admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
test_branch_patrick
splunk-security_content/tests/endpoint
T
History
P4T12ICK 354bf5c03a merged
2020-11-30 18:12:44 +01:00
..
access_lsass_memory_for_dump_creation.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
attempt_to_add_certificate_to_untrusted_store.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
attempt_to_stop_security_service.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
attempted_credential_dump_from_registry_via_reg_exe___ssa.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
attempted_credential_dump_from_registry_via_reg_exe.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
batch_file_write_to_system32.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
common_ransomware_extensions.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
common_ransomware_notes.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
create_local_admin_accounts_using_net_exe.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
create_remote_thread_into_lsass.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
creation_of_shadow_copy_with_wmic_and_powershell.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
creation_of_shadow_copy.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
credential_dumping_via_copy_command_from_shadow_copy.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
credential_dumping_via_symlink_to_shadow_copy.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
deleting_shadow_copies.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
detect_activity_related_to_pass_the_hash_attacks.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
detect_credential_dumping_through_lsass_access.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
detect_dump_lsass_memory_using_comsvcs___ssa.test.yml
new test file format
2020-11-26 09:48:01 +01:00
detect_excessive_account_lockouts_from_endpoint.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
detect_excessive_user_account_lockouts.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
detect_mshta_exe_running_scripts_in_command_line_arguments.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
detect_new_local_admin_account.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
detect_path_interception_by_creation_of_program_exe.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
detect_processes_used_for_system_network_configuration_discovery.test.yml
new test file format
2020-11-26 09:48:01 +01:00
detect_prohibited_applications_spawning_cmd_exe__ssa.test.yml
new detection test
2020-11-10 09:20:22 +01:00
detect_psexec_with_accepteula_flag.test.yml
new test file format
2020-11-26 09:48:01 +01:00
detect_use_of_cmd_exe_to_launch_script_interpreters.test.yml
new test file format
2020-11-26 09:48:01 +01:00
disabling_remote_user_account_control.test.yml
new test file format
2020-11-26 09:48:01 +01:00
dump_lsass_via_comsvcs_dll.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
execution_of_file_with_multiple_extensions.test.yml
new test file format
2020-11-26 09:48:01 +01:00
file_with_samsam_extension.test.yml
new test file format
2020-11-26 09:48:01 +01:00
first_time_seen_cmd_line___ssa.test.yml
fixed tests
2020-10-22 14:30:14 -07:00
hiding_files_and_directories_with_attrib_exe.test.yml
new test file format
2020-11-26 09:48:01 +01:00
kerberoasting_spn_request_with_rc4_encryption.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
malicious_powershell_process___connect_to_internet_with_hidden_window.test.yml
new test file format
2020-11-26 09:48:01 +01:00
malicious_powershell_process___encoded_command.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
malicious_powershell_process___execution_policy_bypass.yml.test.yml
new test file format
2020-11-26 09:48:01 +01:00
monitor_registry_keys_for_print_monitors.test.yml
new test file format
2020-11-26 09:48:01 +01:00
overwriting_accessibility_binaries.test.yml
new test file format
2020-11-26 09:48:01 +01:00
process_execution_via_wmi.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
processes_launching_netsh.test.yml
new test file format
2020-11-26 09:48:01 +01:00
prohibited_apps_spawning_cmdprompt___ssa.test.yml
fixed tests
2020-10-22 14:30:14 -07:00
rare_parent_process_relationship_lolbas___ssa.test.yaml
fixed pass condition
2020-10-22 16:30:17 -07:00
reg_exe_manipulating_windows_services_registry_keys.test.yml
new test file
2020-11-26 11:38:31 +01:00
registry_keys_for_creating_shim_databases.test.yml
new test file
2020-11-26 14:02:15 +01:00
registry_keys_used_for_persistence.yml.test.yml
new test
2020-11-27 09:49:16 +01:00
registry_keys_used_for_privilege_escalation.test.yml
new test
2020-11-27 09:49:16 +01:00
remote_process_instantiation_via_wmi.test.yml
new test file
2020-11-30 14:53:59 +01:00
rundll_loading_dll_by_ordinal.test.yml
detection test
2020-11-30 16:39:27 +01:00
ryuk_test_files_detected.test.yml
new test format
2020-11-30 17:18:10 +01:00
schtasks_scheduling_job_on_remote_system.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
