admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • c341614465 new files for unblocked searches Rico Valdez 2020-09-03 11:10:14 -06:00
  • 101702c623 detection - may still change name Rico Valdez 2020-09-02 10:31:50 -06:00
  • 03245f6372 changes for mustang Rico Valdez 2020-09-02 10:21:52 -06:00
  • a2b98fa8f7 Fixed validate script errors David Dorsey 2020-08-26 23:50:25 -05:00
  • 5addb1eca4 Fixed errors found by validate script David Dorsey 2020-08-26 23:47:26 -05:00
  • 79c108b949 Fixed a horrible bug that Patrick introduced in the validate script David Dorsey 2020-08-26 23:42:50 -05:00
  • 4bd7eae3c8 Removed unused file David Dorsey 2020-08-26 23:17:03 -05:00
  • 181f810dbb Updated cloud instances destroyed to change data model David Dorsey 2020-08-26 22:57:45 -05:00
  • 7d35bc9947 Remove show_options peter-cg 2020-09-15 09:45:45 -07:00
  • d7d22e8809 Merge branch 'TR-41_aws_ec2_mods' of github.com:splunk/security-content into TR-41_aws_ec2_mods David Dorsey 2020-09-15 10:30:16 -05:00
  • 3e420d4cf5 Changed object to object_id David Dorsey 2020-09-15 10:30:02 -05:00
  • 9f54f90aee Merge branch 'develop' into TR-41_aws_ec2_mods Bhavin Patel 2020-09-14 14:12:25 -07:00
  • 1f56396028 Updated search for abnormally high cloud instances. Including verifying that enough data is there David Dorsey 2020-08-25 22:28:59 -05:00
  • 6fd7b6ef2f more updates Rico Valdez 2020-08-28 10:12:55 -06:00
  • aedfc4e837 Created manifests for unseen city, region, and country and updated logic to reflect each case David Dorsey 2020-08-20 14:07:21 -05:00
  • 56d0abdc31 Manifest cleanup David Dorsey 2020-08-20 13:15:14 -05:00
  • 2f1f96c804 Updated baseline searches for cloud provisioning activities. Broke them out into an initial search and update search Updated them to use kv store Updated Cloud Provisioning from previously unseen ip address to relfect changes in baseline searches. Added new fields to make the detection more actionable Added the lookup manifest and a macro manifest David Dorsey 2020-08-19 10:28:05 -05:00
  • e042b84f82 work in progress file Rico Valdez 2020-08-18 17:01:29 -06:00
  • 3c5f75c452 Removed a few API calls that are not really modifications David Dorsey 2020-08-18 13:47:04 -05:00
  • 481fb128c6 new files for translated detections Rico Valdez 2020-08-18 16:38:38 -06:00
  • bb5384564a new files - not finalized Rico Valdez 2020-08-18 16:38:13 -06:00
  • 60456b9e9a some translated searches for change DM Rico Valdez 2020-08-08 18:04:57 -06:00
  • 02ac11cfd8 Merge branch 'develop' into gcpoauth Bhavin Patel 2020-09-14 13:24:54 -07:00
  • f1ebf3b8d5 formatting error bpatel 2020-09-14 13:23:55 -07:00
  • 52739bc3ab yml updates bpatel 2020-09-14 13:12:51 -07:00
  • 57ee3f98a5 addedref Rod Soto 2020-09-14 15:56:03 -04:00
  • 80e2fd37d6 fixedawsforgcp Rod Soto 2020-09-14 15:33:39 -04:00
  • 9b785919de validate fixes David Dorsey 2020-09-10 21:22:34 -05:00
  • 3efae7ccef cron_schedule fixed David Dorsey 2020-09-10 20:52:24 -05:00
  • 97dd7e357b Small updates David Dorsey 2020-09-10 20:49:00 -05:00
  • 414a0f19d8 Added detection testing service results inAttempted Credential Dump From Registry via Reg exe automated_detection_testing_9208 root 2020-09-10 21:58:00 +00:00
  • 2e12dbe9d7 Added detection testing service results inDump LSASS via comsvcs DLL automated_detection_testing_1814 root 2020-09-10 21:28:45 +00:00
  • 8337006ce7 Added detection testing service results inDetect Credential Dumping through LSASS access root 2020-09-10 21:28:45 +00:00
  • fafcb10ccf Added detection testing service results inCreate Remote Thread into LSASS root 2020-09-10 21:28:45 +00:00
  • 4c6fc66da1 Added detection testing service results inAccess LSASS Memory for Dump Creation root 2020-09-10 21:28:45 +00:00
  • 796617a83c Merge branch 'develop' into fixedawsstsassumerole Bhavin Patel 2020-09-10 13:26:07 -07:00
