name: Attempted Credential Dump From Registry via Reg exe - SSA Unit test
tests:
  - name: Attempted Credential Dump From Registry via Reg exe
    file: endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
    pass_condition: '@count_gt(0)'
    description: Test credential dumping detections
    attack_data:
      - file_name: windows-security_ssa.log
        data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.002/windows-security_ssa.log