shim_database_installation_with_suspicious_parameters.test.yml
new detection test
2020-11-26 14:26:58 +01:00
short_lived_windows_accounts.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
ssa___applying_stolen_credentials_via_mimikatz_modules.test.yml
Applying and setting stolen cresentials - detections via PowerSploit, Mimikatz and DSInternals APIs
2020-11-04 01:02:47 -08:00
ssa___applying_stolen_credentials_via_powersploit_modules.test.yml
Applying and setting stolen cresentials - detections via PowerSploit, Mimikatz and DSInternals APIs
2020-11-04 01:02:47 -08:00
ssa___assess_credential_strength_via_dsinternals_modules.test.yml
Probing access and credential strength with stolen credentials
2020-11-05 09:46:23 -08:00
ssa___credential_extraction_dsinternals_conversion_modules.test.yml
Credential Extraction: Changing passing condition to a new syntax
2020-10-29 00:42:19 -07:00
ssa___credential_extraction_dsinternals_modules.test.yml
Credential Extraction: Changing passing condition to a new syntax
2020-10-29 00:42:19 -07:00
ssa___credential_extraction_fgdump_cachedump_s_option.test.yml
Credential Extraction: Changing passing condition to a new syntax
2020-10-29 00:42:19 -07:00
ssa___credential_extraction_fgdump_cachedump_v_option.test.yml
Credential Extraction: Changing passing condition to a new syntax
2020-10-29 00:42:19 -07:00
ssa___credential_extraction_getaddbaccount_from_dump.test.yml
Credential Extraction: Changing passing condition to a new syntax
2020-10-29 00:42:19 -07:00
ssa___credential_extraction_lazagne_command_options.test.yml
Credential Extraction: Changing passing condition to a new syntax
2020-10-29 00:42:19 -07:00
ssa___credential_extraction_mimikatz_modules.test.yml
Credential Extraction: Changing passing condition to a new syntax
2020-10-29 00:42:19 -07:00
ssa___credential_extraction_ms_debuggers_kernel_peek.test.yml
Credential Extraction: Changing passing condition to a new syntax
2020-10-29 00:42:19 -07:00
ssa___credential_extraction_ms_debuggers_z_option.test.yml
Credential Extraction: Changing passing condition to a new syntax
2020-10-29 00:42:19 -07:00
ssa___credential_extraction_powersploit_modules.test.yml
Credential Extraction: Changing passing condition to a new syntax
2020-10-29 00:42:19 -07:00
ssa___detect_kerberoasting.test.yml
change test files to use ssa prefix
2020-11-05 17:36:30 +00:00
ssa___detect_pass_hash.test.yml
change test files to use ssa prefix
2020-11-05 17:36:30 +00:00
ssa___illegal_access_user_content_via_powersploit_modules.test.yml
Illegal control of compromised resources via Mimikatz, PowerSploit and DSInternals modules
2020-11-10 00:58:27 -08:00
ssa___illegal_account_creation_via_powersploit_modules.test.yml
Illegal control of compromised resources via Mimikatz, PowerSploit and DSInternals modules
2020-11-10 00:58:27 -08:00
ssa___illegal_account_enable_disable_via_dsinternals_modules.test.yml
Illegal control of compromised resources via Mimikatz, PowerSploit and DSInternals modules
2020-11-10 00:58:27 -08:00
ssa___illegal_log_deletion_via_mimikatz_modules.test.yml
Fix - renaming and providing adequate test set for log deletion detection (this was Mimikatz detection, not PowerSploit one)
2020-11-10 19:01:01 -08:00
ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.test.yml
Illegal control of compromised resources via Mimikatz, PowerSploit and DSInternals modules
2020-11-10 00:58:27 -08:00
ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.test.yml
Illegal control of compromised resources via Mimikatz, PowerSploit and DSInternals modules
2020-11-10 00:58:27 -08:00
ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.test.yml
Illegal control of compromised resources via Mimikatz, PowerSploit and DSInternals modules
2020-11-10 00:58:27 -08:00
ssa___illegal_privilege_elevation_via_mimikatz_modules.test.yml
Illegal control of compromised resources via Mimikatz, PowerSploit and DSInternals modules
2020-11-10 00:58:27 -08:00
ssa___illegal_service_and_process_control_via_mimikatz_modules.test.yml
Illegal control of compromised resources via Mimikatz, PowerSploit and DSInternals modules
2020-11-10 00:58:27 -08:00
ssa___illegal_service_and_process_control_via_powersploit_modules.test.yml
Illegal control of compromised resources via Mimikatz, PowerSploit and DSInternals modules
2020-11-10 00:58:27 -08:00
ssa___probing_access_with_stolen_credentials_via_powersploit_modules.test.yml
Probing access and credential strength with stolen credentials
2020-11-05 09:46:23 -08:00
ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.test.yml
Fix: Slip in renaming of tests
2020-11-06 15:01:54 -08:00
ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.test.yml
Fix: Slip in renaming of tests
2020-11-06 15:01:54 -08:00
ssa___recon_and_use_accounts_groups_via_mimikatz_modules.test.yml
Fix: File names of recon and use detections
2020-11-06 11:48:29 -08:00
ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.test.yml
Reconnaissance - adding detections for AD infrastructure, network connectivity, computers, domains, processes, services, registry, shares, etc.
