Merge pull request #986 from splunk/TR-301

Changed test script and detections to comply with new format
2026-06-08 17:32:49 +00:00 · 2020-12-03 13:29:05 +01:00
parent c841d1d1c7 5cbbcf9bd0
commit 48e95fe940
73 changed files with 286 additions and 287 deletions
@@ -70,16 +70,16 @@ def test_detection(test, args):
        name = test_desc['name']
        log(logging.INFO, "Testing %s" % name)
        # Download data to temporal folder
-        for unit in test_desc['detections']:
+        for unit in test_desc['tests']:
            detection = get_detection(unit)
            if detection['type'] == "SSA":
                # Prepare data
                data_dir = tempfile.TemporaryDirectory(prefix="data", dir=get_path("%s" % SSML_CWD))
                detection_file = get_path("../detections/%s" % unit['file'])
-                if test_desc['attack_data'] is None or len(test_desc['attack_data']) == 0:
+                if unit['attack_data'] is None or len(unit['attack_data']) == 0:
                    log(logging.ERROR, "No dataset in testing file in %s" % test)
                    return False
-                test_data = pull_data(test_desc, data_dir.name)
+                test_data = pull_data(unit, data_dir.name)
                # Extract pipeline and remove SSA decorations
                input_data = test_data[list(test_data.keys())[0]]
                spl2 = extract_pipeline(detection['search'], input_data, unit['pass_condition'])
@@ -41,7 +41,7 @@ def populate_coverage(types):
            if test.endswith('.yml') or test.endswith('yaml'):
                with open(os.path.join(root, test), 'r') as test_fh:
                    test_desc = yaml.safe_load(test_fh)
-                    for t in test_desc['detections']:
+                    for t in test_desc['tests']:
                        detection_desc = parse_detection(get_path("../detections/%s" % t['file']))
                        detection_type = detection_desc['type']
                        if detection_type in types:
@@ -18,4 +18,4 @@ tests:
    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
    sourcetype: aws:cloudtrail
    source: aws_cloudtrail
-    update_timestamp: True
+    update_timestamp: True
@@ -18,4 +18,4 @@ tests:
    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
    sourcetype: aws:cloudtrail
    source: aws_cloudtrail
-    update_timestamp: True
+    update_timestamp: True
@@ -18,4 +18,4 @@ tests:
    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
    sourcetype: aws:cloudtrail
    source: aws_cloudtrail
-    update_timestamp: True
+    update_timestamp: True
@@ -18,4 +18,4 @@ tests:
    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
    sourcetype: aws:cloudtrail
    source: aws_cloudtrail
-    update_timestamp: True
+    update_timestamp: True
@@ -24,4 +24,4 @@ tests:
    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
    sourcetype: aws:cloudtrail
    source: aws_cloudtrail
-    update_timestamp: True
+    update_timestamp: True
@@ -24,4 +24,4 @@ tests:
    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
    sourcetype: aws:cloudtrail
    source: aws_cloudtrail
-    update_timestamp: True
+    update_timestamp: True
@@ -24,4 +24,4 @@ tests:
    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
    sourcetype: aws:cloudtrail
    source: aws_cloudtrail
-    update_timestamp: True
+    update_timestamp: True
@@ -24,4 +24,4 @@ tests:
    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
    sourcetype: aws:cloudtrail
    source: aws_cloudtrail
-    update_timestamp: True
+    update_timestamp: True
@@ -24,4 +24,4 @@ tests:
    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
    sourcetype: aws:cloudtrail
    source: aws_cloudtrail
-    update_timestamp: True
+    update_timestamp: True
@@ -26,4 +26,4 @@ tests:
    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
    sourcetype: aws:cloudtrail
    source: aws_cloudtrail
-    update_timestamp: True
+    update_timestamp: True
@@ -24,4 +24,4 @@ tests:
    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
    sourcetype: aws:cloudtrail
    source: aws_cloudtrail
-    update_timestamp: True
+    update_timestamp: True
@@ -24,4 +24,4 @@ tests:
    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
    sourcetype: aws:cloudtrail
    source: aws_cloudtrail
-    update_timestamp: True
+    update_timestamp: True
@@ -24,4 +24,4 @@ tests:
    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
    sourcetype: aws:cloudtrail
    source: aws_cloudtrail
-    update_timestamp: True
+    update_timestamp: True
@@ -24,4 +24,4 @@ tests:
    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
    sourcetype: aws:cloudtrail
    source: aws_cloudtrail
-    update_timestamp: True
+    update_timestamp: True
@@ -24,4 +24,4 @@ tests:
    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
    sourcetype: aws:cloudtrail
    source: aws_cloudtrail
-    update_timestamp: True
+    update_timestamp: True
@@ -24,4 +24,4 @@ tests:
    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
    sourcetype: aws:cloudtrail
    source: aws_cloudtrail
-    update_timestamp: True
+    update_timestamp: True
@@ -24,4 +24,4 @@ tests:
    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
    sourcetype: aws:cloudtrail
    source: aws_cloudtrail
-    update_timestamp: True
+    update_timestamp: True
@@ -24,4 +24,4 @@ tests:
    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
    sourcetype: aws:cloudtrail
    source: aws_cloudtrail
-    update_timestamp: True
+    update_timestamp: True
@@ -1,9 +1,9 @@
 name: Attempted Credential Dump From Registry via Reg exe - SSA Unit test
-detections:
+tests:
  - name: Attempted Credential Dump From Registry via Reg exe
    file: endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml
    pass_condition: ''
-description: Test credential dumping detections
-attack_data:
-  - file_name: windows-security_ssa.log
-    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.002/windows-security_ssa.log
+    description: Test credential dumping detections
+    attack_data:
+      - file_name: windows-security_ssa.log
+        data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.002/windows-security_ssa.log
@@ -3,7 +3,7 @@ tests:
  - name: Detect Dump LSASS Memory using comsvcs
    file: endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test credential dumping detections
-attack_data:
-  - file_name: windows-security-events_ssa.log
-    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.001/windows-security-events_ssa.log
+    description: Test credential dumping detections
+    attack_data:
+      - file_name: windows-security-events_ssa.log
+        data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.001/windows-security-events_ssa.log
@@ -1,10 +1,10 @@
 name: Detect Prohibited Applications Spawning cmd exe Unit Test
-detections:
+tests:
  - name: Access LSASS Memory for Dump Creation
    file: endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml
    pass_condition: ''
-description: Test credential dumping detections
-attack_data:
-  - file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json
+    description: Test credential dumping detections
+    attack_data:
+      - file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json

