admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Commit Graph

  • 740266a3f0 Added detection testing service results inCreate Remote Thread into LSASS root 2020-09-08 16:04:29 +00:00
  • 9aacd33ed9 Added detection testing service results inAccess LSASS Memory for Dump Creation root 2020-09-08 16:04:29 +00:00
  • 2c643cc02e Added detection testing service results inDetect Path Interception By Creation Of program exe automated_detection_testing_2343 root 2020-09-08 11:52:50 +00:00
  • c48422e204 Added detection testing service results inDump LSASS via comsvcs DLL automated_detection_testing_2359 root 2020-09-08 09:49:12 +00:00
  • 802366e4d1 Added detection testing service results inDetect Credential Dumping through LSASS access root 2020-09-08 09:49:12 +00:00
  • ada125a860 Added detection testing service results inCreate Remote Thread into LSASS root 2020-09-08 09:49:12 +00:00
  • a3517da1dd Added detection testing service results inAccess LSASS Memory for Dump Creation root 2020-09-08 09:49:12 +00:00
  • db540aa779 Added detection testing service results inDump LSASS via comsvcs DLL automated_detection_testing_6666 root 2020-09-07 15:39:49 +00:00
  • 1ad788ec63 Added detection testing service results inDetect Credential Dumping through LSASS access root 2020-09-07 15:39:49 +00:00
  • de9d7235c1 Added detection testing service results inCreate Remote Thread into LSASS root 2020-09-07 15:39:49 +00:00
  • 047ead644a Added detection testing service results inAccess LSASS Memory for Dump Creation root 2020-09-07 15:39:49 +00:00
  • ba09fa2eea Added detection testing service results inDump LSASS via comsvcs DLL automated_detection_testing_34 root 2020-09-07 14:48:46 +00:00
  • 31e9a1212e Added detection testing service results inDetect Credential Dumping through LSASS access root 2020-09-07 14:48:46 +00:00
  • 0f36d1ea32 Added detection testing service results inCreate Remote Thread into LSASS root 2020-09-07 14:48:46 +00:00
  • e460217cef Added detection testing service results inAccess LSASS Memory for Dump Creation root 2020-09-07 14:48:46 +00:00
  • 56b765510f Added detection testing service results inDump LSASS via comsvcs DLL automated_detection_testing_2309 root 2020-09-07 14:13:24 +00:00
  • cc85ef364b Added detection testing service results inDetect Credential Dumping through LSASS access root 2020-09-07 14:13:24 +00:00
  • d70661985c Added detection testing service results inCreate Remote Thread into LSASS root 2020-09-07 14:13:24 +00:00
  • 56e4b92de1 Added detection testing service results inAccess LSASS Memory for Dump Creation root 2020-09-07 14:13:24 +00:00
  • e109d53aa9 Added detection testing service results inDump LSASS via comsvcs DLL automated_detection_testing_1755 root 2020-09-07 11:53:27 +00:00
  • bab355aaeb Added detection testing service results inDetect Credential Dumping through LSASS access root 2020-09-07 11:53:27 +00:00
  • b90bdb070d Added detection testing service results inCreate Remote Thread into LSASS root 2020-09-07 11:53:27 +00:00
  • 17c2b32a77 Added detection testing service results inAccess LSASS Memory for Dump Creation root 2020-09-07 11:53:27 +00:00
  • 66f74754f6 Merge pull request #646 from splunk/update_test_files P4T12ICK 2020-09-07 13:27:51 +02:00
  • 52672944d6 Added detection testing service results inDump LSASS via comsvcs DLL automated_detection_testing_3103 root 2020-09-07 11:19:08 +00:00
  • 490a3b4cc8 Added detection testing service results inDetect Credential Dumping through LSASS access root 2020-09-07 11:19:08 +00:00
  • 2a0ec17776 Added detection testing service results inCreate Remote Thread into LSASS root 2020-09-07 11:19:08 +00:00
  • af0bb8f3d4 Added detection testing service results inAccess LSASS Memory for Dump Creation root 2020-09-07 11:19:08 +00:00
