admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • 47b44bc4cb Bump pytz from 2020.1 to 2020.4 dependabot[bot] 2020-11-02 14:04:12 +00:00
  • 86ff8d1878 Merge branch 'new_test_file_format' of github.com:splunk/security-content into new_test_file_format P4T12ICK 2020-10-30 11:15:27 +01:00
  • 94ee8537e4 improved testing P4T12ICK 2020-10-30 11:13:48 +01:00
  • e698682bdf Added detection testing service results inCreate local admin accounts using net exe root 2020-10-30 10:13:19 +00:00
  • c952f06956 new format for test files P4T12ICK 2020-10-30 09:11:41 +01:00
  • eb268874bd Update kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml Jose Enrique Hernandez 2020-10-29 12:09:16 -04:00
  • c02686fdad removed community api P4T12ICK 2020-10-29 13:23:56 +01:00
  • 470c94fc90 Credential Extraction: Changing passing condition to a new syntax Stanislav Miskovic 2020-10-29 00:42:19 -07:00
  • da26faa9d9 change input field names Xiao Lin 2020-10-28 22:57:25 +00:00
  • f9fa28dd18 Doc fix Mikael Bjerkeland 2020-10-28 23:26:56 +01:00
  • 17502e4722 Added various Network Infrastructure detections based on the MITRE Network Matrix Mikael Bjerkeland 2020-10-28 23:14:06 +01:00
  • aa7266ffa3 added final report Ignacio Bermudez Corrales 2020-10-28 13:55:17 -07:00
  • 7e068a5267 Added detection for T1020.001, Traffic Duplication Mikael Bjerkeland 2020-10-28 21:51:33 +01:00
  • 2c46a6d261 Merge branch 'develop' of github.com:splunk/security-content into TR162 Xiao Lin 2020-10-28 20:45:39 +00:00
  • f127325458 coverage by type SSA, ESCU Ignacio Bermudez Corrales 2020-10-28 13:45:11 -07:00
  • ce63b5b3c8 adding test file for suspicious_cloud_authentication_activities bpatel 2020-10-28 13:26:04 -07:00
  • bb626c1466 . Mikael Bjerkeland 2020-10-28 21:20:36 +01:00
  • d5c6d72361 . Mikael Bjerkeland 2020-10-28 21:14:40 +01:00
  • eb9b85a381 Merge branch 'develop' of https://github.com/splunk/security-content into mbjerkeland-develop Mikael Bjerkeland 2020-10-28 21:03:32 +01:00
  • b5707c8e22 Credential Extraction: moving test data from SMLE's to AR's S3 bucket and renaming test links Stanislav Miskovic 2020-10-28 11:38:08 -07:00
  • a715d3a193 script that shows the coverage for ssa detections Ignacio Bermudez Corrales 2020-10-28 09:08:13 -07:00
  • 2839525e0c Update and rename credential_extraction_ms_debuggers_z_option.test.yml to ssa___credential_extraction_ms_debuggers_z_option.test.yml miskoSplunk 2020-10-28 01:30:16 -07:00
  • 67be9820f8 Update and rename credential_extraction_ms_debuggers_kernel_peek.test.yml to ssa___credential_extraction_ms_debuggers_kernel_peek.test.yml miskoSplunk 2020-10-28 01:29:01 -07:00
  • f47a5e18af Update and rename credential_extraction_lazagne_command_options_ssa.test.yml to ssa___credential_extraction_lazagne_command_options.test.yml miskoSplunk 2020-10-28 01:28:21 -07:00
  • 2cdefdd198 Update and rename credential_extraction_fgdump_cachedump_v_option_ssa.test.yml to ssa___credential_extraction_fgdump_cachedump_v_option.test.yml miskoSplunk 2020-10-28 01:27:38 -07:00
