admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
9be8315fdca24a6cfedff979f163ea4e690d7521
splunk-security_content/tests/endpoint
T
History
mhaag-spl 962925bbea Create detect_mshta_renamed.test.yml
2021-03-08 16:27:06 -07:00
..
access_lsass_memory_for_dump_creation.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
any_powershell_downloadfile.test.yml
powershell
2021-03-02 09:43:31 -07:00
any_powershell_downloadstring.test.yml
Update any_powershell_downloadstring.test.yml
2021-03-02 15:02:51 -07:00
assertions.py
fixed links to assertions in test
2020-12-03 10:41:09 -08:00
attempt_to_add_certificate_to_untrusted_store.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.test.yml
new attack data
2020-12-09 10:00:12 +01:00
attempt_to_stop_security_service.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
attempted_credential_dump_from_registry_via_reg_exe.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
batch_file_write_to_system32.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
bcdedit_failure_recovery_modification.test.yml
Update bcdedit_failure_recovery_modification.test.yml
2021-01-11 13:57:05 -07:00
certutil_exe_certificate_extraction.test.yml
change time
2021-02-11 09:02:22 -08:00
cobalt_strike_named_pipes.test.yml
Named Pipes + update
2021-02-22 15:26:35 -07:00
common_ransomware_extensions.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
common_ransomware_notes.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
create_local_admin_accounts_using_net_exe.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
create_or_delete_windows_shares_using_net_exe.test.yml
new test file
2020-12-09 12:00:49 +01:00
create_remote_thread_into_lsass.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
creation_of_lsass_dump_with_taskmgr.test.yml
Creation of lsass dump with taskmgr
2021-02-03 14:57:59 -07:00
creation_of_shadow_copy_with_wmic_and_powershell.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
creation_of_shadow_copy.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
credential_dumping_via_copy_command_from_shadow_copy.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
credential_dumping_via_symlink_to_shadow_copy.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
deleting_shadow_copies.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
detect_activity_related_to_pass_the_hash_attacks.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
detect_credential_dumping_through_lsass_access.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
detect_excessive_account_lockouts_from_endpoint.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
detect_excessive_user_account_lockouts.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
detect_html_help_renamed.test.yml
hh renamed
2021-02-11 15:15:30 -07:00
detect_html_help_spawn_child_process.test.yml
HTML help spawning a child
2021-02-11 14:35:06 -07:00
detect_html_help_url_in_command_line.test.yml
T1218.001 remote CHM
2021-02-11 14:21:07 -07:00
detect_html_help_using_infotech_storage_handlers.test.yml
InfoTech Storage Handlers
2021-02-11 15:03:13 -07:00
detect_mimikatz_using_loaded_images.test.yml
Detect Mimikatz Using Loaded Images
2021-03-05 13:10:59 -07:00
detect_mshta_exe_running_scripts_in_command_line_arguments.test.yml
rename mshta inline hta execution
2021-01-20 12:44:21 -07:00
detect_mshta_renamed.test.yml
Create detect_mshta_renamed.test.yml
2021-03-08 16:27:06 -07:00
detect_mshta_url_in_command_line.test.yml
MSHTA
2021-01-20 12:00:25 -07:00
detect_new_local_admin_account.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
detect_path_interception_by_creation_of_program_exe.test.yml
_timeupdate
2021-02-17 10:09:38 -08:00
detect_processes_used_for_system_network_configuration_discovery.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
detect_psexec_with_accepteula_flag.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
detect_regasm_spawning_a_process.test.yml
test files
2021-02-12 12:10:53 -07:00
detect_regasm_with_network_connection.test.yml
regasm-regsvcs-network
2021-02-16 07:16:05 -07:00
detect_regasm_with_no_command_line_arguments.test.yml
regasm no cl arguments
2021-02-16 11:22:07 -07:00
detect_regsvcs_spawning_a_process.test.yml
test files
2021-02-12 12:10:53 -07:00
detect_regsvcs_with_network_connection.test.yml
regasm-regsvcs-network
2021-02-16 07:16:05 -07:00
detect_regsvcs_with_no_command_line_arguments.test.yml
Update detect_regsvcs_with_no_command_line_arguments.test.yml
2021-02-16 11:56:19 -07:00
detect_regsvr32_application_control_bypass.test.yml
Regsvr32 Story and Analytics
2021-01-29 10:58:53 -07:00
detect_rundll32_application_control_bypass___advpack.test.yml
rundll32 advpack and rename
2021-02-04 14:38:54 -07:00
detect_rundll32_application_control_bypass___setupapi.test.yml
rundll32 syssetup, setupapi
2021-02-05 07:27:02 -07:00
detect_rundll32_application_control_bypass___syssetup.test.yml
rundll32 syssetup, setupapi
2021-02-05 07:27:02 -07:00
detect_rundll32_inline_hta_execution.test.yml
rundll32 inline hta
2021-01-20 10:48:25 -07:00
detect_use_of_cmd_exe_to_launch_script_interpreters.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
disabling_remote_user_account_control.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
dump_lsass_via_comsvcs_dll.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
dump_lsass_via_procdump_rename.test.yml
procdump rename
2021-02-03 09:58:51 -07:00