  • ef3fee0a81 Update aws_detect_sts_assume_role_abuse.yml Bhavin Patel 2020-09-10 13:25:39 -07:00
  • b3eeaef59d tweaks and updates Rico Valdez 2020-09-10 14:19:45 -06:00
  • 2fadf948da Merge pull request #630 from splunk/TR-82-risk-tagging Jose Enrique Hernandez 2020-09-10 12:23:59 -04:00
  • 8daac1602b Merge branch 'TR-82-risk-tagging' of github.com:splunk/security-content into TR-82-risk-tagging divious1 2020-09-10 12:17:26 -04:00
  • 9bfc5f9f4e updated spec docs and also added one more example divious1 2020-09-10 12:17:21 -04:00
  • c76fc34e3f Merge branch 'develop' into TR-82-risk-tagging Jose Enrique Hernandez 2020-09-09 23:33:03 -04:00
  • 75c8ef7c95 fixed up base on validate errors divious1 2020-09-09 23:18:56 -04:00
  • d04c937454 added better error handling for macros that are missing divious1 2020-09-09 23:17:52 -04:00
  • 8cfa698e94 adding falco detection divious1 2020-09-09 22:49:39 -04:00
  • 83015eba59 latest updates to create in new vendor_region Rico Valdez 2020-09-09 16:26:25 -06:00
  • bff7706c74 Merge branch 'develop' into response_phases Jose Enrique Hernandez 2020-09-09 16:07:21 -04:00
  • ec7dd03c95 loud cloud peter-cg 2020-09-09 12:25:52 -07:00
  • 5da11f0f25 Added detection testing service results inDump LSASS via comsvcs DLL automated_detection_testing_9659 root 2020-09-09 17:59:22 +00:00
  • 6d8073cfef Added detection testing service results inDetect Credential Dumping through LSASS access root 2020-09-09 17:59:22 +00:00
  • ab2be31ff7 Added detection testing service results inCreate Remote Thread into LSASS root 2020-09-09 17:59:22 +00:00
  • 7a9569429a Added detection testing service results inAccess LSASS Memory for Dump Creation root 2020-09-09 17:59:21 +00:00
  • 66d9898cc8 Added detection testing service results inDump LSASS via comsvcs DLL automated_detection_testing_7313 root 2020-09-09 14:42:08 +00:00
  • b7be6a7b67 Added detection testing service results inDetect Credential Dumping through LSASS access root 2020-09-09 14:42:08 +00:00
  • 3c13e83db1 Added detection testing service results inCreate Remote Thread into LSASS root 2020-09-09 14:42:08 +00:00
  • 7e74b1290b Added detection testing service results inAccess LSASS Memory for Dump Creation root 2020-09-09 14:42:08 +00:00
  • 7f7d03cf33 adding link to aws secret manager Jose Enrique Hernandez 2020-09-09 10:39:25 -04:00
  • 0fe7693307 add automated detection service code P4T12ICK 2020-09-09 16:16:54 +02:00
  • 17655837cc Added detection testing service results inDump LSASS via comsvcs DLL automated_detection_testing_817 root 2020-09-09 13:43:41 +00:00
  • 22a4fbf830 Added detection testing service results inDetect Credential Dumping through LSASS access root 2020-09-09 13:43:41 +00:00
  • 968b190644 Added detection testing service results inCreate Remote Thread into LSASS root 2020-09-09 13:43:41 +00:00
  • 41de9ff153 Added detection testing service results inAccess LSASS Memory for Dump Creation root 2020-09-09 13:43:40 +00:00
  • 25ffc98279 Added detection testing service results inDump LSASS via comsvcs DLL automated_detection_testing_1591 root 2020-09-09 12:25:01 +00:00
  • 386ede22ec Added detection testing service results inDetect Credential Dumping through LSASS access root 2020-09-09 12:25:01 +00:00
  • ed7d376548 Added detection testing service results inCreate Remote Thread into LSASS root 2020-09-09 12:25:01 +00:00
  • ae7a648e72 Added detection testing service results inAccess LSASS Memory for Dump Creation root 2020-09-09 12:25:00 +00:00
  • b9d5bc8815 Added detection testing service results inDump LSASS via comsvcs DLL automated_detection_testing_8150 root 2020-09-09 11:07:40 +00:00
  • 0a7a524ad0 Added detection testing service results inDetect Credential Dumping through LSASS access root 2020-09-09 11:07:40 +00:00