  • 3e0cfa84cb updated test files update_test_files P4T12ICK 2020-09-07 13:18:03 +02:00
  • 84d269e531 Added detection testing service results inDump LSASS via comsvcs DLL automated_detection_testing_3262 root 2020-09-07 09:22:31 +00:00
  • 1e54b83548 Added detection testing service results inDetect Credential Dumping through LSASS access root 2020-09-07 09:22:31 +00:00
  • 38c27abb61 Added detection testing service results inCreate Remote Thread into LSASS root 2020-09-07 09:22:31 +00:00
  • 7013a56379 Added detection testing service results inAccess LSASS Memory for Dump Creation root 2020-09-07 09:22:31 +00:00
  • a71bedb45a Added detection testing service results inUnsigned Image Loaded by LSASS automated_detection_testing_4418 root 2020-09-07 08:52:45 +00:00
  • ce708abe4e Added detection testing service results inDump LSASS via comsvcs DLL root 2020-09-07 08:52:45 +00:00
  • 710653f996 Added detection testing service results inDetect Credential Dumping through LSASS access root 2020-09-07 08:52:45 +00:00
  • 95aef7faea Added detection testing service results inCreate Remote Thread into LSASS root 2020-09-07 08:52:45 +00:00
  • 2ce8d01d36 Added detection testing service results inAccess LSASS Memory for Dump Creation root 2020-09-07 08:52:45 +00:00
  • 8400f241ca Merge pull request #642 from splunk/dependabot/pip/identify-1.5.0 dependabot-preview[bot] 2020-09-05 19:41:11 +00:00
  • e6d5e4eda7 Bump identify from 1.4.30 to 1.5.0 dependabot-preview[bot] 2020-09-05 19:34:10 +00:00
  • 8361e993be Merge pull request #641 from splunk/dependabot/pip/attrs-20.2.0 dependabot-preview[bot] 2020-09-05 10:43:31 +00:00
  • 443de49218 Bump attrs from 20.1.0 to 20.2.0 dependabot-preview[bot] 2020-09-05 10:37:59 +00:00
  • f9b2c816db minor naming bug bpatel 2020-09-04 13:52:49 -07:00
  • 10a5b76af7 merge with develop bpatel 2020-09-04 13:40:15 -07:00
  • d12a38e8ff adding new stories to response bpatel 2020-09-04 13:38:05 -07:00
  • cea3735f1a updates to ymls to make sure validate passes bpatel 2020-09-04 13:31:16 -07:00
  • 7b098cf836 fixed validate issues David Dorsey 2020-09-04 13:13:22 -05:00
  • dbfecd9e29 New analytic story for suspicious cloud user activities. David Dorsey 2020-09-04 10:30:47 -05:00
  • cb5761a251 Added needed macros and lookups David Dorsey 2020-09-04 09:26:10 -05:00
  • e8bf1d9e96 updates for mustang Rico Valdez 2020-09-03 17:10:02 -06:00
  • 637ec487df risk validation bpatel 2020-09-03 11:30:09 -07:00
  • 20b1130737 Merge branch 'TR-82-risk-tagging' of https://github.com/splunk/security-content into TR-82-risk-tagging bpatel 2020-09-03 11:10:26 -07:00
  • 11db020423 risk validation bpatel 2020-09-03 11:09:52 -07:00
  • 8ead727df7 Merge branch 'TR-41_aws_ec2_mods' of github.com:splunk/security-content into TR-41_aws_ec2_mods merging in updates Rico Valdez 2020-09-03 11:10:48 -06:00
  • e9939cbc98 new files for unblocked searches Rico Valdez 2020-09-03 11:10:14 -06:00
  • d82a74122d Merge branch 'TR-41_aws_ec2_mods' of github.com:splunk/security-content into TR-41_aws_ec2_mods David Dorsey 2020-09-03 00:32:46 -05:00
  • ffbd700110 Updates David Dorsey 2020-09-03 00:32:36 -05:00
  • ee38b1d8cd [TR-82] reset markdown to whats in develop. jzsplunk 2020-09-02 12:07:14 -07:00
  • 367dd69bd7 generate testing bpatel 2020-09-02 11:07:08 -07:00
  • 220759a7d1 updates TR-137 bpatel 2020-09-02 11:02:42 -07:00
  • 1fac31b330 [TR-82] reset markdown to whats in develop. jzsplunk 2020-09-02 10:44:22 -07:00
  • a75e4fcc85 detection - may still change name Rico Valdez 2020-09-02 10:31:50 -06:00
  • f7498459c8 changes for mustang Rico Valdez 2020-09-02 10:21:52 -06:00
  • 0db46f89dc [TR-82] first cut of validation logic for risk scoring. jzsplunk 2020-09-01 17:55:14 -07:00