@@ -1,9 +1,9 @@
 name: First time seen command line argument - SSA Unit Test
-detections:
+tests:
  - name: First time seen command line argument
    file: endpoint/first_time_seen_cmd_line___ssa.yml
    pass_condition: ''
-description: Test detection of first time seen command
-attack_data:
-  - file_name: first_time_seen_commandline.json
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/first_time_seen_commandline.json
+    description: Test detection of first time seen command
+    attack_data:
+      - file_name: first_time_seen_commandline.json
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/first_time_seen_commandline.json
@@ -1,9 +1,9 @@
 name: Detect Prohibited Applications Spawning cmd exe - SSA
-detections:
+tests:
  - name: Detect Prohibited Applications Spawning cmd exe
    file: endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml
    pass_condition: ''
-description: Test prohibited apps spawning cmd.exe
-attack_data:
-  - file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json
+    description: Test prohibited apps spawning cmd.exe
+    attack_data:
+      - file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json
@@ -1,10 +1,10 @@
 name: Rare Parent/Child Process Relationship - SSA Unit Test
-detections:
+tests:
  - name: Access LSASS Memory for Dump Creation
    file: endpoint/rare_parent_process_relationship_lolbas___ssa.yaml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test detection looking for LOLBAS processes spawned by other processes that are rarely seen together
-attack_data:
-  - file_name: T1059.all.labeled.lolbas-test.json
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/T1059.all.labeled.lolbas-test.json
+    description: Test detection looking for LOLBAS processes spawned by other processes that are rarely seen together
+    attack_data:
+      - file_name: T1059.all.labeled.lolbas-test.json
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/T1059.all.labeled.lolbas-test.json

