test files

tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml

@@ -0,0 +1,12 @@
+name: Detect AutoSUID post exploitation tool Unit Test
+tests:
+- name: Detect AutoSUID post exploitation tool
+  file: endpoint/detect_autosuid_post_exploitation_tool.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: autoSUID.txt
+    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt
+    source: "Syslog:Linux-Sysmon/Operational"
+    sourcetype: "sysmon_linux"

tests/endpoint/detect_linenum_execution.test.yml

@@ -0,0 +1,12 @@
+name: Detect LinEnum execution unit Test
+tests:
+- name: Detect LinEnum execution
+  file: endpoint/detect_linenum_execution.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: LinuxEnumd.txt
+    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt
+    source: "Syslog:Linux-Sysmon/Operational"
+    sourcetype: "sysmon_linux"

tests/endpoint/detect_linpeas_execution.test.yml

@@ -0,0 +1,12 @@
+name: Detect LinPeas Execution Unit Test
+tests:
+- name: Detect LinPeas Execution
+  file: endpoint/detect_linpeas_execution.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: linpeasdataset.txt
+    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linpeasdataset.txt
+    source: "Syslog:Linux-Sysmon/Operational"
+    sourcetype: "sysmon_linux"

tests/endpoint/detect_linux_exploit_suggester_execution.test.yml

@@ -0,0 +1,12 @@
+name: Detect Linux Exploit Suggester Execution Unit Test
+tests:
+- name: Detect Linux Exploit Suggester Execution
+  file: endpoint/detect_linux_exploit_suggester_execution.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: linuxexploitsuggesterdatasets.txt
+    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linuxexploitsuggesterdatasets.txt
+    source: "Syslog:Linux-Sysmon/Operational"
+    sourcetype: "sysmon_linux"

tests/endpoint/detect_mimipenguin.test.yml

@@ -0,0 +1,12 @@
+name: Detect MimiPenguin Unit Test
+tests:
+- name: Detect MimiPenguin
+  file: endpoint/detect_mimipenguin.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: mimipenguin.txt
+    data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/mimipenguin.txt
+    source: "Syslog:Linux-Sysmon/Operational"
+    sourcetype: "sysmon_linux"