Commits

Commit history

1. Commits on Nov 4, 2020

   • Merge branch 'develop' into misko_apply_set_stolen_credentials

     josehelps

     authored
     db0e7bdView commit details

     Copy full SHA for db0e7bd

     View code at this pointBrowse repository at this point

   • Merge pull request #816 from splunk/misko_cred_extract_APIs_and_Filenames

     Show description for c7b8e71
     josehelps

     authored
     c7b8e71View commit details

     Copy full SHA for c7b8e71

     View code at this pointBrowse repository at this point

   • Merge branch 'develop' into misko_apply_set_stolen_credentials

     jzsplunk

     authored
     7434975View commit details

     Copy full SHA for 7434975

     View code at this pointBrowse repository at this point

   • Merge branch 'develop' into misko_cred_extract_APIs_and_Filenames

     josehelps

     authored
     c25465cView commit details

     Copy full SHA for c25465c

     View code at this pointBrowse repository at this point

   • Merge branch 'develop' into new_test_file_format

     P4T12ICK

     authored
     ac27485View commit details

     Copy full SHA for ac27485

     View code at this pointBrowse repository at this point

   • Applying and setting stolen cresentials - detections via PowerSploit, Mimikatz and DSInternals APIs

     miskoSplunk

     committed
     16821b7View commit details

     Copy full SHA for 16821b7

     View code at this pointBrowse repository at this point
2. Commits on Nov 3, 2020

   • detection tests

     

     P4T12ICK

     committed
     15a3dfeView commit details

     Copy full SHA for 15a3dfe

     View code at this pointBrowse repository at this point
3. Commits on Oct 30, 2020

   • new format for test files

     

     P4T12ICK

     committed
     c952f06View commit details

     Copy full SHA for c952f06

     View code at this pointBrowse repository at this point
4. Commits on Oct 29, 2020

   • Credential Extraction: Changing passing condition to a new syntax

     miskoSplunk

     committed
     470c94fView commit details

     Copy full SHA for 470c94f

     View code at this pointBrowse repository at this point
5. Commits on Oct 28, 2020

   • Credential Extraction: moving test data from SMLE's to AR's S3 bucket and renaming test links

     miskoSplunk

     committed
     b5707c8View commit details

     Copy full SHA for b5707c8

     View code at this pointBrowse repository at this point

   • Update and rename credential_extraction_ms_debuggers_z_option.test.yml to ssa___credential_extraction_ms_debuggers_z_option.test.yml

     miskoSplunk

     authored
     2839525View commit details

     Copy full SHA for 2839525

     View code at this pointBrowse repository at this point

   • Update and rename credential_extraction_ms_debuggers_kernel_peek.test.yml to ssa___credential_extraction_ms_debuggers_kernel_peek.test.yml

     miskoSplunk

     authored
     67be982View commit details

     Copy full SHA for 67be982

     View code at this pointBrowse repository at this point

   • Update and rename credential_extraction_lazagne_command_options_ssa.test.yml to ssa___credential_extraction_lazagne_command_options.test.yml

     miskoSplunk

     authored
     f47a5e1View commit details

     Copy full SHA for f47a5e1

     View code at this pointBrowse repository at this point

   • Update and rename credential_extraction_fgdump_cachedump_v_option_ssa.test.yml to ssa___credential_extraction_fgdump_cachedump_v_option.test.yml

     miskoSplunk

     authored
     2cdefddView commit details

     Copy full SHA for 2cdefdd

     View code at this pointBrowse repository at this point

   • Update and rename credential_extraction_fgdump_cachedump_s_option_ssa.test.yml to ssa___credential_extraction_fgdump_cachedump_s_option.test.yml

     miskoSplunk

     authored
     5f01133View commit details

     Copy full SHA for 5f01133

     View code at this pointBrowse repository at this point
6. Commits on Oct 27, 2020