@@ -1,10 +1,10 @@
 name: Applying Stolen Credentials via Mimikatz modules - SSA Unit test
-detections:
+tests:
  - name: Applying Stolen Credentials via Mimikatz modules
    file: endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test applying stolen credentials detections
-attack_data:
-  - file_name: logAllMimikatzModules.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log
+    description: Test applying stolen credentials detections
+    attack_data:
+      - file_name: logAllMimikatzModules.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log

@@ -1,10 +1,10 @@
 name: Applying Stolen Credentials via PowerSploit modules - SSA Unit test
-detections:
+tests:
  - name: Applying Stolen Credentials via PowerSploit
    file: endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test applying stolen credentials detections
-attack_data:
-  - file_name: logAllPowerSploitModulesWithOldNames.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log
+    description: Test applying stolen credentials detections
+    attack_data:
+      - file_name: logAllPowerSploitModulesWithOldNames.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log

@@ -1,10 +1,10 @@
 name: Assessment of Credential Strength via DSInternals modules - SSA Unit test
-detections:
+tests:
  - name: Assessment of Credential Strength via DSInternals modules
    file: endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test assessment of credential strength detections
-attack_data:
-  - file_name: logAllDSInternalsModules.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log
+    description: Test assessment of credential strength detections
+    attack_data:
+      - file_name: logAllDSInternalsModules.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log

@@ -1,10 +1,10 @@
 name: Credential Extraction indicative of use of DSInternals credential conversion modules - SSA Unit test
-detections:
+tests:
  - name: Credential Extraction indicative of use of DSInternals credential conversion modules
    file: endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test credential extraction detections
-attack_data:
-  - file_name: logAllDSInternalsModules.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log
+    description: Test credential extraction detections
+    attack_data:
+      - file_name: logAllDSInternalsModules.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log

@@ -1,10 +1,10 @@
 name: Credential Extraction indicative of use of DSInternals modules - SSA Unit test
-detections:
+tests:
  - name: Credential Extraction indicative of use of DSInternals modules
    file: endpoint/ssa___credential_extraction_dsinternals_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test credential extraction detections
-attack_data:
-  - file_name: logAllDSInternalsModules.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log
+    description: Test credential extraction detections
+    attack_data:
+      - file_name: logAllDSInternalsModules.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log

@@ -1,10 +1,10 @@
 name: Credential Extraction indicative of FGDump and CacheDump with s option - SSA Unit test
-detections:
+tests:
  - name: Credential Extraction indicative of FGDump and CacheDump with s option
    file: endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test credential extraction detections
-attack_data:
-  - file_name: logFgdump.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logFgdump.log
+    description: Test credential extraction detections
+    attack_data:
+      - file_name: logFgdump.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logFgdump.log

@@ -1,10 +1,9 @@
 name: Credential Extraction indicative of FGDump and CacheDump with v option - SSA Unit test
-detections:
+tests:
  - name: Credential Extraction indicative of FGDump and CacheDump with v option
    file: endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test credential extraction detections
-attack_data:
-  - file_name: logFgdump.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logFgdump.log
-
+    description: Test credential extraction detections
+    attack_data:
+      - file_name: logFgdump.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logFgdump.log
@@ -1,10 +1,10 @@
 name: Credential Extraction via Get-ADDBAccount module present in PowerSploit and DSInternals - SSA Unit test
-detections:
+tests:
  - name: Credential Extraction via Get-ADDBAccount module present in PowerSploit and DSInternals
    file: endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test credential extraction detections
-attack_data:
-  - file_name: logPowerShellModule.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logPowerShellModule.log
+    description: Test credential extraction detections
+    attack_data:
+      - file_name: logPowerShellModule.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logPowerShellModule.log

