diff --git a/bin/ssa_test.py b/bin/ssa_test.py index 4fb1b70701..f6c04eac96 100644 --- a/bin/ssa_test.py +++ b/bin/ssa_test.py @@ -70,16 +70,16 @@ def test_detection(test, args): name = test_desc['name'] log(logging.INFO, "Testing %s" % name) # Download data to temporal folder - for unit in test_desc['detections']: + for unit in test_desc['tests']: detection = get_detection(unit) if detection['type'] == "SSA": # Prepare data data_dir = tempfile.TemporaryDirectory(prefix="data", dir=get_path("%s" % SSML_CWD)) detection_file = get_path("../detections/%s" % unit['file']) - if test_desc['attack_data'] is None or len(test_desc['attack_data']) == 0: + if unit['attack_data'] is None or len(unit['attack_data']) == 0: log(logging.ERROR, "No dataset in testing file in %s" % test) return False - test_data = pull_data(test_desc, data_dir.name) + test_data = pull_data(unit, data_dir.name) # Extract pipeline and remove SSA decorations input_data = test_data[list(test_data.keys())[0]] spl2 = extract_pipeline(detection['search'], input_data, unit['pass_condition']) diff --git a/bin/testing_coverage.py b/bin/testing_coverage.py index 2bbb13e392..5ec6508ca0 100644 --- a/bin/testing_coverage.py +++ b/bin/testing_coverage.py @@ -41,7 +41,7 @@ def populate_coverage(types): if test.endswith('.yml') or test.endswith('yaml'): with open(os.path.join(root, test), 'r') as test_fh: test_desc = yaml.safe_load(test_fh) - for t in test_desc['detections']: + for t in test_desc['tests']: detection_desc = parse_detection(get_path("../detections/%s" % t['file'])) detection_type = detection_desc['type'] if detection_type in types: diff --git a/tests/cloud/abnormally_high_cloud_instances_destroyed.test.yml b/tests/cloud/abnormally_high_cloud_instances_destroyed.test.yml index 8bd1e72463..3f61ea9962 100644 --- a/tests/cloud/abnormally_high_cloud_instances_destroyed.test.yml +++ b/tests/cloud/abnormally_high_cloud_instances_destroyed.test.yml @@ -18,4 +18,4 @@ tests: data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: True \ No newline at end of file + update_timestamp: True diff --git a/tests/cloud/abnormally_high_cloud_instances_launched.test.yml b/tests/cloud/abnormally_high_cloud_instances_launched.test.yml index fc096e7bef..ab15067788 100644 --- a/tests/cloud/abnormally_high_cloud_instances_launched.test.yml +++ b/tests/cloud/abnormally_high_cloud_instances_launched.test.yml @@ -18,4 +18,4 @@ tests: data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: True \ No newline at end of file + update_timestamp: True diff --git a/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml b/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml index ca163e5aeb..ddd41ce163 100644 --- a/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml +++ b/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml @@ -18,4 +18,4 @@ tests: data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: True \ No newline at end of file + update_timestamp: True diff --git a/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml b/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml index a01943263d..1f23dbd74d 100644 --- a/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml +++ b/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml @@ -18,4 +18,4 @@ tests: data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: True \ No newline at end of file + update_timestamp: True diff --git a/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml b/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml index 1b157cb710..5f40139464 100644 --- a/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml +++ b/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml @@ -24,4 +24,4 @@ tests: data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: True \ No newline at end of file + update_timestamp: True diff --git a/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml b/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml index e6aea07454..15ea3c2a26 100644 --- a/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml +++ b/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml @@ -24,4 +24,4 @@ tests: data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: True \ No newline at end of file + update_timestamp: True diff --git a/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml b/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml index 0496572389..78c5c3aa3d 100644 --- a/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml +++ b/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml @@ -24,4 +24,4 @@ tests: data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: True \ No newline at end of file + update_timestamp: True diff --git a/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml b/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml index af25b5286c..c0fcf50a38 100644 --- a/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml +++ b/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml @@ -24,4 +24,4 @@ tests: data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: True \ No newline at end of file + update_timestamp: True diff --git a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml index d78f2c70a6..006ac5620e 100644 --- a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml +++ b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml @@ -24,4 +24,4 @@ tests: data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: True \ No newline at end of file + update_timestamp: True diff --git a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml index d98e6b148e..d6415f7904 100644 --- a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml +++ b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml @@ -26,4 +26,4 @@ tests: data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: True \ No newline at end of file + update_timestamp: True diff --git a/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml b/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml index de0503e506..ccbb1ff50c 100644 --- a/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml +++ b/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml @@ -24,4 +24,4 @@ tests: data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: True \ No newline at end of file + update_timestamp: True diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml index 49f79de51c..c0b2ea455d 100644 --- a/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml +++ b/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml @@ -24,4 +24,4 @@ tests: data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: True \ No newline at end of file + update_timestamp: True diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml index d83f1eee79..1eda84d927 100644 --- a/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml +++ b/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml @@ -24,4 +24,4 @@ tests: data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: True \ No newline at end of file + update_timestamp: True diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml index ef343eb58d..e6b710eff5 100644 --- a/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml +++ b/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml @@ -24,4 +24,4 @@ tests: data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: True \ No newline at end of file + update_timestamp: True diff --git a/tests/cloud/detect_aws_console_login_by_new_user.test.yml b/tests/cloud/detect_aws_console_login_by_new_user.test.yml index ac5f1a3b57..54a02cf2f3 100644 --- a/tests/cloud/detect_aws_console_login_by_new_user.test.yml +++ b/tests/cloud/detect_aws_console_login_by_new_user.test.yml @@ -24,4 +24,4 @@ tests: data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: True \ No newline at end of file + update_timestamp: True diff --git a/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml b/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml index 794cb11c6d..9d8b60402a 100644 --- a/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml +++ b/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml @@ -24,4 +24,4 @@ tests: data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: True \ No newline at end of file + update_timestamp: True diff --git a/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml b/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml index ac50c95a3a..fe3a3fa513 100644 --- a/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml +++ b/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml @@ -24,4 +24,4 @@ tests: data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: True \ No newline at end of file + update_timestamp: True diff --git a/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml b/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml index 58313fba0c..66d65a9834 100644 --- a/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml +++ b/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml @@ -24,4 +24,4 @@ tests: data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: True \ No newline at end of file + update_timestamp: True diff --git a/tests/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.test.yml b/tests/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.test.yml index fbad49f39c..5507b09024 100644 --- a/tests/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.test.yml +++ b/tests/endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.test.yml @@ -1,9 +1,9 @@ name: Attempted Credential Dump From Registry via Reg exe - SSA Unit test -detections: +tests: - name: Attempted Credential Dump From Registry via Reg exe file: endpoint/attempted_credential_dump_from_registry_via_reg_exe___ssa.yml pass_condition: '' -description: Test credential dumping detections -attack_data: - - file_name: windows-security_ssa.log - data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.002/windows-security_ssa.log + description: Test credential dumping detections + attack_data: + - file_name: windows-security_ssa.log + data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.002/windows-security_ssa.log diff --git a/tests/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.test.yml b/tests/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.test.yml index 780c38ac08..c2265626b1 100644 --- a/tests/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.test.yml +++ b/tests/endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.test.yml @@ -3,7 +3,7 @@ tests: - name: Detect Dump LSASS Memory using comsvcs file: endpoint/detect_dump_lsass_memory_using_comsvcs___ssa.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test credential dumping detections -attack_data: - - file_name: windows-security-events_ssa.log - data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.001/windows-security-events_ssa.log + description: Test credential dumping detections + attack_data: + - file_name: windows-security-events_ssa.log + data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.001/windows-security-events_ssa.log diff --git a/tests/endpoint/detect_prohibited_applications_spawning_cmd_exe__ssa.test.yml b/tests/endpoint/detect_prohibited_applications_spawning_cmd_exe__ssa.test.yml index 24a2fed4b2..5892c7ed22 100644 --- a/tests/endpoint/detect_prohibited_applications_spawning_cmd_exe__ssa.test.yml +++ b/tests/endpoint/detect_prohibited_applications_spawning_cmd_exe__ssa.test.yml @@ -1,10 +1,10 @@ name: Detect Prohibited Applications Spawning cmd exe Unit Test -detections: +tests: - name: Access LSASS Memory for Dump Creation file: endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml pass_condition: '' -description: Test credential dumping detections -attack_data: - - file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json + description: Test credential dumping detections + attack_data: + - file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json diff --git a/tests/endpoint/first_time_seen_cmd_line___ssa.test.yml b/tests/endpoint/first_time_seen_cmd_line___ssa.test.yml index 976d077cd5..c0ee55b470 100644 --- a/tests/endpoint/first_time_seen_cmd_line___ssa.test.yml +++ b/tests/endpoint/first_time_seen_cmd_line___ssa.test.yml @@ -1,9 +1,9 @@ name: First time seen command line argument - SSA Unit Test -detections: +tests: - name: First time seen command line argument file: endpoint/first_time_seen_cmd_line___ssa.yml pass_condition: '' -description: Test detection of first time seen command -attack_data: - - file_name: first_time_seen_commandline.json - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/first_time_seen_commandline.json + description: Test detection of first time seen command + attack_data: + - file_name: first_time_seen_commandline.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/first_time_seen_commandline.json diff --git a/tests/endpoint/prohibited_apps_spawning_cmdprompt___ssa.test.yml b/tests/endpoint/prohibited_apps_spawning_cmdprompt___ssa.test.yml index c82cb62f4a..18d72ca7dd 100644 --- a/tests/endpoint/prohibited_apps_spawning_cmdprompt___ssa.test.yml +++ b/tests/endpoint/prohibited_apps_spawning_cmdprompt___ssa.test.yml @@ -1,9 +1,9 @@ name: Detect Prohibited Applications Spawning cmd exe - SSA -detections: +tests: - name: Detect Prohibited Applications Spawning cmd exe file: endpoint/prohibited_apps_spawning_cmdprompt___ssa.yml pass_condition: '' -description: Test prohibited apps spawning cmd.exe -attack_data: - - file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json + description: Test prohibited apps spawning cmd.exe + attack_data: + - file_name: unit_test_detect_prohibited_applications_spawning_cmd_exe.