  • b56faf1c49 Added detection testing service results inCreate Remote Thread into LSASS root 2020-09-09 11:07:40 +00:00
  • 3ac8ea9a46 Added detection testing service results inAccess LSASS Memory for Dump Creation root 2020-09-09 11:07:40 +00:00
  • f76e66d184 Merge pull request #659 from splunk/dependabot/pip/pyrsistent-0.17.2 dependabot-preview[bot] 2020-09-09 09:47:32 +00:00
  • 8d1b7e1395 Bump pyrsistent from 0.17.1 to 0.17.2 dependabot-preview[bot] 2020-09-09 09:42:22 +00:00
  • 07db19f80b Added detection testing service results inDump LSASS via comsvcs DLL automated_detection_testing_1604 root 2020-09-09 09:20:49 +00:00
  • 17c323f1f6 Added detection testing service results inDetect Credential Dumping through LSASS access root 2020-09-09 09:20:49 +00:00
  • 3a85e2435f Added detection testing service results inCreate Remote Thread into LSASS root 2020-09-09 09:20:49 +00:00
  • 60e0b753a8 Added detection testing service results inAccess LSASS Memory for Dump Creation root 2020-09-09 09:20:49 +00:00
  • f13a8d3ceb Added detection testing service results inDump LSASS via comsvcs DLL automated_detection_testing_6937 root 2020-09-09 08:15:31 +00:00
  • bc2a87f26e Added detection testing service results inDetect Credential Dumping through LSASS access root 2020-09-09 08:15:31 +00:00
  • 3055bb469f Added detection testing service results inCreate Remote Thread into LSASS root 2020-09-09 08:15:31 +00:00
  • 77903db2dd Added detection testing service results inAccess LSASS Memory for Dump Creation root 2020-09-09 08:15:31 +00:00
  • 9cdc721ad6 Merge pull request #656 from splunk/dependabot/pip/pyrsistent-0.17.1 dependabot-preview[bot] 2020-09-09 07:36:36 +00:00
  • 027b8ce1a1 Bump pyrsistent from 0.17.0 to 0.17.1 dependabot-preview[bot] 2020-09-09 07:31:42 +00:00
  • fc99713981 Translated detections/detect_spike_in_security_group_activity.yml David Dorsey 2020-09-09 01:36:26 -05:00
  • adf19afe6a Updated baseline searches to have correct deployment. Which was also created David Dorsey 2020-09-09 01:35:38 -05:00
  • d588bbc8f6 Translated detect_spike_in_aws_api_activity.yml to use Change DM David Dorsey 2020-09-09 01:01:16 -05:00
  • 0748b5e8ee bug fixes David Dorsey 2020-09-09 01:00:45 -05:00
  • 3697092a4b Updated MLTK searches based on Peter's work David Dorsey 2020-09-08 22:49:16 -05:00
  • 691a46e468 skeleton of linux rootkit story divious1 2020-09-08 19:58:34 -04:00
  • 3b69af66a7 Adding cloud NACL deletion detection peter-cg 2020-09-08 14:09:24 -07:00
  • a0bad4ef74 Revert "Converting ACL deletion detection from Cloudtrail to Change DM" peter-cg 2020-09-08 13:49:08 -07:00
  • 3159472018 Converting ACL deletion detection from Cloudtrail to Change DM peter-cg 2020-09-08 13:44:10 -07:00
  • 83a35dcc65 Merge pull request #655 from splunk/dependabot/pip/pyrsistent-0.17.0 dependabot-preview[bot] 2020-09-08 19:42:40 +00:00
  • c8a4d57195 Bump pyrsistent from 0.16.0 to 0.17.0 dependabot-preview[bot] 2020-09-08 19:38:00 +00:00
  • 19f3778dda Merge branch 'develop' into TR-82-risk-tagging jzsplunk 2020-09-08 09:52:12 -07:00
  • aeaf3775f2 Added detection testing service results inDump LSASS via comsvcs DLL automated_detection_testing_5355 root 2020-09-08 16:12:58 +00:00
  • 255bb964ef Added detection testing service results inDetect Credential Dumping through LSASS access root 2020-09-08 16:12:58 +00:00
  • 48ab198f19 Added detection testing service results inCreate Remote Thread into LSASS root 2020-09-08 16:12:58 +00:00
  • c867d9512b Added detection testing service results inAccess LSASS Memory for Dump Creation root 2020-09-08 16:12:58 +00:00
  • 2de1f17a7b Added detection testing service results inDump LSASS via comsvcs DLL automated_detection_testing_706 root 2020-09-08 16:04:29 +00:00
  • 99839d2635 Added detection testing service results inDetect Credential Dumping through LSASS access root 2020-09-08 16:04:29 +00:00