@@ -1,10 +1,10 @@
 name: Credential Extraction indicative of Lazagne command line options - SSA Unit test
-detections:
+tests:
  - name: Credential Extraction indicative of Lazagne command line options
    file: endpoint/ssa___credential_extraction_lazagne_command_options.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test credential extraction detections
-attack_data:
-  - file_name: logLazagneCredDump.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logLazagneCredDump.log
+    description: Test credential extraction detections
+    attack_data:
+      - file_name: logLazagneCredDump.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logLazagneCredDump.log

@@ -1,10 +1,10 @@
 name: Credential Extraction indicative of use of Mimikatz modules - SSA Unit test
-detections:
+tests:
  - name: Credential Extraction indicative of use of Mimikatz modules
    file: endpoint/ssa___credential_extraction_mimikatz_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test credential extraction detections
-attack_data:
-  - file_name: logAllMimikatzModules.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log
+    description: Test credential extraction detections
+    attack_data:
+      - file_name: logAllMimikatzModules.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log

@@ -1,10 +1,10 @@
 name: Credential Extraction native Microsoft debuggers peek into the kernel - SSA Unit test
-detections:
+tests:
  - name: Credential Extraction native Microsoft debuggers peek into the kernel
    file: endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test credential extraction detections
-attack_data:
-  - file_name: logLiveKDFullKernelDump.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logLiveKDFullKernelDump.log
+    description: Test credential extraction detections
+    attack_data:
+      - file_name: logLiveKDFullKernelDump.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logLiveKDFullKernelDump.log

@@ -1,10 +1,10 @@
 name: Credential Extraction native Microsoft debuggers via z command line option - SSA Unit test
-detections:
+tests:
  - name: Credential Extraction native Microsoft debuggers via z command line option
    file: endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test credential extraction detections
-attack_data:
-  - file_name: logLiveKDFullKernelDump.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logLiveKDFullKernelDump.log
+    description: Test credential extraction detections
+    attack_data:
+      - file_name: logLiveKDFullKernelDump.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logLiveKDFullKernelDump.log

@@ -1,10 +1,10 @@
 name: Credential Extraction indicative of use of PowerSploit modules - SSA Unit test
-detections:
+tests:
  - name: Credential Extraction indicative of use of PowerSploit modules
    file: endpoint/ssa___credential_extraction_powersploit_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test credential extraction detections
-attack_data:
-  - file_name: logAllPowerSploitModulesWithOldNames.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log
+    description: Test credential extraction detections
+    attack_data:
+      - file_name: logAllPowerSploitModulesWithOldNames.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log

@@ -1,10 +1,10 @@
 name: Detect Kerberoasting - SSA Unit test
-detections:
+tests:
  - name: Detect kerberoasting
    file: endpoint/ssa___detect_kerberoasting.yml 
    pass_condition: ''
-description: Test detection of kerberoasting
-attack_data:
-  - file_name: T1558.003.json
-    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1558.003/T1558.003.json
+    description: Test detection of kerberoasting
+    attack_data:
+      - file_name: T1558.003.json
+        data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1558.003/T1558.003.json

@@ -1,10 +1,10 @@
 name: Detect Pass the Hash - SSA Unit test
-detections:
+tests:
  - name: Detect Pass the Hash
    file: endpoint/ssa___detect_pass_hash.yml 
    pass_condition: ''
-description: Test detection of pass-the-hash
-attack_data:
-  - file_name: T1550.002.json
-    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1550.002/T1550.002.json
+    description: Test detection of pass-the-hash
+    attack_data:
+      - file_name: T1550.002.json
+        data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1550.002/T1550.002.json