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unit_test_detect_prohibited_applications_spawning_cmd_exe.json diff --git a/tests/endpoint/rare_parent_process_relationship_lolbas___ssa.test.yaml b/tests/endpoint/rare_parent_process_relationship_lolbas___ssa.test.yaml index e54a5f73e7..cf59936dd9 100644 --- a/tests/endpoint/rare_parent_process_relationship_lolbas___ssa.test.yaml +++ b/tests/endpoint/rare_parent_process_relationship_lolbas___ssa.test.yaml @@ -1,10 +1,10 @@ name: Rare Parent/Child Process Relationship - SSA Unit Test -detections: +tests: - name: Access LSASS Memory for Dump Creation file: endpoint/rare_parent_process_relationship_lolbas___ssa.yaml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test detection looking for LOLBAS processes spawned by other processes that are rarely seen together -attack_data: - - file_name: T1059.all.labeled.lolbas-test.json - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/T1059.all.labeled.lolbas-test.json + description: Test detection looking for LOLBAS processes spawned by other processes that are rarely seen together + attack_data: + - file_name: T1059.all.labeled.lolbas-test.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/T1059.all.labeled.lolbas-test.json diff --git a/tests/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.test.yml index 006246e07c..10d08ba298 100644 --- a/tests/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.test.yml +++ b/tests/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.test.yml @@ -1,10 +1,10 @@ name: Applying Stolen Credentials via Mimikatz modules - SSA Unit test -detections: +tests: - name: Applying Stolen Credentials via Mimikatz modules file: endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test applying stolen credentials detections -attack_data: - - file_name: logAllMimikatzModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log + description: Test applying stolen credentials detections + attack_data: + - file_name: logAllMimikatzModules.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log diff --git a/tests/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.test.yml b/tests/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.test.yml index 7d1b68b06c..145b995d20 100644 --- a/tests/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.test.yml +++ b/tests/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.test.yml @@ -1,10 +1,10 @@ name: Applying Stolen Credentials via PowerSploit modules - SSA Unit test -detections: +tests: - name: Applying Stolen Credentials via PowerSploit file: endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test applying stolen credentials detections -attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log + description: Test applying stolen credentials detections + attack_data: + - file_name: logAllPowerSploitModulesWithOldNames.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log diff --git a/tests/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.test.yml b/tests/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.test.yml index c82aecccd4..a13e9f6f69 100644 --- a/tests/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.test.yml +++ b/tests/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.test.yml @@ -1,10 +1,10 @@ name: Assessment of Credential Strength via DSInternals modules - SSA Unit test -detections: +tests: - name: Assessment of Credential Strength via DSInternals modules file: endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test assessment of credential strength detections -attack_data: - - file_name: logAllDSInternalsModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log + description: Test assessment of credential strength detections + attack_data: + - file_name: logAllDSInternalsModules.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log diff --git a/tests/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.test.yml b/tests/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.test.yml index a7050d568b..1c19ccc28d 100644 --- a/tests/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.test.yml +++ b/tests/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.test.yml @@ -1,10 +1,10 @@ name: Credential Extraction indicative of use of DSInternals credential conversion modules - SSA Unit test -detections: +tests: - name: Credential Extraction indicative of use of DSInternals credential conversion modules file: endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test credential extraction detections -attack_data: - - file_name: logAllDSInternalsModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log + description: Test credential extraction detections + attack_data: + - file_name: logAllDSInternalsModules.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log diff --git a/tests/endpoint/ssa___credential_extraction_dsinternals_modules.test.yml b/tests/endpoint/ssa___credential_extraction_dsinternals_modules.test.yml index 01bb493895..8650f65a1c 100644 --- a/tests/endpoint/ssa___credential_extraction_dsinternals_modules.test.yml +++ b/tests/endpoint/ssa___credential_extraction_dsinternals_modules.test.yml @@ -1,10 +1,10 @@ name: Credential Extraction indicative of use of DSInternals modules - SSA Unit test -detections: +tests: - name: Credential Extraction indicative of use of DSInternals modules file: endpoint/ssa___credential_extraction_dsinternals_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test credential extraction detections -attack_data: - - file_name: logAllDSInternalsModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log + description: Test credential extraction detections + attack_data: + - file_name: logAllDSInternalsModules.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log diff --git a/tests/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.test.yml b/tests/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.test.yml index 59560bf164..21a63479f1 100644 --- a/tests/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.test.yml +++ b/tests/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.test.yml @@ -1,10 +1,10 @@ name: Credential Extraction indicative of FGDump and CacheDump with s option - SSA Unit test -detections: +tests: - name: Credential Extraction indicative of FGDump and CacheDump with s option file: endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test credential extraction detections -attack_data: - - file_name: logFgdump.