
  • 3420a755d0 Added detection testing service results inAttempt To Stop Security Service root 2020-11-06 12:44:38 +00:00
  • 85f349668c new detection testing file P4T12ICK 2020-11-06 13:43:49 +01:00
  • ee59a8150b new test file P4T12ICK 2020-11-06 13:26:45 +01:00
  • b988641071 Reconnaissance and access to accounts groups and policies via Mimikatz and PowerSploit modules Stanislav Miskovic 2020-11-05 23:10:53 -08:00
  • 049d9da7a3 Merge branch 'develop' into TR-281 Ignacio 2020-11-05 19:22:36 -08:00
  • 10917d4c8d Selecting only necessary fields to avoid serialization problem on DSP Ignacio Bermudez Corrales 2020-11-05 19:19:50 -08:00
  • 9b5ccc2f93 Adding Reconnaissance of Credential Stores and Services via Mimikatz modules Stanislav Miskovic 2020-11-05 19:12:04 -08:00
  • 94e73720b4 Merge branch 'develop' into dependabot_auto_merges Jose Enrique Hernandez 2020-11-05 21:43:23 -05:00
  • 71abe0338c specific token that requires github repo access otherwise auto merges fail divious1 2020-11-05 21:42:10 -05:00
  • ef2c32d06a Merge pull request #887 from splunk/dependabot/pip/botocore-1.19.11 dependabot[bot] 2020-11-06 02:32:40 +00:00
  • 098aa9019a mods Shannon Davis 2020-11-06 11:08:38 +11:00
  • 44b5080384 Merge branch 'develop' into dependabot/pip/botocore-1.19.11 Jose Enrique Hernandez 2020-11-05 19:06:48 -05:00
  • 10bdaa537e Merge pull request #888 from splunk/dependabot/pip/boto3-1.16.11 Jose Enrique Hernandez 2020-11-05 19:05:34 -05:00
  • dd0704e323 Merge pull request #889 from splunk/dependabot/pip/attrs-20.3.0 Jose Enrique Hernandez 2020-11-05 19:05:07 -05:00
  • 4d87173809 detection updates bpatel 2020-11-05 16:04:50 -08:00
  • 229391234d Merge branch 'develop' into misko_credential_probing miskoSplunk 2020-11-05 16:00:56 -08:00
  • 1ab400a565 mods Shannon Davis 2020-11-06 10:57:35 +11:00
  • 329c2e59e2 Merge pull request #6 from splunk/develop davisshannon 2020-11-06 10:53:29 +11:00
  • ee80e0c09d added timeout Ignacio Bermudez Corrales 2020-11-04 15:16:04 -08:00
  • 4fe445695e Merge branch 'develop' into dependabot/pip/attrs-20.3.0 Jose Enrique Hernandez 2020-11-05 17:52:46 -05:00
  • f6566e39dc Merge branch 'develop' into ransomwares3 Bhavin Patel 2020-11-05 13:04:35 -08:00
  • cf3bce9ca7 Merge pull request #891 from splunk/TR-254-new Ignacio 2020-11-05 12:32:40 -08:00
  • c57016f99d using artifactory api to retrieve latest humvee jar Ignacio Bermudez Corrales 2020-11-05 11:46:46 -08:00
  • de839bc3b8 Added detection testing service results inDetect New Local Admin account root 2020-11-05 18:15:30 +00:00
  • 608af0ae98 bug fix P4T12ICK 2020-11-05 18:58:28 +01:00
  • 5e845f4b3d Probing access and credential strength with stolen credentials Stanislav Miskovic 2020-11-05 09:46:23 -08:00
  • ae45426783 Merge branch 'develop' of github.com:splunk/security-content into tf23 Xiao Lin 2020-11-05 09:37:16 -08:00
  • 811ba865fa change test files to use ssa prefix Xiao Lin 2020-11-05 17:36:30 +00:00
  • fa2ca47546 test yml Xiao Lin 2020-11-05 17:03:54 +00:00
  • 4f581f419d add 3 underscore Xiao Lin 2020-11-05 17:01:20 +00:00
  • 640cadef7c use ssa as prefix Xiao Lin 2020-11-05 16:59:13 +00:00
  • 0bb7df59f5 Merge branch 'detection_testing_part_one' of github.com:splunk/security-content into detection_testing_part_one P4T12ICK 2020-11-05 17:40:48 +01:00
