From 1bd28e6bd323fba64aee950add52b93ef99b94c0 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 1 Oct 2021 11:31:37 +0200 Subject: [PATCH] privilege_escalation_persistence --- detections/endpoint/print_processor_registry_autostart.yml | 2 +- tests/endpoint/print_processor_registry_autostart.test.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/print_processor_registry_autostart.yml b/detections/endpoint/print_processor_registry_autostart.yml index 144544ae94..dab28eac10 100644 --- a/detections/endpoint/print_processor_registry_autostart.yml +++ b/detections/endpoint/print_processor_registry_autostart.yml @@ -32,7 +32,7 @@ tags: - Windows Persistence Techniques - Windows Privilege Escalation dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/print_reg/sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/print_reg/sysmon_print.log kill_chain_phases: - Exploitation mitre_attack_id: diff --git a/tests/endpoint/print_processor_registry_autostart.test.yml b/tests/endpoint/print_processor_registry_autostart.test.yml index 35d0f7985e..c32f529f1b 100644 --- a/tests/endpoint/print_processor_registry_autostart.test.yml +++ b/tests/endpoint/print_processor_registry_autostart.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-365d' latest_time: 'now' attack_data: - - file_name: sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/print_reg/sysmon.log + - file_name: sysmon_print.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/print_reg/sysmon_print.log source: WinEventLog:Microsoft-Windows-PrintService/Operational sourcetype: WinEventLog \ No newline at end of file