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logFgdump.log + description: Test credential extraction detections + attack_data: + - file_name: logFgdump.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logFgdump.log diff --git a/tests/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.test.yml b/tests/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.test.yml index 72fd50f2b7..819b4cfe25 100644 --- a/tests/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.test.yml +++ b/tests/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.test.yml @@ -1,10 +1,9 @@ name: Credential Extraction indicative of FGDump and CacheDump with v option - SSA Unit test -detections: +tests: - name: Credential Extraction indicative of FGDump and CacheDump with v option file: endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test credential extraction detections -attack_data: - - file_name: logFgdump.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logFgdump.log - + description: Test credential extraction detections + attack_data: + - file_name: logFgdump.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logFgdump.log diff --git a/tests/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.test.yml b/tests/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.test.yml index 0d81c03c02..2886573dc1 100644 --- a/tests/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.test.yml +++ b/tests/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.test.yml @@ -1,10 +1,10 @@ name: Credential Extraction via Get-ADDBAccount module present in PowerSploit and DSInternals - SSA Unit test -detections: +tests: - name: Credential Extraction via Get-ADDBAccount module present in PowerSploit and DSInternals file: endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test credential extraction detections -attack_data: - - file_name: logPowerShellModule.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logPowerShellModule.log + description: Test credential extraction detections + attack_data: + - file_name: logPowerShellModule.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logPowerShellModule.log diff --git a/tests/endpoint/ssa___credential_extraction_lazagne_command_options.test.yml b/tests/endpoint/ssa___credential_extraction_lazagne_command_options.test.yml index bcea6b3364..ff0dfd6aff 100644 --- a/tests/endpoint/ssa___credential_extraction_lazagne_command_options.test.yml +++ b/tests/endpoint/ssa___credential_extraction_lazagne_command_options.test.yml @@ -1,10 +1,10 @@ name: Credential Extraction indicative of Lazagne command line options - SSA Unit test -detections: +tests: - name: Credential Extraction indicative of Lazagne command line options file: endpoint/ssa___credential_extraction_lazagne_command_options.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test credential extraction detections -attack_data: - - file_name: logLazagneCredDump.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logLazagneCredDump.log + description: Test credential extraction detections + attack_data: + - file_name: logLazagneCredDump.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logLazagneCredDump.log diff --git a/tests/endpoint/ssa___credential_extraction_mimikatz_modules.test.yml b/tests/endpoint/ssa___credential_extraction_mimikatz_modules.test.yml index 34fa9b0381..4250ef9daf 100644 --- a/tests/endpoint/ssa___credential_extraction_mimikatz_modules.test.yml +++ b/tests/endpoint/ssa___credential_extraction_mimikatz_modules.test.yml @@ -1,10 +1,10 @@ name: Credential Extraction indicative of use of Mimikatz modules - SSA Unit test -detections: +tests: - name: Credential Extraction indicative of use of Mimikatz modules file: endpoint/ssa___credential_extraction_mimikatz_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test credential extraction detections -attack_data: - - file_name: logAllMimikatzModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log + description: Test credential extraction detections + attack_data: + - file_name: logAllMimikatzModules.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log diff --git a/tests/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.test.yml b/tests/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.test.yml index 14f1c8fe2f..030b360277 100644 --- a/tests/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.test.yml +++ b/tests/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.test.yml @@ -1,10 +1,10 @@ name: Credential Extraction native Microsoft debuggers peek into the kernel - SSA Unit test -detections: +tests: - name: Credential Extraction native Microsoft debuggers peek into the kernel file: endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test credential extraction detections -attack_data: - - file_name: logLiveKDFullKernelDump.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logLiveKDFullKernelDump.log + description: Test credential extraction detections + attack_data: + - file_name: logLiveKDFullKernelDump.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logLiveKDFullKernelDump.log diff --git a/tests/endpoint/ssa___credential_extraction_ms_debuggers_z_option.test.yml b/tests/endpoint/ssa___credential_extraction_ms_debuggers_z_option.test.yml index ab84df9f5c..144afb955b 100644 --- a/tests/endpoint/ssa___credential_extraction_ms_debuggers_z_option.test.yml +++ b/tests/endpoint/ssa___credential_extraction_ms_debuggers_z_option.test.yml @@ -1,10 +1,10 @@ name: Credential Extraction native Microsoft debuggers via z command line option - SSA Unit test -detections: +tests: - name: Credential Extraction native Microsoft debuggers via z command line option file: endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test credential extraction detections -attack_data: - - file_name: logLiveKDFullKernelDump.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logLiveKDFullKernelDump.log + description: Test credential extraction detections + attack_data: + - file_name: logLiveKDFullKernelDump.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logLiveKDFullKernelDump.log diff --git a/tests/endpoint/ssa___credential_extraction_powersploit_modules.test.yml b/tests/endpoint/ssa___credential_extraction_powersploit_modules.test.yml index 577ffbb8b1..a7432a0af3 100644 --- a/tests/endpoint/ssa___credential_extraction_powersploit_modules.test.yml +++ b/tests/endpoint/ssa___credential_extraction_powersploit_modules.test.yml @@ -1,10 +1,10 @@ name: Credential Extraction indicative of use of PowerSploit modules - SSA Unit test -detections: +tests: - name: Credential Extraction indicative of use of PowerSploit modules file: endpoint/ssa___credential_extraction_powersploit_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test credential extraction detections -attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log + description: Test credential extraction detections + attack_data: + - file_name: logAllPowerSploitModulesWithOldNames.