@@ -1,10 +1,10 @@
 name: Illegal Access To User Content via PowerSploit modules - SSA Unit test
-detections:
+tests:
  - name: Illegal Access To User Content via PowerSploit modules
    file: endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test illegal access to user content detections
-attack_data:
-  - file_name: logAllPowerSploitModulesWithOldNames.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log
+    description: Test illegal access to user content detections
+    attack_data:
+      - file_name: logAllPowerSploitModulesWithOldNames.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log

@@ -1,10 +1,10 @@
 name: Illegal Account Creation via PowerSploit modules - SSA Unit test
-detections:
+tests:
  - name: Illegal Account Creation via PowerSploit modules
    file: endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test illegal account creation detections
-attack_data:
-  - file_name: logAllPowerSploitModulesWithOldNames.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log
+    description: Test illegal account creation detections
+    attack_data:
+      - file_name: logAllPowerSploitModulesWithOldNames.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log

@@ -1,10 +1,10 @@
 name: Illegal Enabling or Disabling of Accounts via DSInternals modules - SSA Unit test
-detections:
+tests:
  - name: Illegal Enabling or Disabling of Accounts via DSInternals modules
    file: endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test enabling or disabling of accounts detections
-attack_data:
-  - file_name: logAllDSInternalsModules.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log
+    description: Test enabling or disabling of accounts detections
+    attack_data:
+      - file_name: logAllDSInternalsModules.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log

@@ -1,10 +1,10 @@
 name: Illegal Deletion of Logs via Mimikatz modules - SSA Unit test
-detections:
+tests:
  - name: Illegal Deletion of Logs via Mimikatz modules 
    file: endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test illegal log deletion detections
-attack_data:
-  - file_name: logAllMimikatzModules.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log
+    description: Test illegal log deletion detections
+    attack_data:
+      - file_name: logAllMimikatzModules.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log

@@ -1,9 +1,9 @@
 name: Illegal Management of Active Directory Elements and Policies via DSInternals modules - SSA Unit test
-detections:
+tests:
  - name: Illegal Management of Active Directory Elements and Policies via DSInternals modules
    file: endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test illegal management of Active Directory elements and policies detections
-attack_data:
-  - file_name: logAllDSInternalsModules.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log
+    description: Test illegal management of Active Directory elements and policies detections
+    attack_data:
+      - file_name: logAllDSInternalsModules.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log
@@ -1,10 +1,10 @@
 name: Illegal Management of Computers and Active Directory Elements via PowerSploit modules - SSA Unit test
-detections:
+tests:
  - name: Illegal Management of Computers and Active Directory Elements via PowerSploit modules
    file: endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test illegal management of computers and Active Directory elements detections
-attack_data:
-  - file_name: logAllPowerSploitModulesWithOldNames.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log
+    description: Test illegal management of computers and Active Directory elements detections
+    attack_data:
+      - file_name: logAllPowerSploitModulesWithOldNames.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log

@@ -1,10 +1,10 @@
 name: Illegal Privilege Elevation and Persistence via PowerSploit modules - SSA Unit test
-detections:
+tests:
  - name: Illegal Privilege Elevation and Persistence via PowerSploit modules
    file: endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test privilege elevation and persistence detections
-attack_data:
-  - file_name: logAllPowerSploitModulesWithOldNames.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log
+    description: Test privilege elevation and persistence detections
+    attack_data:
+      - file_name: logAllPowerSploitModulesWithOldNames.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log

@@ -1,10 +1,10 @@
 name: Illegal Privilege Elevation via Mimikatz modules - SSA Unit test
-detections:
+tests:
  - name: Illegal Privilege Elevation via Mimikatz modules
    file: endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test illegal privilege elevation detections
-attack_data:
-  - file_name: logAllMimikatzModules.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log
+    description: Test illegal privilege elevation detections
+    attack_data:
+      - file_name: logAllMimikatzModules.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log

@@ -1,10 +1,10 @@
 name: Illegal Service and Process Control via Mimikatz modules - SSA Unit test
-detections:
+tests:
  - name: Illegal Service and Process Control via Mimikatz modules
    file: endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test illegal service and process control detections
-attack_data:
-  - file_name: logAllMimikatzModules.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log
+    description: Test illegal service and process control detections
+    attack_data:
+      - file_name: logAllMimikatzModules.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log