  • e46b37300f bug fix in detection P4T12ICK 2020-11-05 17:40:31 +01:00
  • 17c2951b92 Bump attrs from 20.2.0 to 20.3.0 dependabot[bot] 2020-11-05 14:03:58 +00:00
  • cbc0fd5aa3 Bump boto3 from 1.16.10 to 1.16.11 dependabot[bot] 2020-11-05 14:03:57 +00:00
  • 7234237741 Bump botocore from 1.19.10 to 1.19.11 dependabot[bot] 2020-11-05 14:03:55 +00:00
  • 3de3e6c8ab Merge branch 'detection_testing_part_one' of https://github.com/splunk/security-content into detection_testing_part_one Detection Testing Service 2020-11-05 13:20:33 +00:00
  • c396e43995 Added detection testing service results inKerberoasting spn request with RC4 encryption root 2020-11-05 13:20:32 +00:00
  • a81ae920af Added detection testing service results inDetect Activity Related to Pass the Hash Attacks root 2020-11-05 13:09:41 +00:00
  • 7d0ddb28e9 Reduce FP Mikael Bjerkeland 2020-11-05 12:40:19 +01:00
  • 59c9b9bcb9 Merge branch 'detection_testing_part_one' of https://github.com/splunk/security-content into detection_testing_part_one Detection Testing Service 2020-11-05 10:20:59 +00:00
  • e29ebc6d92 Added detection testing service results inDetect Credential Dumping through LSASS access root 2020-11-05 10:20:58 +00:00
  • 6af70e41b7 Added detection testing service results inCreate Remote Thread into LSASS root 2020-11-05 10:11:51 +00:00
  • 0930c6e7ae Merge branch 'detection_testing_part_one' of github.com:splunk/security-content into detection_testing_part_one P4T12ICK 2020-11-05 10:42:12 +01:00
  • 25672136fd improvements detection testing service P4T12ICK 2020-11-05 10:41:42 +01:00
  • 7262514981 Added detection testing service results inAttempt To Add Certificate To Untrusted Store automated_detection_testing_834 root 2020-11-05 09:39:58 +00:00
  • 054fa8ca3b Added detection testing service results inAccess LSASS Memory for Dump Creation root 2020-11-05 08:46:55 +00:00
  • 8a66f8e175 changed macro P4T12ICK 2020-11-05 09:18:37 +01:00
  • 76fc296d43 Merge branch 'develop' into mbjerkeland-develop jzsplunk 2020-11-04 17:45:22 -08:00
  • 1bfa0dfc6b Merge branch 'develop' into ransomwares3 jzsplunk 2020-11-04 17:44:34 -08:00
  • f845dc331e Merge branch 'develop' into issue_#850 jzsplunk 2020-11-04 17:43:59 -08:00
  • 04f8db150a Merge branch 'develop' of github.com:splunk/security-content into TR162 Xiao Lin 2020-11-04 22:40:23 +00:00
  • 11bef0bbc6 Merge pull request #823 from splunk/adding_api_checks Bhavin Patel 2020-11-04 14:16:58 -08:00
  • 8e317c3c00 Merge branch 'develop' into adding_api_checks Bhavin Patel 2020-11-04 14:09:15 -08:00
  • c2d56f2e57 Merge branch 'develop' into issue_#850 jzsplunk 2020-11-04 14:07:06 -08:00
  • 74e25172e4 Merge pull request #854 from splunk/ssa-coverage Jose Enrique Hernandez 2020-11-04 16:51:26 -05:00
  • a30cf8bb5d Merge pull request #1 from splunk/develop davisshannon 2020-11-05 08:33:59 +11:00
  • 8b93ff2097 minor bpatel 2020-11-04 13:32:06 -08:00
  • be1c42f895 Merge branch 'develop' into mbjerkeland-develop jzsplunk 2020-11-04 13:05:28 -08:00
  • 24292ea2c8 Merge pull request #877 from splunk/misko_apply_set_stolen_credentials jzsplunk 2020-11-04 12:47:25 -08:00
  • 27cb068218 updating spl to use All_Traffic.transport=tcp bpatel 2020-11-04 12:46:20 -08:00
  • bf21ee071f more test files for mustang bpatel 2020-11-04 12:39:57 -08:00