From 328417d4fa6feb2ca2ca2fb878a85ae2c8c653e3 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 26 Jan 2022 14:31:04 -0800 Subject: [PATCH] test files --- .../detect_autosuid_post_exploitation_tool.test.yml | 12 ++++++++++++ tests/endpoint/detect_linenum_execution.test.yml | 12 ++++++++++++ tests/endpoint/detect_linpeas_execution.test.yml | 12 ++++++++++++ ...detect_linux_exploit_suggester_execution.test.yml | 12 ++++++++++++ tests/endpoint/detect_mimipenguin.test.yml | 12 ++++++++++++ 5 files changed, 60 insertions(+) create mode 100644 tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml create mode 100644 tests/endpoint/detect_linenum_execution.test.yml create mode 100644 tests/endpoint/detect_linpeas_execution.test.yml create mode 100644 tests/endpoint/detect_linux_exploit_suggester_execution.test.yml create mode 100644 tests/endpoint/detect_mimipenguin.test.yml diff --git a/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml b/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml new file mode 100644 index 0000000000..29c16b458d --- /dev/null +++ b/tests/endpoint/detect_autosuid_post_exploitation_tool.test.yml @@ -0,0 +1,12 @@ +name: Detect AutoSUID post exploitation tool Unit Test +tests: +- name: Detect AutoSUID post exploitation tool + file: endpoint/detect_autosuid_post_exploitation_tool.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: autoSUID.txt + data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt + source: "Syslog:Linux-Sysmon/Operational" + sourcetype: "sysmon_linux" diff --git a/tests/endpoint/detect_linenum_execution.test.yml b/tests/endpoint/detect_linenum_execution.test.yml new file mode 100644 index 0000000000..85d7de99da --- /dev/null +++ b/tests/endpoint/detect_linenum_execution.test.yml @@ -0,0 +1,12 @@ +name: Detect LinEnum execution unit Test +tests: +- name: Detect LinEnum execution + file: endpoint/detect_linenum_execution.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: LinuxEnumd.txt + data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt + source: "Syslog:Linux-Sysmon/Operational" + sourcetype: "sysmon_linux" diff --git a/tests/endpoint/detect_linpeas_execution.test.yml b/tests/endpoint/detect_linpeas_execution.test.yml new file mode 100644 index 0000000000..1e7397a056 --- /dev/null +++ b/tests/endpoint/detect_linpeas_execution.test.yml @@ -0,0 +1,12 @@ +name: Detect LinPeas Execution Unit Test +tests: +- name: Detect LinPeas Execution + file: endpoint/detect_linpeas_execution.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: linpeasdataset.txt + data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linpeasdataset.txt + source: "Syslog:Linux-Sysmon/Operational" + sourcetype: "sysmon_linux" diff --git a/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml b/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml new file mode 100644 index 0000000000..1efcd32d23 --- /dev/null +++ b/tests/endpoint/detect_linux_exploit_suggester_execution.test.yml @@ -0,0 +1,12 @@ +name: Detect Linux Exploit Suggester Execution Unit Test +tests: +- name: Detect Linux Exploit Suggester Execution + file: endpoint/detect_linux_exploit_suggester_execution.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: linuxexploitsuggesterdatasets.txt + data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linuxexploitsuggesterdatasets.txt + source: "Syslog:Linux-Sysmon/Operational" + sourcetype: "sysmon_linux" diff --git a/tests/endpoint/detect_mimipenguin.test.yml b/tests/endpoint/detect_mimipenguin.test.yml new file mode 100644 index 0000000000..a2fff212b5 --- /dev/null +++ b/tests/endpoint/detect_mimipenguin.test.yml @@ -0,0 +1,12 @@ +name: Detect MimiPenguin Unit Test +tests: +- name: Detect MimiPenguin + file: endpoint/detect_mimipenguin.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: mimipenguin.txt + data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/mimipenguin.txt + source: "Syslog:Linux-Sysmon/Operational" + sourcetype: "sysmon_linux"