@@ -1,10 +1,10 @@
 name: Illegal Service and Process Control via PowerSploit modules - SSA Unit test
-detections:
+tests:
  - name: Illegal Service and Process Control via PowerSploit modules
    file: endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test illegal service and process control detections
-attack_data:
-  - file_name: logAllPowerSploitModulesWithOldNames.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log
+    description: Test illegal service and process control detections
+    attack_data:
+      - file_name: logAllPowerSploitModulesWithOldNames.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log

@@ -1,10 +1,10 @@
 name: Probing Access with Stolen Credentials via PowerSploit modules - SSA Unit test
-detections:
+tests:
  - name: Probing Access with Stolen Credentials via PowerSploit modules
    file: endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test access probing with stolen credentials detections
-attack_data:
-  - file_name: logAllPowerSploitModulesWithOldNames.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log
+    description: Test access probing with stolen credentials detections
+    attack_data:
+      - file_name: logAllPowerSploitModulesWithOldNames.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log

@@ -1,10 +1,10 @@
 name: Reconnaissance of Access and Persistence Opportunities via PowerSploit modules - SSA Unit test
-detections:
+tests:
  - name: Reconnaissance of Access and Persistence Opportunities via PowerSploit modules
    file: endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml 
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test reconnaissance of access and persistence detections
-attack_data:
-  - file_name: logAllPowerSploitModulesWithOldNames.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log
+    description: Test reconnaissance of access and persistence detections
+    attack_data:
+      - file_name: logAllPowerSploitModulesWithOldNames.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log

@@ -1,10 +1,10 @@
 name: Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules - SSA Unit test
-detections:
+tests:
  - name: Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules
    file: endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml 
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test reconnaissance and access to accounts groups and policies detections
-attack_data:
-  - file_name: logAllPowerSploitModulesWithOldNames.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log
+    description: Test reconnaissance and access to accounts groups and policies detections
+    attack_data:
+      - file_name: logAllPowerSploitModulesWithOldNames.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log

@@ -1,10 +1,10 @@
 name: Reconnaissance and Access to Accounts and Groups via Mimikatz modules - SSA Unit test
-detections:
+tests:
  - name: Reconnaissance and Access to Accounts and Groups via Mimikatz modules
    file: endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test reconnaissance and access to accounts and groups detections
-attack_data:
-  - file_name: logAllMimikatzModules.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log
+    description: Test reconnaissance and access to accounts and groups detections
+    attack_data:
+      - file_name: logAllMimikatzModules.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log

@@ -1,10 +1,10 @@
 name: Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit modules - SSA Unit test
-detections:
+tests:
  - name: Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit modules
    file: endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test reconnaissance and access to active directory infrastrucutre detections
-attack_data:
-  - file_name: logAllPowerSploitModulesWithOldNames.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log
+    description: Test reconnaissance and access to active directory infrastrucutre detections
+    attack_data:
+      - file_name: logAllPowerSploitModulesWithOldNames.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log

@@ -1,10 +1,10 @@
 name: Reconnaissance and Access to Computers and Domains via PowerSploit modules - SSA Unit test
-detections:
+tests:
  - name: Reconnaissance and Access to Computers and Domains via PowerSploit modules
    file: endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test reconnaissance and access to computers and domains detections
-attack_data:
-  - file_name: logAllPowerSploitModulesWithOldNames.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log
+    description: Test reconnaissance and access to computers and domains detections
+    attack_data:
+      - file_name: logAllPowerSploitModulesWithOldNames.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log

@@ -1,10 +1,10 @@
 name: Reconnaissance and Access to Computers via Mimikatz modules - SSA Unit test
-detections:
+tests:
  - name: Reconnaissance and Access to Computers via Mimikatz modules
    file: endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test reconnaissance and access to computers detections
-attack_data:
-  - file_name: logAllMimikatzModules.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log
+    description: Test reconnaissance and access to computers detections
+    attack_data:
+      - file_name: logAllMimikatzModules.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log