  • 5f01133544 Update and rename credential_extraction_fgdump_cachedump_s_option_ssa.test.yml to ssa___credential_extraction_fgdump_cachedump_s_option.test.yml miskoSplunk 2020-10-28 01:26:40 -07:00
  • afa732f7c4 Credential Extraction, renaming the rest of the files to ssa___ Stanislav Miskovic 2020-10-28 01:22:59 -07:00
  • 85c521c80a Merge pull request #847 from splunk/dependabot/add-v2-config-file Jose Enrique Hernandez 2020-10-27 19:29:15 -04:00
  • cad99d8dfb add risk scores bpatel 2020-10-27 16:19:50 -07:00
  • 11b5336c21 Update Dependabot config file dependabot-preview[bot] 2020-10-27 23:14:41 +00:00
  • dd69bd2d1b Merge pull request #844 from splunk/pretty-testing Bhavin Patel 2020-10-27 16:07:52 -07:00
  • f8f860bd5d Merge branch 'develop' into pretty-testing Ignacio 2020-10-27 15:41:15 -07:00
  • daea9d4192 change to use SSA input_event Xiao Lin 2020-10-27 22:30:00 +00:00
  • b8e213cd2a added logging instead of printing Ignacio Bermudez Corrales 2020-10-27 15:13:49 -07:00
  • 2ceba2da51 Merge branch 'develop' of github.com:splunk/security-content into TR162 Xiao Lin 2020-10-27 22:26:30 +00:00
  • 3185517716 Update and rename credential_extraction_powersploit_modules_ssa.test.yml to ssa___credential_extraction_powersploit_modules.test.yml miskoSplunk 2020-10-27 15:17:41 -07:00
  • 575fd73422 Update and rename credential_extraction_mimikatz_modules_ssa.test.yml to ssa___credential_extraction_mimikatz_modules.test.yml miskoSplunk 2020-10-27 15:16:05 -07:00
  • 625fe1c7bc fixnamedetection Rod Soto 2020-10-27 18:08:53 -04:00
  • be32b7bf01 detectuserencryptings3 Rod Soto 2020-10-27 18:01:40 -04:00
  • a599d1ac21 modifiedmfasearch Rod Soto 2020-10-27 17:46:34 -04:00
  • 69e5aee23c detecionKMSkeyswMFA Rod Soto 2020-10-27 17:43:58 -04:00
  • 303ed6f735 test1 bpatel 2020-10-27 14:22:16 -07:00
  • 9d76d8e833 ransomware3story Rod Soto 2020-10-27 17:12:52 -04:00
  • 7b61b36a5d Merge pull request #841 from splunk/dependabot/pip/boto3-1.16.6 dependabot-preview[bot] 2020-10-27 20:31:45 +00:00
  • 3eedcfd10a Bump boto3 from 1.16.4 to 1.16.6 dependabot-preview[bot] 2020-10-27 20:01:06 +00:00
  • 8042ff1b5b Merge pull request #840 from splunk/dependabot/pip/botocore-1.19.6 dependabot-preview[bot] 2020-10-27 19:59:44 +00:00
  • 9d79b215cd Bump botocore from 1.19.4 to 1.19.6 dependabot-preview[bot] 2020-10-27 19:30:04 +00:00
  • 8ec9c06f2e Update and rename credential_extraction_getaddbaccount_from_dump_ssa.test.yml to ssa___credential_extraction_getaddbaccount_from_dump.test.yml miskoSplunk 2020-10-27 11:36:01 -07:00
  • abf692795d Update and rename credential_extraction_dsinternals_modules_ssa.test.yml to ssa___credential_extraction_dsinternals_modules.test.yml miskoSplunk 2020-10-27 11:34:40 -07:00
  • 2cd4512d65 Update and rename credential_extraction_dsinternals_conversion_modules_ssa.test.yml to ssa___credential_extraction_dsinternals_conversion_modules.test.yml miskoSplunk 2020-10-27 11:32:33 -07:00