dump_lsass_via_procdump.test.yml
dump lsass via procdump
2021-02-01 12:37:36 -07:00
eventvwr_uac_bypass.test.yml
Eventvwr UAC Bypass
2021-03-01 15:18:27 -07:00
execution_of_file_with_multiple_extensions.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
file_with_samsam_extension.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
fodhelper_uac_bypass.test.yml
Update fodhelper_uac_bypass.test.yml
2021-03-02 12:52:07 -07:00
hiding_files_and_directories_with_attrib_exe.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
kerberoasting_spn_request_with_rc4_encryption.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
malicious_powershell_process___connect_to_internet_with_hidden_window.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
malicious_powershell_process___encoded_command.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
malicious_powershell_process___execution_policy_bypass.test.yml
new test file
2021-01-19 14:44:01 +01:00
malicious_powershell_process_with_obfuscation_techniques.test.yml
new test file
2021-01-19 13:55:33 +01:00
monitor_registry_keys_for_print_monitors.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
nishang_powershelltcponeline.test.yml
fixes
2021-03-03 14:54:56 -07:00
nltest_domain_trust_discovery.test.yml
T1482 - NLTest usage
2021-01-25 09:09:02 -07:00
ntdsutil_export_ntds.test.yml
ntdsutil export NTDS.dit
2021-01-28 14:36:52 -07:00
overwriting_accessibility_binaries.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
process_creating_lnk_file_in_suspicious_location.test.yml
fixing file path
2021-02-01 14:56:27 -05:00
process_execution_via_wmi.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
processes_launching_netsh.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
reg_exe_manipulating_windows_services_registry_keys.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
registry_keys_for_creating_shim_databases.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
registry_keys_used_for_persistence.yml.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
registry_keys_used_for_privilege_escalation.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
remote_process_instantiation_via_wmi.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
rundll_loading_dll_by_ordinal.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
ryuk_test_files_detected.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
ryuk_wake_on_lan_command.test.yml
Ryuk Wake on LAN
2021-03-01 10:07:12 -07:00
samsam_test_file_write.test.yml
new test file
2020-12-07 13:09:29 +01:00
sc_exe_manipulating_windows_services.test.yml
new test file
2020-12-07 13:22:34 +01:00
scheduled_task_deleted_or_created_via_cmd.test.yml
renaming dragonfly
2020-12-17 13:53:20 -05:00
schtasks_scheduling_job_on_remote_system.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
schtasks_used_for_forcing_a_reboot.yml.test.yml
new test file
2020-12-07 14:21:52 +01:00
script_execution_via_wmi.test.yml
new test file
2020-12-07 14:18:07 +01:00
shim_database_file_creation.test.yml
test detection
2020-12-08 10:02:38 +01:00
shim_database_installation_with_suspicious_parameters.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
short_lived_windows_accounts.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
single_letter_process_on_endpoint.test.yml
new test file
2020-12-08 10:12:15 +01:00
ssa___applying_stolen_credentials_via_mimikatz_modules.test.yml
Basic assertion language
2020-12-03 10:41:09 -08:00
ssa___applying_stolen_credentials_via_powersploit_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___assess_credential_strength_via_dsinternals_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___attempted_credential_dump_from_registry_via_reg_exe.test.yml
renamed ssa detections
2021-01-25 16:32:23 -08:00
ssa___credential_extraction_dsinternals_conversion_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___credential_extraction_dsinternals_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___credential_extraction_fgdump_cachedump_s_option.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___credential_extraction_fgdump_cachedump_v_option.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___credential_extraction_getaddbaccount_from_dump.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___credential_extraction_lazagne_command_options.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___credential_extraction_mimikatz_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___credential_extraction_ms_debuggers_kernel_peek.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___credential_extraction_ms_debuggers_z_option.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___credential_extraction_powersploit_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___detect_dump_lsass_memory_using_comsvcs.test.yml
renamed ssa detections
2021-01-25 16:32:23 -08:00
ssa___detect_kerberoasting.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___detect_pass_hash.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___detect_prohibited_applications_spawning_cmd_exe.test.yml
renamed ssa detections
2021-01-25 16:32:23 -08:00
ssa___first_time_seen_cmd_line.test.yml
added more test corner cases
2021-02-02 22:13:05 -08:00