  • 5690c95392 fixedreferencesgcpoauthdetection Rod Soto 2020-09-01 20:44:10 -04:00
  • 66404dbcbe firstshotgcpaoutabusedetection Rod Soto 2020-09-01 20:42:54 -04:00
  • 5efea5eb85 Merge branch 'develop' into TR-82-risk-tagging jzsplunk 2020-09-01 17:12:21 -07:00
  • e3633953d9 Merge pull request #634 from splunk/dependabot/pip/identify-1.4.30 dependabot-preview[bot] 2020-09-01 07:56:09 +00:00
  • 77e2a8e22d Bump identify from 1.4.29 to 1.4.30 dependabot-preview[bot] 2020-09-01 07:51:15 +00:00
  • 2ed48b0016 TR-159_linux_rootkits divious1 2020-08-31 21:37:58 -04:00
  • 6456cb2449 Merge pull request #633 from splunk/dependabot/pip/more-itertools-8.5.0 dependabot-preview[bot] 2020-08-28 18:51:17 +00:00
  • 9d3694b18e Bump more-itertools from 8.4.0 to 8.5.0 dependabot-preview[bot] 2020-08-28 18:45:53 +00:00
  • bda59e0708 Merge branch 'TR-41_aws_ec2_mods' of github.com:splunk/security-content into TR-41_aws_ec2_mods Rico Valdez 2020-08-28 10:18:40 -06:00
  • 662d680870 more updates Rico Valdez 2020-08-28 10:12:55 -06:00
  • 5e9f3a7ae0 Merge branch 'develop' into fixedawsstsassumerole Rod Soto 2020-08-27 21:08:51 -04:00
  • a2688815db Merge branch 'develop' into TR-82-risk-tagging Jose Enrique Hernandez 2020-08-27 16:48:15 -04:00
  • 346fcc2a18 updating docs and package bits [ci skip] research bot 2020-08-27 18:42:27 +00:00
  • 48100ebb96 fixedaws_dete_role_creation Rod Soto 2020-08-27 14:12:34 -04:00
  • 0b9dd4ca9b Fixed validate script errors David Dorsey 2020-08-26 23:50:25 -05:00
  • 0c7efecd12 Fixed errors found by validate script David Dorsey 2020-08-26 23:47:26 -05:00
  • e2f786ef0a Fixed a horrible bug that Patrick introduced in the validate script David Dorsey 2020-08-26 23:42:50 -05:00
  • d662b0538d Removed unused file David Dorsey 2020-08-26 23:17:03 -05:00
  • 0a47f73352 Updated cloud instances destroyed to change data model David Dorsey 2020-08-26 22:57:45 -05:00
  • d04d0e9d69 fixedassumedroleaws Rod Soto 2020-08-26 16:56:54 -04:00
  • b48b40ff76 Updated search for abnormally high cloud instances. Including verifying that enough data is there David Dorsey 2020-08-25 22:28:59 -05:00
  • bb54641af6 Merge branch 'develop' into response_phases Jose Enrique Hernandez 2020-08-25 18:57:46 -04:00
  • 339e117806 skeleton divious1 2020-08-25 18:56:44 -04:00
  • 2a13216059 Merge pull request #625 from splunk/coverage_update v3.0.6 Bhavin Patel 2020-08-25 11:31:23 -07:00
  • ac69800ab4 Merge branch 'develop' into coverage_update coverage_update Bhavin Patel 2020-08-25 11:26:03 -07:00
  • f58ded02dc Merge branch 'develop' into TR-82-risk-tagging Bhavin Patel 2020-08-25 09:44:32 -07:00
  • 463f218ef9 Merge pull request #619 from splunk/PR_609 Jose Enrique Hernandez 2020-08-25 12:19:00 -04:00
  • a66740b506 Merge branch 'develop' into PR_609 PR_609 Jose Enrique Hernandez 2020-08-25 12:13:24 -04:00
  • 00653ac542 Merge pull request #623 from splunk/fixawsk8sfailuresrcuser Bhavin Patel 2020-08-24 12:47:10 -07:00
  • 3097f4e692 [TR-82] cleanup spec markdown for new risk params. jzsplunk 2020-08-24 10:34:09 -07:00
  • 86708a89e2 [TR-82] fix savedsearches annotations logic. jzsplunk 2020-08-24 10:24:29 -07:00
  • 5eb6c522c6 Merge branch 'develop' into PR_609 Jose Enrique Hernandez 2020-08-24 12:50:54 -04:00
  • f97c0c6d83 Merge pull request #612 from inspired/mbjerkeland-develop Jose Enrique Hernandez 2020-08-24 12:50:38 -04:00
  • d140413a50 Merge branch 'develop' into PR_609 Jose Enrique Hernandez 2020-08-24 12:42:12 -04:00
  • 98e2127d89 Merge branch 'develop' into mbjerkeland-develop Jose Enrique Hernandez 2020-08-24 12:41:57 -04:00
  • 27cbc9136b Merge branch 'develop' into coverage_update Jose Enrique Hernandez 2020-08-24 12:41:43 -04:00