  • 4ca69a1e0f Rename CredentialExtraction_SSA.ipynb to ssa___CredentialExtraction.ipynb miskoSplunk 2020-10-27 11:31:43 -07:00
  • 20d1b360b5 Rename credential_extraction_powersploit_modules_ssa.yml to ssa___credential_extraction_powersploit_modules.yml miskoSplunk 2020-10-27 11:30:47 -07:00
  • f3464264f6 Rename credential_extraction_mimikatz_modules_ssa.yml to ssa___credential_extraction_mimikatz_modules.yml miskoSplunk 2020-10-27 11:26:05 -07:00
  • c520b284f7 Rename credential_extraction_dsinternals_modules_ssa.yml to ssa___credential_extraction_dsinternals_modules.yml miskoSplunk 2020-10-27 11:25:30 -07:00
  • 8a96c46ae4 Rename credential_extraction_dsinternals_conversion_modules_ssa.yml to ssa___credential_extraction_dsinternals_conversion_modules.yml miskoSplunk 2020-10-27 11:23:15 -07:00
  • 922559d436 Credential Extraction: Adding tests, second try to push Stanislav Miskovic 2020-10-27 11:04:31 -07:00
  • ceca8c6e95 Merge branch 'develop' of github.com:splunk/security-content into TR162 Xiao Lin 2020-10-27 18:00:21 +00:00
  • caea9b2567 Merge branch 'develop' into mustang_beta Bhavin Patel 2020-10-27 09:56:04 -07:00
  • 663c7df078 Merge branch 'develop' into misko_cred_extract_APIs_and_Filenames miskoSplunk 2020-10-26 16:26:39 -07:00
  • a19a43c2f9 fixed test and detection Ignacio Bermudez Corrales 2020-10-26 14:47:50 -07:00
  • ae3a475109 added testing data for system proc in unusual location add_gitlab_ci-all-tests Ignacio Bermudez Corrales 2020-10-26 11:31:55 -07:00
  • 94704b0ccc adding missing risk scores bpatel 2020-10-26 14:18:38 -07:00
  • 79d675a88a Merge pull request #813 from splunk/add_gitlab_ci Jose Enrique Hernandez 2020-10-26 13:58:01 -04:00
  • d612466667 Merge branch 'develop' of github.com:splunk/security-content into tf23 Xiao Lin 2020-10-26 10:28:59 -07:00
  • eaaccff9fd Merge branch 'develop' of github.com:splunk/security-content into TR162 Xiao Lin 2020-10-26 17:26:33 +00:00
  • cbab59c197 Merge branch 'develop' into add_gitlab_ci-all-tests Ignacio Bermudez Corrales 2020-10-26 09:26:40 -07:00
  • 25b0334c73 Merge branch 'develop' into add_gitlab_ci Ignacio 2020-10-26 08:41:24 -07:00
  • 8c023e96fc Merge pull request #834 from splunk/dependabot/pip/cryptography-3.2 dependabot-preview[bot] 2020-10-26 02:39:03 +00:00
  • 976e9ad004 Bump cryptography from 3.1.1 to 3.2 dependabot-preview[bot] 2020-10-26 02:35:05 +00:00
  • 93f8f3a5c5 adding diagram divious1 2020-10-25 22:25:34 -04:00
  • e8c3eb0cad Merge pull request #833 from splunk/dependabot/pip/importlib-resources-3.2.0 dependabot-preview[bot] 2020-10-26 02:02:01 +00:00
  • bc6608b75d Bump importlib-resources from 3.1.1 to 3.2.0 dependabot-preview[bot] 2020-10-26 01:57:39 +00:00
  • bbf15487fb Merge pull request #832 from splunk/dependabot/pip/zipp-3.4.0 dependabot-preview[bot] 2020-10-25 19:05:40 +00:00
  • 6c5da25f17 Bump zipp from 3.3.2 to 3.4.0 dependabot-preview[bot] 2020-10-25 19:01:09 +00:00