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log diff --git a/tests/endpoint/ssa___detect_kerberoasting.test.yml b/tests/endpoint/ssa___detect_kerberoasting.test.yml index 2d4307a420..31a36f76ae 100644 --- a/tests/endpoint/ssa___detect_kerberoasting.test.yml +++ b/tests/endpoint/ssa___detect_kerberoasting.test.yml @@ -1,10 +1,10 @@ name: Detect Kerberoasting - SSA Unit test -detections: +tests: - name: Detect kerberoasting file: endpoint/ssa___detect_kerberoasting.yml pass_condition: '' -description: Test detection of kerberoasting -attack_data: - - file_name: T1558.003.json - data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1558.003/T1558.003.json + description: Test detection of kerberoasting + attack_data: + - file_name: T1558.003.json + data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1558.003/T1558.003.json diff --git a/tests/endpoint/ssa___detect_pass_hash.test.yml b/tests/endpoint/ssa___detect_pass_hash.test.yml index a1c0d73384..17c64367d5 100644 --- a/tests/endpoint/ssa___detect_pass_hash.test.yml +++ b/tests/endpoint/ssa___detect_pass_hash.test.yml @@ -1,10 +1,10 @@ name: Detect Pass the Hash - SSA Unit test -detections: +tests: - name: Detect Pass the Hash file: endpoint/ssa___detect_pass_hash.yml pass_condition: '' -description: Test detection of pass-the-hash -attack_data: - - file_name: T1550.002.json - data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1550.002/T1550.002.json + description: Test detection of pass-the-hash + attack_data: + - file_name: T1550.002.json + data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1550.002/T1550.002.json diff --git a/tests/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.test.yml b/tests/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.test.yml index cd783a248d..6d8f893d55 100644 --- a/tests/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.test.yml +++ b/tests/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.test.yml @@ -1,10 +1,10 @@ name: Illegal Access To User Content via PowerSploit modules - SSA Unit test -detections: +tests: - name: Illegal Access To User Content via PowerSploit modules file: endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test illegal access to user content detections -attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log + description: Test illegal access to user content detections + attack_data: + - file_name: logAllPowerSploitModulesWithOldNames.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log diff --git a/tests/endpoint/ssa___illegal_account_creation_via_powersploit_modules.test.yml b/tests/endpoint/ssa___illegal_account_creation_via_powersploit_modules.test.yml index 7417bcfd92..a524228fc2 100644 --- a/tests/endpoint/ssa___illegal_account_creation_via_powersploit_modules.test.yml +++ b/tests/endpoint/ssa___illegal_account_creation_via_powersploit_modules.test.yml @@ -1,10 +1,10 @@ name: Illegal Account Creation via PowerSploit modules - SSA Unit test -detections: +tests: - name: Illegal Account Creation via PowerSploit modules file: endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test illegal account creation detections -attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log + description: Test illegal account creation detections + attack_data: + - file_name: logAllPowerSploitModulesWithOldNames.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log diff --git a/tests/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.test.yml b/tests/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.test.yml index ba847d7564..b9660fe617 100644 --- a/tests/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.test.yml +++ b/tests/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.test.yml @@ -1,10 +1,10 @@ name: Illegal Enabling or Disabling of Accounts via DSInternals modules - SSA Unit test -detections: +tests: - name: Illegal Enabling or Disabling of Accounts via DSInternals modules file: endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test enabling or disabling of accounts detections -attack_data: - - file_name: logAllDSInternalsModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log + description: Test enabling or disabling of accounts detections + attack_data: + - file_name: logAllDSInternalsModules.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log diff --git a/tests/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.test.yml index 9e0051967d..977a07b3be 100644 --- a/tests/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.test.yml +++ b/tests/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.test.yml @@ -1,10 +1,10 @@ name: Illegal Deletion of Logs via Mimikatz modules - SSA Unit test -detections: +tests: - name: Illegal Deletion of Logs via Mimikatz modules file: endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test illegal log deletion detections -attack_data: - - file_name: logAllMimikatzModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log + description: Test illegal log deletion detections + attack_data: + - file_name: logAllMimikatzModules.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log diff --git a/tests/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.test.yml b/tests/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.test.yml index d207c906d0..2e2c438476 100644 --- a/tests/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.test.yml +++ b/tests/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.test.yml @@ -1,9 +1,9 @@ name: Illegal Management of Active Directory Elements and Policies via DSInternals modules - SSA Unit test -detections: +tests: - name: Illegal Management of Active Directory Elements and Policies via DSInternals modules file: endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test illegal management of Active Directory elements and policies detections -attack_data: - - file_name: logAllDSInternalsModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log + description: Test illegal management of Active Directory elements and policies detections + attack_data: + - file_name: logAllDSInternalsModules.