diff --git a/bin/validate.py b/bin/validate.py index d0da8ab741..ed97c5196c 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -118,6 +118,9 @@ def validate_standard_fields(object, uuids): else: uuids.append(object['id']) + if (object['type']) == 'batch' and len(object['name']) > 75: + errors.append('ERROR: Search name is longer than 75 characters: %s' % (object['name'])) + # if object['name'].endswith(" "): # errors.append( # "ERROR: name has trailing spaces: '%s'" % diff --git a/detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml similarity index 92% rename from detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml rename to detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml index 1bd7e82992..5fa61fe30d 100644 --- a/detections/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml @@ -1,4 +1,4 @@ -name: Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass +name: Set Default PowerShell Execution Policy To Unrestricted or Bypass id: c2590137-0b08-4985-9ec5-6ae23d92f63d version: 6 date: '2020-11-06' @@ -13,7 +13,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime Registry.registry_key_name=ExecutionPolicy (Registry.registry_value_name=Unrestricted OR Registry.registry_value_name=Bypass) by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` - | `attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`' + | `set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Registry node. You must also be ingesting logs with the fields registry_path, registry_key_name, and registry_value_name diff --git a/tests/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.test.yml b/tests/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.test.yml similarity index 59% rename from tests/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.test.yml rename to tests/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.test.yml index efcb210456..d45f44ce25 100644 --- a/tests/endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.test.yml +++ b/tests/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.test.yml @@ -1,7 +1,7 @@ -name: Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass Unit Test +name: Set Default PowerShell Execution Policy To Unrestricted or Bypass Unit Test tests: -- name: Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass - file: endpoint/attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +- name: Set Default PowerShell Execution Policy To Unrestricted or Bypass + file: endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now'