  • 015cdc49ab Merge pull request #831 from splunk/dependabot/pip/virtualenv-20.1.0 dependabot-preview[bot] 2020-10-25 09:33:27 +00:00
  • 3dd94c8484 Bump virtualenv from 20.0.35 to 20.1.0 dependabot-preview[bot] 2020-10-25 09:29:09 +00:00
  • c729959e46 Merge pull request #830 from splunk/dependabot/pip/psutil-5.7.3 dependabot-preview[bot] 2020-10-24 14:19:43 +00:00
  • 331754f45f Bump psutil from 5.7.2 to 5.7.3 dependabot-preview[bot] 2020-10-24 14:15:03 +00:00
  • ae7ff6cd12 Merge pull request #829 from splunk/dependabot/pip/zipp-3.3.2 dependabot-preview[bot] 2020-10-24 03:21:36 +00:00
  • d65c060208 Bump zipp from 3.3.1 to 3.3.2 dependabot-preview[bot] 2020-10-24 03:17:31 +00:00
  • dca80fcc85 remove bin/validate.py from ci Ignacio Bermudez Corrales 2020-10-23 15:06:37 -07:00
  • aec8ad9712 Removed tests that had issues they should be in branch add_gitlab_ci-all-tests Ignacio Bermudez Corrales 2020-10-23 13:40:33 -07:00
  • f5b76d9e29 running validation with --skip-error to get full report Ignacio Bermudez Corrales 2020-10-23 13:02:54 -07:00
  • e1c8eb9ad7 Merge pull request #827 from splunk/dependabot/pip/boto3-1.16.4 dependabot-preview[bot] 2020-10-23 19:53:18 +00:00
  • dfe21cd833 changing ci pipeline image to python-java Ignacio Bermudez Corrales 2020-10-23 12:51:51 -07:00
  • 9f3e6c7503 Bump boto3 from 1.16.3 to 1.16.4 dependabot-preview[bot] 2020-10-23 19:49:03 +00:00
  • e1802a5b62 Merge pull request #825 from splunk/dependabot/pip/importlib-resources-3.1.1 dependabot-preview[bot] 2020-10-23 19:47:54 +00:00
  • 0ac028c238 Bump importlib-resources from 3.1.0 to 3.1.1 dependabot-preview[bot] 2020-10-23 19:43:25 +00:00
  • b0a60f7c16 Merge pull request #824 from splunk/dependabot/pip/gitpython-3.1.11 dependabot-preview[bot] 2020-10-23 19:42:08 +00:00
  • 212606838b Bump gitpython from 3.1.10 to 3.1.11 dependabot-preview[bot] 2020-10-23 19:38:37 +00:00
  • d06812bdb3 Merge pull request #826 from splunk/dependabot/pip/botocore-1.19.4 dependabot-preview[bot] 2020-10-23 19:37:22 +00:00
  • 0c33ab2b73 Bump botocore from 1.19.3 to 1.19.4 dependabot-preview[bot] 2020-10-23 19:31:07 +00:00
  • 5a992e7064 Adding executable path for java Ignacio Bermudez Corrales 2020-10-23 11:21:57 -07:00
  • 7d8bdbd754 Removed git and build due to authentication problems. Using published jar instead Ignacio Bermudez Corrales 2020-10-23 10:35:42 -07:00
  • 3139cbd8a5 Merge branch 'develop' of github.com:splunk/security-content into TR162 Xiao Lin 2020-10-23 05:03:33 +00:00
  • c08b23d281 adding smoke test for master api divious1 2020-10-22 23:33:52 -04:00
  • 9daf3049af Merge pull request #822 from splunk/dependabot/pip/gitpython-3.1.10 dependabot-preview[bot] 2020-10-23 02:39:04 +00:00
  • ac21d074c2 Bump gitpython from 3.1.9 to 3.1.10 dependabot-preview[bot] 2020-10-23 02:34:40 +00:00
  • ab646c1c36 fixed pass condition Ignacio Bermudez Corrales 2020-10-22 16:30:17 -07:00
  • 4ca51e113e Merge branch 'develop' of github.com:splunk/security-content into TR162 Xiao Lin 2020-10-22 23:08:53 +00:00