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log diff --git a/tests/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.test.yml b/tests/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.test.yml index 3ad6fc6502..c80c51abce 100644 --- a/tests/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.test.yml +++ b/tests/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.test.yml @@ -1,10 +1,10 @@ name: Illegal Management of Computers and Active Directory Elements via PowerSploit modules - SSA Unit test -detections: +tests: - name: Illegal Management of Computers and Active Directory Elements via PowerSploit modules file: endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test illegal management of computers and Active Directory elements detections -attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log + description: Test illegal management of computers and Active Directory elements detections + attack_data: + - file_name: logAllPowerSploitModulesWithOldNames.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log diff --git a/tests/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.test.yml b/tests/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.test.yml index ab8de9d7e6..1000cead13 100644 --- a/tests/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.test.yml +++ b/tests/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.test.yml @@ -1,10 +1,10 @@ name: Illegal Privilege Elevation and Persistence via PowerSploit modules - SSA Unit test -detections: +tests: - name: Illegal Privilege Elevation and Persistence via PowerSploit modules file: endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test privilege elevation and persistence detections -attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log + description: Test privilege elevation and persistence detections + attack_data: + - file_name: logAllPowerSploitModulesWithOldNames.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log diff --git a/tests/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.test.yml index 1ec737e81b..ba50aeb233 100644 --- a/tests/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.test.yml +++ b/tests/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.test.yml @@ -1,10 +1,10 @@ name: Illegal Privilege Elevation via Mimikatz modules - SSA Unit test -detections: +tests: - name: Illegal Privilege Elevation via Mimikatz modules file: endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test illegal privilege elevation detections -attack_data: - - file_name: logAllMimikatzModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log + description: Test illegal privilege elevation detections + attack_data: + - file_name: logAllMimikatzModules.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log diff --git a/tests/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.test.yml index c435d9e1f6..f2b7d2c637 100644 --- a/tests/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.test.yml +++ b/tests/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.test.yml @@ -1,10 +1,10 @@ name: Illegal Service and Process Control via Mimikatz modules - SSA Unit test -detections: +tests: - name: Illegal Service and Process Control via Mimikatz modules file: endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test illegal service and process control detections -attack_data: - - file_name: logAllMimikatzModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log + description: Test illegal service and process control detections + attack_data: + - file_name: logAllMimikatzModules.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log diff --git a/tests/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.test.yml b/tests/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.test.yml index 406eca8cea..1ff8813160 100644 --- a/tests/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.test.yml +++ b/tests/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.test.yml @@ -1,10 +1,10 @@ name: Illegal Service and Process Control via PowerSploit modules - SSA Unit test -detections: +tests: - name: Illegal Service and Process Control via PowerSploit modules file: endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test illegal service and process control detections -attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log + description: Test illegal service and process control detections + attack_data: + - file_name: logAllPowerSploitModulesWithOldNames.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log diff --git a/tests/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.test.yml b/tests/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.test.yml index 19a4c6e68f..a436fe411c 100644 --- a/tests/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.test.yml +++ b/tests/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.test.yml @@ -1,10 +1,10 @@ name: Probing Access with Stolen Credentials via PowerSploit modules - SSA Unit test -detections: +tests: - name: Probing Access with Stolen Credentials via PowerSploit modules file: endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test access probing with stolen credentials detections -attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log + description: Test access probing with stolen credentials detections + attack_data: + - file_name: logAllPowerSploitModulesWithOldNames.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log diff --git a/tests/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.test.yml b/tests/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.test.yml index 99cd649e6e..e44349fa95 100644 --- a/tests/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.test.yml +++ b/tests/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.test.yml @@ -1,10 +1,10 @@ name: Reconnaissance of Access and Persistence Opportunities via PowerSploit modules - SSA Unit test -detections: +tests: - name: Reconnaissance of Access and Persistence Opportunities via PowerSploit modules file: endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test reconnaissance of access and persistence detections -attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log + description: Test reconnaissance of access and persistence detections + attack_data: + - file_name: logAllPowerSploitModulesWithOldNames.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log diff --git a/tests/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.test.yml b/tests/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.test.yml index 6791b8243f..88cda1c183 100644 --- a/tests/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.test.yml +++ b/tests/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.test.yml @@ -1,10 +1,10 @@ name: Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules - SSA Unit test -detections: +tests: - name: Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules file: endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test reconnaissance and access to accounts groups and policies detections -attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log + description: Test reconnaissance and access to accounts groups and policies detections + attack_data: + - file_name: logAllPowerSploitModulesWithOldNames.