Commit Graph

  • 60bc58adfb Bump cfgv from 3.1.0 to 3.2.0 dependabot-preview[bot] 2020-07-31 18:01:40 +00:00
  • f79e2dac3c Merge pull request #603 from splunk/dependabot/pip/virtualenv-20.0.29 dependabot-preview[bot] 2020-07-31 18:00:28 +00:00
  • 3d4f62dfba Bump virtualenv from 20.0.28 to 20.0.29 dependabot-preview[bot] 2020-07-31 17:54:51 +00:00
  • 772d7a237f Merge branch 'develop' into removing_slack_from_ci Jose Enrique Hernandez 2020-07-29 23:11:15 -04:00
  • f72ec831a2 removed slack notifications they break PRs divious1 2020-07-29 23:08:21 -04:00
  • d2913cbd50 Merge branch 'develop' into relative_path_and_type_consideration Jose Enrique Hernandez 2020-07-29 15:06:10 -04:00
  • 267730094d Merge pull request #593 from splunk/TR038-create-local-admin-accounts-using-net-exe P4T12ICK 2020-07-29 11:09:17 +02:00
  • bd1c4d8231 merged with develop Patrick Bareiss 2020-07-29 11:03:54 +02:00
  • b34f553837 updated test files Patrick Bareiss 2020-07-29 11:01:13 +02:00
  • d0aa56f92c updated test files Patrick Bareiss 2020-07-29 11:00:22 +02:00
  • ed7b65bfab merged with develop Patrick Bareiss 2020-07-29 10:55:23 +02:00
  • 9d7a8c2e3e Merge branch 'develop' into TR038-create-local-admin-accounts-using-net-exe Patrick Bareiss 2020-07-29 10:55:02 +02:00
  • f09d5222ef Merge pull request #575 from splunk/TR037-process-execution-via-wmi P4T12ICK 2020-07-29 10:12:23 +02:00
  • fc0a62a347 updated CI pipeline Patrick Bareiss 2020-07-29 10:06:06 +02:00
  • a93c669aac Merge branch 'develop' into TR037-process-execution-via-wmi P4T12ICK 2020-07-29 10:03:09 +02:00
  • 3f93f64bfd [TR-038] update mitre id for detection. add test for net exe specific behavior Joseph Zadeh 2020-07-28 11:47:58 -07:00
  • a4e1a402ca anothererrorfixed Rod Soto 2020-07-28 12:03:21 -04:00
  • d597c6f64c Merge branch 'develop' into nocaps Rod Soto 2020-07-28 11:53:17 -04:00
  • 182b0551aa fixedsearch Rod Soto 2020-07-28 11:52:34 -04:00
  • ee69edcd44 Merge pull request #592 from splunk/detection_testing_combined P4T12ICK 2020-07-28 15:55:53 +02:00
  • 074b782dd0 detection tested Patrick Bareiss 2020-07-28 15:43:57 +02:00
  • dd0e6caf00 merged multiple test detections Patrick Bareiss 2020-07-28 14:22:53 +02:00
  • 1619908a32 merged Patrick Bareiss 2020-07-28 14:20:39 +02:00
  • 004eeb2347 merged Patrick Bareiss 2020-07-28 14:20:14 +02:00
  • 3e9f00b376 tested detection Patrick Bareiss 2020-07-28 14:17:21 +02:00
  • 8db3edafe2 tested detection Patrick Bareiss 2020-07-28 14:17:10 +02:00
  • f53f148f00 seeifitworks Rod Soto 2020-07-28 08:10:19 -04:00
  • 9b3a81da87 fixedsearches Rod Soto 2020-07-28 07:46:50 -04:00
  • d2752c13f9 successful tested Patrick Bareiss 2020-07-28 11:14:53 +02:00
  • f74a0fe273 successful tested Patrick Bareiss 2020-07-28 11:14:34 +02:00
  • 6e950137cb Merge branch 'develop' into TR-33_schtasks_scheduling_job_on_remote_system TR-33_schtasks_scheduling_job_on_remote_system P4T12ICK 2020-07-28 09:29:48 +02:00
  • 46fa587782 minor improvement CI job ci_improvements Patrick Bareiss 2020-07-28 09:27:43 +02:00
  • ba11f8f183 awslm5searches Rod Soto 2020-07-27 20:33:01 -04:00
  • 1ac5d3fca4 awslm3rd Rod Soto 2020-07-27 19:19:10 -04:00
  • 9f2c49f532 2searchstsassumerole Rod Soto 2020-07-27 17:57:12 -04:00