ssa___illegal_access_user_content_via_powersploit_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___illegal_account_creation_via_powersploit_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___illegal_account_enable_disable_via_dsinternals_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___illegal_log_deletion_via_mimikatz_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___illegal_privilege_elevation_via_mimikatz_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___illegal_service_and_process_control_via_mimikatz_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___illegal_service_and_process_control_via_powersploit_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___probing_access_with_stolen_credentials_via_powersploit_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___prohibited_apps_spawning_cmdprompt.test.yml
renamed ssa detections
2021-01-25 16:32:23 -08:00
ssa___rare_parent_process_relationship_lolbas.test.yaml
renamed ssa detections
2021-01-25 16:32:23 -08:00
ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___recon_and_use_accounts_groups_via_mimikatz_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___recon_and_use_computers_domains_via_powersploit_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___recon_and_use_computers_via_mimikatz_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___recon_and_use_operating_system_elements_via_powersploit_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___recon_and_use_shares_via_mimikatz_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___recon_and_use_shares_via_powersploit_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___recon_connectivity_via_powersploit_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___recon_credential_stores_and_services_via_mimikatz_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___recon_defensive_tools_via_powersploit_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___recon_process_service_hijacking_via_mimikatz_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___recon_processes_and_services_via_mimikatz_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___setting_credentials_via_dsinternals_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___setting_credentials_via_mimikatz_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___setting_credentials_via_powersploit_modules.test.yml
updated pass conditions in tests
2020-12-03 11:37:00 -08:00
ssa___system_process_running_unexpected_location.test.yml
renamed ssa detections
2021-01-25 16:32:23 -08:00
ssa___unusual_lolbas_in_short_period_of_time.test.yml
renamed ssa detections
2021-01-25 16:32:23 -08:00
ssa___unusually_long_command_line.test.yml
renamed ssa detections
2021-01-25 16:32:23 -08:00
suspicious_dllhost_no_command_line_arguments.test.yml
Update suspicious_dllhost_no_command_line_arguments.test.yml
2021-02-23 14:22:23 -07:00
suspicious_gpupdate_no_command_line_arguments.test.yml
Update suspicious_gpupdate_no_command_line_arguments.test.yml
2021-02-23 13:48:57 -07:00
suspicious_microsoft_workflow_compiler_rename.test.yml
Microsoft Workflow Compiler
2021-01-19 14:45:02 -07:00
suspicious_microsoft_workflow_compiler_usage.test.yml
Microsoft Workflow Compiler
2021-01-19 14:45:02 -07:00
suspicious_msbuild_path.test.yml
URL Fixes
2021-01-19 13:43:37 -07:00
suspicious_msbuild_rename.test.yml
URL Fixes
2021-01-19 13:43:37 -07:00
suspicious_msbuild_spawn.test.yml
URL Fixes
2021-01-19 13:43:37 -07:00
suspicious_mshta_child_process.test.yml
wrong url
2021-01-26 10:56:49 -07:00
suspicious_mshta_spawn.test.yml
ID changes
2021-01-20 14:45:27 -07:00
suspicious_reg_exe_process.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
suspicious_regsvr32_register_suspicious_path.test.yml
Update suspicious_regsvr32_register_suspicious_path.test.yml
2021-01-29 13:34:40 -07:00
suspicious_rundll32_dllregisterserver.test.yml
rundll32 dllregisterserver
2021-02-09 12:10:39 -07:00
suspicious_rundll32_rename.test.yml
rundll32 advpack and rename
2021-02-04 14:38:54 -07:00
suspicious_rundll32_startw.test.yml
Rundll32,StartW
2021-02-09 10:54:34 -07:00
suspicious_rundll32_with_no_command_line_arguments.test.yml
misspell
2021-02-09 11:27:19 -07:00
suspicious_scheduled_task_from_public_directory.test.yml
Update suspicious_scheduled_task_from_public_directory.test.yml
2021-03-02 15:01:54 -07:00
suspicious_searchprotocolhost_no_command_line_arguments.test.yml
SearchprotocolHost
2021-02-23 15:04:11 -07:00
suspicious_wevtutil_usage.test.yml
new test file
2020-12-08 11:19:49 +01:00
suspicious_writes_to_windows_recycle_bin.test.yml
new test file
2020-12-08 11:47:59 +01:00
system_information_discovery_detection.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
system_processes_run_from_unexpected_locations.test.yml
new test file
2020-12-08 13:27:58 +01:00
unload_sysmon_filter_driver.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
unusually_long_command_line.test.yml
new test file
2020-12-08 13:38:41 +01:00
usn_journal_deletion.test.yml
new test file
2020-12-08 14:18:08 +01:00
wbadmin_delete_system_backups.test.yml
Adding WBAdmin - delete system backups
2021-01-22 13:52:56 -07:00
windows_adfind_exe.test.yml
renamed test file
2020-12-17 18:05:54 -05:00
windows_disableantispyware_reg.test.yml
Create windows_disableantispyware_reg.test.yml
2021-03-02 15:21:55 -07:00
windows_event_log_cleared.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
windows_security_account_manager_stopped.test.yml
updated url links for dataset
2020-12-03 15:03:50 +01:00
wmi_permanent_event_subscription___sysmon.test.yml
new test file
2020-12-08 15:43:25 +01:00