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log diff --git a/tests/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.test.yml index ad6fcaaf8d..c7f58f7422 100644 --- a/tests/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.test.yml +++ b/tests/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.test.yml @@ -1,10 +1,10 @@ name: Reconnaissance and Access to Accounts and Groups via Mimikatz modules - SSA Unit test -detections: +tests: - name: Reconnaissance and Access to Accounts and Groups via Mimikatz modules file: endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test reconnaissance and access to accounts and groups detections -attack_data: - - file_name: logAllMimikatzModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log + description: Test reconnaissance and access to accounts and groups detections + attack_data: + - file_name: logAllMimikatzModules.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log diff --git a/tests/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.test.yml b/tests/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.test.yml index 03975c28d4..b002020a8f 100644 --- a/tests/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.test.yml +++ b/tests/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.test.yml @@ -1,10 +1,10 @@ name: Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit modules - SSA Unit test -detections: +tests: - name: Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit modules file: endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test reconnaissance and access to active directory infrastrucutre detections -attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log + description: Test reconnaissance and access to active directory infrastrucutre detections + attack_data: + - file_name: logAllPowerSploitModulesWithOldNames.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log diff --git a/tests/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.test.yml b/tests/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.test.yml index 51af66084a..836ada270b 100644 --- a/tests/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.test.yml +++ b/tests/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.test.yml @@ -1,10 +1,10 @@ name: Reconnaissance and Access to Computers and Domains via PowerSploit modules - SSA Unit test -detections: +tests: - name: Reconnaissance and Access to Computers and Domains via PowerSploit modules file: endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test reconnaissance and access to computers and domains detections -attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log + description: Test reconnaissance and access to computers and domains detections + attack_data: + - file_name: logAllPowerSploitModulesWithOldNames.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log diff --git a/tests/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.test.yml index f28495b1e4..baddf2aae8 100644 --- a/tests/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.test.yml +++ b/tests/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.test.yml @@ -1,10 +1,10 @@ name: Reconnaissance and Access to Computers via Mimikatz modules - SSA Unit test -detections: +tests: - name: Reconnaissance and Access to Computers via Mimikatz modules file: endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test reconnaissance and access to computers detections -attack_data: - - file_name: logAllMimikatzModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log + description: Test reconnaissance and access to computers detections + attack_data: + - file_name: logAllMimikatzModules.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log diff --git a/tests/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.test.yml b/tests/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.test.yml index 9597bf7e4d..386f068944 100644 --- a/tests/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.test.yml +++ b/tests/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.test.yml @@ -1,10 +1,10 @@ name: Reconnaissance and Access to Operating System Elements via PowerSploit modules - SSA Unit test -detections: +tests: - name: Reconnaissance and Access to Operating System Elements via PowerSploit modules file: endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test reconnaissance and access to operating system element detections -attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log + description: Test reconnaissance and access to operating system element detections + attack_data: + - file_name: logAllPowerSploitModulesWithOldNames.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log diff --git a/tests/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.test.yml index 61903f9460..5404874bf1 100644 --- a/tests/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.test.yml +++ b/tests/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.test.yml @@ -1,10 +1,10 @@ name: Reconnaissance and Access to Shared Resources via Mimikatz modules - SSA Unit test -detections: +tests: - name: Reconnaissance and Access to Shared Resources via Mimikatz modules file: endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test reconnaissance and access to network shares detections -attack_data: - - file_name: logAllMimikatzModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log + description: Test reconnaissance and access to network shares detections + attack_data: + - file_name: logAllMimikatzModules.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log diff --git a/tests/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.test.yml b/tests/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.test.yml index 846540550e..91ed913cf0 100644 --- a/tests/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.test.yml +++ b/tests/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.test.yml @@ -1,10 +1,10 @@ name: Reconnaissance and Access to Shared Resources via PowerSploit modules - SSA Unit test -detections: +tests: - name: Reconnaissance and Access to Shared Resources via PowerSploit modules file: endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test reconnaissance and access to shares detections -attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log + description: Test reconnaissance and access to shares detections + attack_data: + - file_name: logAllPowerSploitModulesWithOldNames.