test file

stories/ransomware_darkside.yml

@@ -6,7 +6,7 @@ author: Bhavin Patel, Splunk
 type: batch
 description: Leverage searches that allow you to detect and investigate unusual activities
   that might relate to the DarkSide Ransomware
-narrative: 
+narrative: ''
 references:
 - https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/
 - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html

tests/endpoint/delete_shadowcopy_with_powershell.test.yml

@@ -0,0 +1,12 @@
+name: Delete ShadowCopy With PowerShell Unit Test
+tests:
+- name: Delete ShadowCopy With PowerShell
+  file: endpoint/delete_shadowcopy_with_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/shadowcopy_del/windows-powershell.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: wineventlog