@@ -1,10 +1,10 @@
 name: Reconnaissance and Access to Operating System Elements via PowerSploit modules - SSA Unit test
-detections:
+tests:
  - name: Reconnaissance and Access to Operating System Elements via PowerSploit modules
    file: endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test reconnaissance and access to operating system element detections
-attack_data:
-  - file_name: logAllPowerSploitModulesWithOldNames.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log
+    description: Test reconnaissance and access to operating system element detections
+    attack_data:
+      - file_name: logAllPowerSploitModulesWithOldNames.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log

@@ -1,10 +1,10 @@
 name: Reconnaissance and Access to Shared Resources via Mimikatz modules - SSA Unit test
-detections:
+tests:
  - name: Reconnaissance and Access to Shared Resources via Mimikatz modules
    file: endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test reconnaissance and access to network shares detections
-attack_data:
-  - file_name: logAllMimikatzModules.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log
+    description: Test reconnaissance and access to network shares detections
+    attack_data:
+      - file_name: logAllMimikatzModules.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log

@@ -1,10 +1,10 @@
 name: Reconnaissance and Access to Shared Resources via PowerSploit modules - SSA Unit test
-detections:
+tests:
  - name: Reconnaissance and Access to Shared Resources via PowerSploit modules
    file: endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test reconnaissance and access to shares detections
-attack_data:
-  - file_name: logAllPowerSploitModulesWithOldNames.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log
+    description: Test reconnaissance and access to shares detections
+    attack_data:
+      - file_name: logAllPowerSploitModulesWithOldNames.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log

@@ -1,10 +1,10 @@
 name: Reconnaissance of Connectivity via PowerSploit modules - SSA Unit test
-detections:
+tests:
  - name: Reconnaissance of Connectivity via PowerSploit modules
    file: endpoint/ssa___recon_connectivity_via_powersploit_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test reconnaissance of connectivity detections
-attack_data:
-  - file_name: logAllPowerSploitModulesWithOldNames.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log
+    description: Test reconnaissance of connectivity detections
+    attack_data:
+      - file_name: logAllPowerSploitModulesWithOldNames.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log

@@ -1,10 +1,10 @@
 name: Reconnaissance of Credential Stores and Services via Mimikatz modules - SSA Unit test
-detections:
+tests:
  - name: Reconnaissance of Credential Stores and Services via Mimikatz modules
    file: endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test reconnaissance of credential stores and services detections
-attack_data:
-  - file_name: logAllMimikatzModules.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log
+    description: Test reconnaissance of credential stores and services detections
+    attack_data:
+      - file_name: logAllMimikatzModules.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log

@@ -1,10 +1,10 @@
 name: Reconnaissance of Defensive Tools via PowerSploit modules - SSA Unit test
-detections:
+tests:
  - name: Reconnaissance of Defensive Tools via PowerSploit modules
    file: endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test reconnaissance of presence of defensive tools detections
-attack_data:
-  - file_name: logAllPowerSploitModulesWithOldNames.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log
+    description: Test reconnaissance of presence of defensive tools detections
+    attack_data:
+      - file_name: logAllPowerSploitModulesWithOldNames.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log

@@ -1,10 +1,10 @@
 name: Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules - SSA Unit test
-detections:
+tests:
  - name: Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules
    file: endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test reconnaissance of privilege escalations opportunities detections
-attack_data:
-  - file_name: logAllPowerSploitModulesWithOldNames.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log
+    description: Test reconnaissance of privilege escalations opportunities detections
+    attack_data:
+      - file_name: logAllPowerSploitModulesWithOldNames.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log