  • 3584bb4a31 newawslmsearches Rod Soto 2020-07-27 17:20:05 -04:00
  • cdf0c769b9 updating search to use action field bpatel 2020-07-24 17:14:18 -07:00
  • 6372bbd532 Merge pull request #581 from splunk/pretty_printing_search Bhavin Patel 2020-07-24 15:56:58 -07:00
  • 025a161f7b Update smb_traffic_spike.yml Jose Enrique Hernandez 2020-07-24 12:32:22 -04:00
  • 4167531536 updated CI Patrick Bareiss 2020-07-24 16:13:20 +02:00
  • 35ce8cc953 Merge branch 'develop' into TR-33_schtasks_scheduling_job_on_remote_system Patrick Bareiss 2020-07-24 16:12:05 +02:00
  • a21c34870f test detection Patrick Bareiss 2020-07-24 15:07:56 +02:00
  • 8e61333d8c Merge pull request #579 from splunk/dependabot/pip/virtualenv-20.0.28 dependabot-preview[bot] 2020-07-24 09:04:52 +00:00
  • 97f5fa4e1e Bump virtualenv from 20.0.27 to 20.0.28 dependabot-preview[bot] 2020-07-24 08:59:29 +00:00
  • a1b6692832 uuid bug bpatel 2020-07-23 16:14:47 -07:00
  • 4281799b17 first versions of the updated searches bpatel 2020-07-23 16:13:30 -07:00
  • c625d06123 Merge remote-tracking branch 'fork/develop' into relative_path_and_type_consideration divious1 2020-07-23 14:33:04 -04:00
  • dbb70b8f54 Merge pull request #577 from splunk/move_ci_us_east-2 trogdorsey 2020-07-23 09:58:42 -05:00
  • 320a491f61 moving job to us-east-2 seperating from our usual work region divious1 2020-07-23 10:46:18 -04:00
  • c276041a41 Updated Jinja2 Template to accept Type Kyle Fondren 2020-07-22 15:23:37 -04:00
  • 55a5169200 change to use absolute path - fixed quote style Kyle Fondren 2020-07-22 14:33:26 -04:00
  • b04e4a01d0 fixed missing '+' in named fields Kyle Fondren 2020-07-22 14:14:55 -04:00
  • 1d72b16961 Added logic to include type in naming convention Kyle Fondren 2020-07-22 14:06:50 -04:00
  • 4d30e91f05 updated output_path to use path.join over concat Kyle Fondren 2020-07-22 13:28:55 -04:00
  • f579091b4a Merge pull request #572 from splunk/dependabot/pip/identify-1.4.25 dependabot-preview[bot] 2020-07-22 16:12:31 +00:00
  • a3f66a086f Bump identify from 1.4.24 to 1.4.25 dependabot-preview[bot] 2020-07-22 16:07:26 +00:00
  • fb90eb2e49 Merge pull request #574 from splunk/dependabot/pip/urllib3-1.25.10 dependabot-preview[bot] 2020-07-22 16:06:08 +00:00
  • 75f0490888 Bump urllib3 from 1.25.9 to 1.25.10 dependabot-preview[bot] 2020-07-22 16:01:23 +00:00
  • 255c50131d Merge pull request #573 from splunk/update_sub_techniques Jose Enrique Hernandez 2020-07-22 11:32:41 -04:00
  • ce279c60af [TR-037] test for process execution via WMI (no mitre sub-technique for this attack type). Joseph Zadeh 2020-07-22 08:30:02 -07:00
  • d163dc0158 Merge pull request #571 from splunk/bug_fix_generate Jose Enrique Hernandez 2020-07-22 10:49:29 -04:00
  • 219c2a68c7 converted detections to subtechniques Patrick Bareiss 2020-07-22 11:01:06 +02:00
  • a38b71f11d converted detections to subtechniques Patrick Bareiss 2020-07-22 10:59:55 +02:00
  • e7966e76b1 converted detections to subtechniques Patrick Bareiss 2020-07-22 10:45:43 +02:00
  • bd0e7ca2ba converted detections to subtechniques Patrick Bareiss 2020-07-22 10:34:54 +02:00
  • 5ceef308a7 bug fix generate script Patrick Bareiss 2020-07-21 10:12:58 +02:00
  • 1822b485d7 Merge pull request #568 from splunk/newgcpk8podsearch Bhavin Patel 2020-07-20 11:14:56 -07:00
