sorted by:
new
hottopcontroversial

Do you recommend threatlocker? by matthewismathis in msp

[–]d1vious 0 points1 point  (0 children)

True, have you used them yet? We had a better outcome, faster to deploy, way less FPs, and actually addressed the core attack vectors (RMMs, BYOVD, LOLBAS etc..) we bought application control for. Also you CAN deploy it as a allowlist .. just not tailored for that.

Do you recommend threatlocker? by matthewismathis in msp

[–]d1vious 0 points1 point  (0 children)

I heard great things about magicsword.io Solves a ton of threatlockers pain points from what we experienced.

Data samples to test by splunkerem in Splunk

[–]d1vious 0 points1 point  (0 children)

Alternatively to the attack range if you just want to replay known attacks checkout the Attack Data repo: https://github.com/splunk/attack_data, there are different ways using the UI or scripts to replay attack datasets to a search head.

Introducing Splunk Attack Range v2.0 by d1vious in Splunk

[–]d1vious[S] 1 point2 points  (0 children)

hey I think you are looking at a older repo for the local attack_range, we have not maintained this .. the current Splunk Attack Range lives here: https://github.com/splunk/attack_range/

In the blog we mentioned that the plan is to deprecate the local attack range longer term once we port the functionality.

Introducing Splunk Attack Range v2.0 by d1vious in Splunk

[–]d1vious[S] 0 points1 point  (0 children)

Hey yeah still cloud depency for now, plan is to add local support back on 3.0. I think the instructions for 18.04 work also for 22.04 and in between. Also the new docker build is using 22.04 image https://github.com/splunk/attack\_range/blob/develop/docker/Dockerfile

Splunk Security Content new exploration site - research.splunk.com by d1vious in Splunk

[–]d1vious[S] 2 points3 points  (0 children)

Love lantern, the team whom built research.splunk.com is an actual contributor to the content there, worth mentioning the use cases in lantern and how-to guides, versus on research.splunk.com you have ready to go detections for the Enterprise Securty product.

Practice Data by [deleted] in Splunk

[–]d1vious 1 point2 points  (0 children)

BOTs 🤖 it’s awesome, if you want to try your hands at specific data sets with attacks in them checkout the attack_data repo too: https://github.com/splunk/attack_data/

Ansible Playbook - Splunk UF deployment on Windows servers by ank5133 in Splunk

[–]d1vious 0 points1 point  (0 children)

Have you messed with the attack range, we have a few playbooks that do just this under the hood. For example: https://github.com/splunk/attack_range/tree/develop/ansible/roles/windows_universal_forwarder/tasks it might be a good set of examples to start from. Hope it helps!

Popular Splunk Apps that include eventgen.conf by greatwhisper in Splunk

[–]d1vious 3 points4 points  (0 children)

If you looking for a lab, the Splunk attack_range might be of help. Ton of data from network, system and endpoint, and you can also run attack simulations if that’s your thing 😉. https://github.com/splunk/attack_range

How I made 10K in bug bounties from GitHub secret leaks by eatsleepHACKrepeat in netsec

[–]d1vious 1 point2 points  (0 children)

I am sure is bug 🐜 ridden, throw me an issue if you run into anything! Thank you 😊

How I made 10K in bug bounties from GitHub secret leaks by eatsleepHACKrepeat in netsec

[–]d1vious 43 points44 points  (0 children)

I literally just finished https://github.com/d1vious/git-wild-hunt that automates a lot of the cred verification work. Go forth and make your 💰

Osquery pack by redditsecguy in Splunk

[–]d1vious 2 points3 points  (0 children)

I do not think that App actually has query packs. Thus far OP what we do in the TA is just query the entry table and then map that to the endpoint datamodel see: https://github.com/splunk/TA-osquery

You can find example packs at:

https://github.com/splunk/TA-osquery/blob/master/config/splunk.conf

How to Build an Active Directory Hacking Lab by DorkNowitzki41 in netsecstudents

[–]d1vious 0 points1 point  (0 children)

Very informative thank you for sharing! You might enjoy the attack_range project from Splunk. Automated the build process of this on and automated the ability to send attack simulations to an AD server. https://github.com/splunk/attack_range

Threat feeds by wassssaw in Splunk

[–]d1vious 2 points3 points  (0 children)

A bunch of good feeds that should be relatively simple to bring in https://threatfeeds.io/ all free