   • Update and rename credential_extraction_powersploit_modules_ssa.test.yml to ssa___credential_extraction_powersploit_modules.test.yml

     miskoSplunk

     authored
     3185517View commit details

     Copy full SHA for 3185517

     View code at this pointBrowse repository at this point

   • Update and rename credential_extraction_mimikatz_modules_ssa.test.yml to ssa___credential_extraction_mimikatz_modules.test.yml

     miskoSplunk

     authored
     575fd73View commit details

     Copy full SHA for 575fd73

     View code at this pointBrowse repository at this point

   • Update and rename credential_extraction_getaddbaccount_from_dump_ssa.test.yml to ssa___credential_extraction_getaddbaccount_from_dump.test.yml

     miskoSplunk

     authored
     8ec9c06View commit details

     Copy full SHA for 8ec9c06

     View code at this pointBrowse repository at this point

   • Update and rename credential_extraction_dsinternals_modules_ssa.test.yml to ssa___credential_extraction_dsinternals_modules.test.yml

     miskoSplunk

     authored
     abf6927View commit details

     Copy full SHA for abf6927

     View code at this pointBrowse repository at this point

   • Update and rename credential_extraction_dsinternals_conversion_modules_ssa.test.yml to ssa___credential_extraction_dsinternals_conversion_modules.test.yml

     miskoSplunk

     authored
     2cd4512View commit details

     Copy full SHA for 2cd4512

     View code at this pointBrowse repository at this point

   • Credential Extraction: Adding tests, second try to push

     miskoSplunk

     committed
     922559dView commit details

     Copy full SHA for 922559d

     View code at this pointBrowse repository at this point
7. Commits on Oct 26, 2020

   • fixed test and detection

     

     Ignacio Bermudez Corrales

     committed
     a19a43cView commit details

     Copy full SHA for a19a43c

     View code at this pointBrowse repository at this point
8. Commits on Oct 23, 2020

   • Removed tests that had issues they should be in branch add_gitlab_ci-all-tests

     Show description for aec8ad9
     

     Ignacio Bermudez Corrales

     committed
     aec8ad9View commit details

     Copy full SHA for aec8ad9

     View code at this pointBrowse repository at this point
9. Commits on Oct 22, 2020

   • fixed pass condition

     

     Ignacio Bermudez Corrales

     committed
     ab646c1View commit details

     Copy full SHA for ab646c1

     View code at this pointBrowse repository at this point

   • fixed tests

     

     Ignacio Bermudez Corrales

     committed
     9d13976View commit details

     Copy full SHA for 9d13976

     View code at this pointBrowse repository at this point

   • multiple tests supported + output validation

     

     Ignacio Bermudez Corrales

     committed
     51c8df5View commit details

     Copy full SHA for 51c8df5

     View code at this pointBrowse repository at this point
10. Commits on Oct 20, 2020

    • Merge pull request #775 from splunk/improved_kerberoasting_attack

      Show description for 8fef4fe
      patel-bhavin

      authored
      8fef4feView commit details

      Copy full SHA for 8fef4fe

      View code at this pointBrowse repository at this point

    • Merge pull request #774 from splunk/pass_the_hash_detection

      Show description for 7a45ca7
      patel-bhavin

      authored
      7a45ca7View commit details

      Copy full SHA for 7a45ca7

      View code at this pointBrowse repository at this point
11. Commits on Oct 19, 2020

    • Merge branch 'develop' into improved_kerberoasting_attack

      josehelps

      authored
      ca119d7View commit details

      Copy full SHA for ca119d7

      View code at this pointBrowse repository at this point
12. Commits on Oct 16, 2020

    • test files for ssa detections

      

      Ignacio Bermudez Corrales

      committed
      ebb0554View commit details

      Copy full SHA for ebb0554

      View code at this pointBrowse repository at this point

    • adding tests per detection

      

      Ignacio Bermudez Corrales

      committed
      3f8b95fView commit details

      Copy full SHA for 3f8b95f

      View code at this pointBrowse repository at this point

    • fixed kerberoasting detection

      

      P4T12ICK

      committed
      d788863View commit details

      Copy full SHA for d788863

      View code at this pointBrowse repository at this point

    • rebased with develop

      

      P4T12ICK

      committed
      7fe760cView commit details

      Copy full SHA for 7fe760c

      View code at this pointBrowse repository at this point
13. Commits on Oct 15, 2020

    • updated to point to the right file

      josehelps

      committed
      3a38445View commit details

      Copy full SHA for 3a38445

      View code at this pointBrowse repository at this point

    • notebook for prohibited apps spawning

      josehelps

      committed
      015514eView commit details

      Copy full SHA for 015514e

      View code at this pointBrowse repository at this point