trinitor/DetectionLab
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
429 Commits 1 Branch 0 Tags
797a9d507abaa05edcfc0a13547d27dfab82ef33
Commit Graph
148 Commits
Author SHA1 Message Date
Ahmed Shawky fefbb9ac54 Fix a monir bug when importing windows-application-security osquery config into fleet. 2020-01-17 23:08:47 +04:00
Chris LongandGitHub 85563d7742 Fix issue #362 
https://github.com/clong/DetectionLab/issues/362
 2019-12-21 01:17:32 -08:00
Chris Long b5c73ce647 Include Invoke-AtomicTest in Powershell 2019-12-20 23:46:35 -08:00
Chris LongandGitHub ffbca14bd0 Adding mirrors back 2019-12-20 18:03:48 -08:00
Chris LongandGitHub ba7004b283 Merge branch 'master' into ubuntu_upgrade 2019-12-20 15:51:01 -08:00
Chris Long 7e17727cbb Logger bump to Ubuntu 18.04 & Migrate to Zeek 2019-12-20 15:48:13 -08:00
Chris LongandGitHub e4bb3c9a43 Update 20-detectionlab 2019-12-18 13:43:21 -08:00
Chris Long 0393d627ad Convert ADSI:Exists to Get-ADOrganizationalUnit 2019-12-04 18:49:28 -08:00
Chris Long 4a8485c28e Disable IPv6 on Windows adapters 2019-12-04 13:45:43 -08:00
Chris Long f64ff20aaf Disabling default windows inputs. Adding powershell command for event channel perms 2019-12-04 11:27:35 -08:00
Chris Long 249ce2ec76 Updating channel permissions for Microsoft-Windows-Sysmon 2019-12-03 22:18:20 -08:00
Chris Long f3fa80299f Adding rearm to each Windows host 2019-12-03 19:53:59 -08:00
Chris Long ee9a1f87fd Removing Splunk forwarder from Windows hosts 2019-12-03 00:42:02 -08:00
Chris Long 905eaca9fa Adding Guacamole for multi-machine management 2019-11-19 21:01:19 -08:00
Chris Long 17e42182ef Adding updated manifests 2019-11-11 23:11:36 -08:00
Chris Long 9f392c76cc Re-create DC Auditing GPO. Update ThreatHunting Splunk App. 2019-11-11 23:01:57 -08:00
Chris LongandGitHub 2b608addb0 Fixing issue #341 
Add TLS1.2 support
 2019-11-07 23:44:03 -08:00
Chris Long 0bd64eb04b Updating bootstrap.sh 2019-11-06 22:13:19 -08:00
Chris LongandGitHub 466b54e385 Installing yq via apt-get 
Fixing the yq issue by using the apt repository
 2019-11-04 22:43:25 -08:00
Chris LongandGitHub b0b124243b Updating yq installation check 2019-11-01 08:43:21 -07:00
Chris LongandGitHub a9d743ef49 Addressing issue #329 
Thanks to @protodroidbot for the fix!
 2019-10-31 21:33:14 -07:00
Chris Long 84287c4c17 Updating bootstrap.sh to not install BOTSv2 by default 2019-09-30 20:32:19 -07:00
Mike Haag 2d5d6f508e Add BOTS to Logger 
This will add the BOTSv2 dataset to DetectionLab.

One app required for BOTS:
Splunk Stream - https://splunkbase.splunk.com/app/1809/

Recommended:
Boss of the SOC (BOTS) Advanced APT Hunting Companion App for Splunk -  https://splunkbase.splunk.com/app/4430/
 2019-09-05 10:02:05 -06:00
dtriznaandGitHub 9bfcc8296c Update Vagrantfile 2019-07-24 14:18:04 +03:00
dtriznaandGitHub 9694416e33 Update Vagrantfile 2019-07-24 14:16:10 +03:00
Chris LongandGitHub a07e9cbaac Fix bro-pkg issue 
https://github.com/abiteboul
 2019-07-20 23:44:19 -07:00
Chris Long 9cceafa28e Update ThreatHunting app to 1.3.4 2019-07-20 00:49:35 -07:00
Chris Long 280bce8252 Updating bginfo.bgi to point to the correct .bmp 2019-07-08 00:41:32 -07:00
Chris Long 2480c27200 Remove Prebuilt Vagrantfile 2019-07-07 10:46:59 -07:00
Chris Long f55b721da2 Remove debugging paths from Vagrantfile 2019-07-06 18:35:02 -07:00
Chris Long df718b4408 Update to 1903 2019-07-06 18:29:29 -07:00
Sunny NeoandGitHub 8d7bc4b9dc Explicitly define the file directory 
Osquery was not working with Fleet after deployment due to wrong directories. 

The following command installs the osqueryd service with --flagfile=\ProgramData\osquery\osquery.flags" however osquery.flags found at "C:\Program Files\osquery\osquery.flags" 

``` "c:\Program Files\osquery\osqueryd\osqueryd.exe" -ArgumentList "--install" -Wait  
```

The original osquery.flags defines the certfile.crt to be in "C:\programdata\osquery", it should be in  "c:\Program Files\osquery\" instead.
 2019-06-16 22:56:11 +08:00
Chris Long 95d1fb31f4 Updating ASNGen App 2019-06-09 17:53:21 -07:00
Chris Long e9ccc17e17 Revert Vagrantfile changes 2019-05-26 21:37:24 -07:00
Chris Long e78c312bc5 Actually add files 2019-05-26 21:36:10 -07:00
Chris Long cd722dab8b Fix ThreatHunting App, add Lookup Editor, Update VM tools 2019-05-26 21:34:45 -07:00
Chris Long 9dcc235a55 Update osquery paths in v3.4.0 2019-05-25 12:36:45 -07:00
Olaf Hartong 7916fd1818 added v1.3.2 2019-05-19 22:33:01 +02:00
Olaf Hartong 04bbd7d25e Updated ThreatHunting app to 1.3 2019-05-19 21:06:04 +02:00
Chris Long 6b40e372bd Actually include the files 2019-05-11 01:42:35 -07:00
Chris Long 4082b7a193 Add JA3 for Bro and Suricata. Add background wallpaper. 2019-05-11 01:40:23 -07:00
Chris Long 1261c0dfd8 Adding timestamps to scripts, Vagrantfile_prebuilt, logo 2019-05-06 09:26:59 -07:00
Chris LongandGitHub bb2a17ba98 Adding TaskManager.reg 2019-04-28 22:12:59 -07:00
Chris Long 1746b49811 Add Atomic Red Team, Poll Packet for Provisioning, Fixes 2019-04-28 22:02:11 -07:00
Chris Long 3de47b621a Fix WEF inputs for Splunk 2019-04-28 13:12:53 -07:00
Chris Long 88cd120e6e Don't try to re-disable Defender 2019-04-28 01:42:25 -07:00
Chris Long e1039c8090 Adding back repository for apt-fast 2019-04-27 23:07:11 -07:00
Chris Long 65381681c9 Removing remnants of python3.6 and pip 2019-04-27 22:53:13 -07:00
Chris Long 7d844fd988 Removing Caldera 2019-04-27 22:36:06 -07:00
Chris Long 614af67405 Update to Caldera 2.0, reduce verbosity 2019-04-27 21:05:23 -07:00