  • 2d9eaf695f Merge branch 'develop' into newgcpk8podsearch Bhavin Patel 2020-07-20 10:47:42 -07:00
  • bb906c721a Update gcp_kubernetes_cluster_pod_scan_detection.yml Bhavin Patel 2020-07-20 10:47:18 -07:00
  • 24c0354c3f Merge pull request #569 from splunk/dependabot/pip/identify-1.4.24 dependabot-preview[bot] 2020-07-19 18:37:19 +00:00
  • 86e7b4f3b9 Bump identify from 1.4.23 to 1.4.24 dependabot-preview[bot] 2020-07-19 18:32:06 +00:00
  • ef98461e89 newgcpk8podsearch Rod Soto 2020-07-17 22:11:19 -04:00
  • f2b605fcbc gcppodscan gcppodscandetection Rod Soto 2020-07-17 21:52:31 -04:00
  • 7f95b60210 Merge pull request #566 from splunk/dependabot/pip/taxii2-client-2.2.1 dependabot-preview[bot] 2020-07-17 19:44:08 +00:00
  • c767fe1cd8 Bump taxii2-client from 2.2.0 to 2.2.1 dependabot-preview[bot] 2020-07-17 19:37:50 +00:00
  • cd86c0ccc7 Merge pull request #564 from splunk/dependabot/pip/simplejson-3.17.2 dependabot-preview[bot] 2020-07-16 18:51:40 +00:00
  • 28b5150604 Bump simplejson from 3.17.0 to 3.17.2 dependabot-preview[bot] 2020-07-16 18:46:24 +00:00
  • 23cf6ae542 updating docs and package bits [ci skip] research bot 2020-07-15 21:14:02 +00:00
  • a079a093b8 Merge pull request #563 from splunk/yet_another_map_bug v3.0.4 Bhavin Patel 2020-07-15 13:59:40 -07:00
  • 440fcfb3ae fixed print msg divious1 2020-07-15 16:53:49 -04:00
  • 217aabfe72 forgot to get rid of tdqm divious1 2020-07-15 16:46:37 -04:00
  • 8ef987da5d Merge pull request #562 from splunk/mitre_map_bug Bhavin Patel 2020-07-15 13:26:14 -07:00
  • a250cceed2 minor arg bug divious1 2020-07-15 16:19:40 -04:00
  • 9b08ad29c1 Merge pull request #560 from splunk/dependabot/pip/virtualenv-20.0.27 dependabot-preview[bot] 2020-07-15 18:56:17 +00:00
  • 6cd1b26d36 Merge branch 'develop' into dependabot/pip/virtualenv-20.0.27 Jose Enrique Hernandez 2020-07-15 14:51:44 -04:00
  • 9c23451998 Merge pull request #561 from splunk/TR-49 Jose Enrique Hernandez 2020-07-15 14:51:21 -04:00
  • c1747aaa21 Merge branch 'develop' into TR-49 Bhavin Patel 2020-07-15 10:29:46 -07:00
  • a1a2ce7e0c Merge pull request #559 from splunk/update_README Bhavin Patel 2020-07-15 10:26:24 -07:00
  • d7a324cb01 Bump virtualenv from 20.0.26 to 20.0.27 dependabot-preview[bot] 2020-07-15 17:22:31 +00:00
  • d5e560c4d6 Merge branch 'develop' into update_README Bhavin Patel 2020-07-15 10:15:33 -07:00
  • b034e224c4 Merge pull request #547 from splunk/mitre_maps Bhavin Patel 2020-07-15 10:15:09 -07:00
  • 52f8c45892 Merge branch 'develop' into update_README Bhavin Patel 2020-07-15 10:12:29 -07:00
  • 73507de98c updating spl and FP bpatel 2020-07-14 17:50:43 -07:00
  • 170660e742 fixing space divious1 2020-07-14 16:13:28 -04:00
  • c2a89d1dd7 adding mitre map to readme divious1 2020-07-14 16:05:26 -04:00
  • d23064ec18 Merge pull request #557 from splunk/gcpk8plussearches Bhavin Patel 2020-07-14 11:32:30 -07:00
  • 48ee5353bd overhauled or readme divious1 2020-07-14 00:11:11 -04:00
  • ea717a66fc adding ffilter, sigh bpatel 2020-07-13 17:05:30 -07:00
  • 68ee505590 Merge branch 'develop' into gcpk8plussearches Bhavin Patel 2020-07-13 16:45:48 -07:00
  • 7475e16264 Merge pull request #558 from splunk/dependabot/pip/typing-3.7.4.3 dependabot-preview[bot] 2020-07-13 23:37:01 +00:00