@@ -1,10 +1,10 @@
 name: Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules - SSA Unit test
-detections:
+tests:
  - name: Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules
    file: endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test reconnaissance of process or service hijacking detections
-attack_data:
-  - file_name: logAllMimikatzModules.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log
+    description: Test reconnaissance of process or service hijacking detections
+    attack_data:
+      - file_name: logAllMimikatzModules.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log

@@ -1,10 +1,10 @@
 name: Reconnaissance and Access to Processes and Services via Mimikatz modules - SSA Unit test
-detections:
+tests:
  - name: Reconnaissance and Access to Processes and Services via Mimikatz modules
    file: endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test reconnaissance of processes and services detections
-attack_data:
-  - file_name: logAllMimikatzModules.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log
+    description: Test reconnaissance of processes and services detections
+    attack_data:
+      - file_name: logAllMimikatzModules.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log

@@ -1,10 +1,10 @@
 name: Setting Credentials via DSInternals modules - SSA Unit test
-detections:
+tests:
  - name: Setting Credentials via DSInternals modules
    file: endpoint/ssa___setting_credentials_via_dsinternals_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test illegal credential setting detections
-attack_data:
-  - file_name: logAllDSInternalsModules.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log
+    description: Test illegal credential setting detections
+    attack_data:
+      - file_name: logAllDSInternalsModules.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log

@@ -1,10 +1,10 @@
 name: Setting Credentials via Mimikatz modules - SSA Unit test
-detections:
+tests:
  - name: Setting Credentials via Mimikatz modules
    file: endpoint/ssa___setting_credentials_via_mimikatz_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test illegal credential setting detections
-attack_data:
-  - file_name: logAllMimikatzModules.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log
+    description: Test illegal credential setting detections
+    attack_data:
+      - file_name: logAllMimikatzModules.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log

@@ -1,10 +1,10 @@
 name: Setting Credentials via PowerSploit modules - SSA Unit test
-detections:
+tests:
  - name: Setting Credentials via PowerSploit modules
    file: endpoint/ssa___setting_credentials_via_powersploit_modules.yml
    pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0'
-description: Test illegal credential setting detections
-attack_data:
-  - file_name: logAllPowerSploitModulesWithOldNames.log
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log
+    description: Test illegal credential setting detections
+    attack_data:
+      - file_name: logAllPowerSploitModulesWithOldNames.log
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log

@@ -1,9 +1,9 @@
 name: System Process Running from Unexpected Location - SSA Unit Test
-detections:
+tests:
  - name: System Process Running from Unexpected Location - SSA
    file: endpoint/system_process_running_unexpected_location___ssa.yml
    pass_condition: ''
-description: Test process running from other locations
-attack_data:
-  - file_name: unusual-location-test.json
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unusual-location-test.json
+    description: Test process running from other locations
+    attack_data:
+      - file_name: unusual-location-test.json
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unusual-location-test.json
@@ -1,9 +1,9 @@
 name: More than usual number of LOLBAS applications in short time period - SSA Unit Test
-detections:
+tests:
  - name: More than usual number of LOLBAS applications in short time period
    file: endpoint/unusual_lolbas_in_short_period_of_time___ssa.yml
    pass_condition: ''
-description: Test more than usual lolbas being executed in a short period of time
-attack_data:
-  - file_name: T1059.all.labeled.lolbas-test.json
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/T1059.all.labeled.lolbas-test.json
+    description: Test more than usual lolbas being executed in a short period of time
+    attack_data:
+      - file_name: T1059.all.labeled.lolbas-test.json
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/T1059.all.labeled.lolbas-test.json
@@ -1,10 +1,10 @@
 name: Unusually Long Command Line - SSA Unit Test
-detections:
+tests:
  - name: Unusually Long Command Line
    file: endpoint/unusually_long_command_line___ssa.yml
    pass_condition: ''
-description: Test unusually long command lines
-attack_data:
-  - file_name: unusual_commandline.json
-    data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unusual_commandline.json
+    description: Test unusually long command lines
+    attack_data:
+      - file_name: unusual_commandline.json
+        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unusual_commandline.json