From 03444a29e9537fa7fffdcc5274941ffc87513059 Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 12 May 2021 13:50:03 -0700 Subject: [PATCH] test file --- stories/ransomware_darkside.yml | 2 +- .../delete_shadowcopy_with_powershell.test.yml | 12 ++++++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) create mode 100644 tests/endpoint/delete_shadowcopy_with_powershell.test.yml diff --git a/stories/ransomware_darkside.yml b/stories/ransomware_darkside.yml index 328a9fb57a..745cebc6d3 100644 --- a/stories/ransomware_darkside.yml +++ b/stories/ransomware_darkside.yml @@ -6,7 +6,7 @@ author: Bhavin Patel, Splunk type: batch description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware -narrative: +narrative: '' references: - https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/ - https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html diff --git a/tests/endpoint/delete_shadowcopy_with_powershell.test.yml b/tests/endpoint/delete_shadowcopy_with_powershell.test.yml new file mode 100644 index 0000000000..b53c03377c --- /dev/null +++ b/tests/endpoint/delete_shadowcopy_with_powershell.test.yml @@ -0,0 +1,12 @@ +name: Delete ShadowCopy With PowerShell Unit Test +tests: +- name: Delete ShadowCopy With PowerShell + file: endpoint/delete_shadowcopy_with_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/shadowcopy_del/windows-powershell.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: wineventlog \ No newline at end of file