admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update detect_certify_with_powershell_script_block_logging.yml

Browse Source
This commit is contained in:
Bhavin Patel
2023-08-17 15:39:40 -07:00
committed by GitHub
parent 391023a451
commit 2eee405de4
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/detect_certify_with_powershell_script_block_logging.yml
+3 -3
View File
@@ -64,6 +64,6 @@ tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/certify_abuse/certify_esc1_abuse_powershell.log
source: XmlWinEventLog:Security
sourcetype: XmlWinEventLog
update_timestamp: true
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
update_timestamp: true