2020-11-06 18:15:45 -08:00
ssa___recon_and_use_computers_domains_via_powersploit_modules.test.yml
Reconnaissance - adding detections for AD infrastructure, network connectivity, computers, domains, processes, services, registry, shares, etc.
2020-11-06 18:15:45 -08:00
ssa___recon_and_use_computers_via_mimikatz_modules.test.yml
Reconnaissance - adding detections for AD infrastructure, network connectivity, computers, domains, processes, services, registry, shares, etc.
2020-11-06 18:15:45 -08:00
ssa___recon_and_use_operating_system_elements_via_powersploit_modules.test.yml
Reconnaissance - adding detections for AD infrastructure, network connectivity, computers, domains, processes, services, registry, shares, etc.
2020-11-06 18:15:45 -08:00
ssa___recon_and_use_shares_via_mimikatz_modules.test.yml
Reconnaissance - adding detections for AD infrastructure, network connectivity, computers, domains, processes, services, registry, shares, etc.
2020-11-06 18:15:45 -08:00
ssa___recon_and_use_shares_via_powersploit_modules.test.yml
Reconnaissance - adding detections for AD infrastructure, network connectivity, computers, domains, processes, services, registry, shares, etc.
2020-11-06 18:15:45 -08:00
ssa___recon_connectivity_via_powersploit_modules.test.yml
Reconnaissance - adding detections for AD infrastructure, network connectivity, computers, domains, processes, services, registry, shares, etc.
2020-11-06 18:15:45 -08:00
ssa___recon_credential_stores_and_services_via_mimikatz_modules.test.yml
Adding Reconnaissance of Credential Stores and Services via Mimikatz modules
2020-11-05 19:12:04 -08:00
ssa___recon_defensive_tools_via_powersploit_modules.test.yml
Reconnaissance and access to accounts groups and policies via Mimikatz and PowerSploit modules
2020-11-05 23:10:53 -08:00
ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.test.yml
Reconnaissance and access to accounts groups and policies via Mimikatz and PowerSploit modules
2020-11-05 23:10:53 -08:00
ssa___recon_process_service_hijacking_via_mimikatz_modules.test.yml
Reconnaissance and access to accounts groups and policies via Mimikatz and PowerSploit modules
2020-11-05 23:10:53 -08:00
ssa___recon_processes_and_services_via_mimikatz_modules.test.yml
Reconnaissance - adding detections for AD infrastructure, network connectivity, computers, domains, processes, services, registry, shares, etc.
2020-11-06 18:15:45 -08:00
ssa___setting_credentials_via_dsinternals_modules.test.yml
Applying and setting stolen cresentials - detections via PowerSploit, Mimikatz and DSInternals APIs
2020-11-04 01:02:47 -08:00
ssa___setting_credentials_via_mimikatz_modules.test.yml
Applying and setting stolen cresentials - detections via PowerSploit, Mimikatz and DSInternals APIs
2020-11-04 01:02:47 -08:00
ssa___setting_credentials_via_powersploit_modules.test.yml
Applying and setting stolen cresentials - detections via PowerSploit, Mimikatz and DSInternals APIs
2020-11-04 01:02:47 -08:00
suspicious_reg_exe_process.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
system_information_discovery_detection.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
system_process_running_unexpected_location___ssa.test.yml
fixed test and detection
2020-10-26 14:47:50 -07:00
unload_sysmon_filter_driver.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
unusual_lolbas_in_short_period_of_time___ssa.test.yml
fixed tests
2020-10-22 14:30:14 -07:00
unusually_long_command_line___ssa.test.yml
fixed tests
2020-10-22 14:30:14 -07:00
windows_event_log_cleared.test.yml
New format for detection testing
2020-11-25 12:29:34 +01:00
windows_security_account_manager_stopped.test.yml
new test format
2020-11-30 17:18:10 +01:00