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log diff --git a/tests/endpoint/ssa___recon_connectivity_via_powersploit_modules.test.yml b/tests/endpoint/ssa___recon_connectivity_via_powersploit_modules.test.yml index c7b710d2a4..66bb612917 100644 --- a/tests/endpoint/ssa___recon_connectivity_via_powersploit_modules.test.yml +++ b/tests/endpoint/ssa___recon_connectivity_via_powersploit_modules.test.yml @@ -1,10 +1,10 @@ name: Reconnaissance of Connectivity via PowerSploit modules - SSA Unit test -detections: +tests: - name: Reconnaissance of Connectivity via PowerSploit modules file: endpoint/ssa___recon_connectivity_via_powersploit_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test reconnaissance of connectivity detections -attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log + description: Test reconnaissance of connectivity detections + attack_data: + - file_name: logAllPowerSploitModulesWithOldNames.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log diff --git a/tests/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.test.yml index aead7cb4a7..26efa97215 100644 --- a/tests/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.test.yml +++ b/tests/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.test.yml @@ -1,10 +1,10 @@ name: Reconnaissance of Credential Stores and Services via Mimikatz modules - SSA Unit test -detections: +tests: - name: Reconnaissance of Credential Stores and Services via Mimikatz modules file: endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test reconnaissance of credential stores and services detections -attack_data: - - file_name: logAllMimikatzModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log + description: Test reconnaissance of credential stores and services detections + attack_data: + - file_name: logAllMimikatzModules.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log diff --git a/tests/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.test.yml b/tests/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.test.yml index 79736a1d90..8a56e22e2e 100644 --- a/tests/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.test.yml +++ b/tests/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.test.yml @@ -1,10 +1,10 @@ name: Reconnaissance of Defensive Tools via PowerSploit modules - SSA Unit test -detections: +tests: - name: Reconnaissance of Defensive Tools via PowerSploit modules file: endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test reconnaissance of presence of defensive tools detections -attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log + description: Test reconnaissance of presence of defensive tools detections + attack_data: + - file_name: logAllPowerSploitModulesWithOldNames.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log diff --git a/tests/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.test.yml b/tests/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.test.yml index e7f1dd088a..2e4fffa9fa 100644 --- a/tests/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.test.yml +++ b/tests/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.test.yml @@ -1,10 +1,10 @@ name: Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules - SSA Unit test -detections: +tests: - name: Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules file: endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test reconnaissance of privilege escalations opportunities detections -attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log + description: Test reconnaissance of privilege escalations opportunities detections + attack_data: + - file_name: logAllPowerSploitModulesWithOldNames.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log diff --git a/tests/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.test.yml index 82c7581149..7c868ab0d3 100644 --- a/tests/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.test.yml +++ b/tests/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.test.yml @@ -1,10 +1,10 @@ name: Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules - SSA Unit test -detections: +tests: - name: Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules file: endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test reconnaissance of process or service hijacking detections -attack_data: - - file_name: logAllMimikatzModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log + description: Test reconnaissance of process or service hijacking detections + attack_data: + - file_name: logAllMimikatzModules.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log diff --git a/tests/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.test.yml index 5c3a876003..55dc641927 100644 --- a/tests/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.test.yml +++ b/tests/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.test.yml @@ -1,10 +1,10 @@ name: Reconnaissance and Access to Processes and Services via Mimikatz modules - SSA Unit test -detections: +tests: - name: Reconnaissance and Access to Processes and Services via Mimikatz modules file: endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test reconnaissance of processes and services detections -attack_data: - - file_name: logAllMimikatzModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log + description: Test reconnaissance of processes and services detections + attack_data: + - file_name: logAllMimikatzModules.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log diff --git a/tests/endpoint/ssa___setting_credentials_via_dsinternals_modules.test.yml b/tests/endpoint/ssa___setting_credentials_via_dsinternals_modules.test.yml index 79eb142c4b..7723e35002 100644 --- a/tests/endpoint/ssa___setting_credentials_via_dsinternals_modules.test.yml +++ b/tests/endpoint/ssa___setting_credentials_via_dsinternals_modules.test.yml @@ -1,10 +1,10 @@ name: Setting Credentials via DSInternals modules - SSA Unit test -detections: +tests: - name: Setting Credentials via DSInternals modules file: endpoint/ssa___setting_credentials_via_dsinternals_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test illegal credential setting detections -attack_data: - - file_name: logAllDSInternalsModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log + description: Test illegal credential setting detections + attack_data: + - file_name: logAllDSInternalsModules.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log diff --git a/tests/endpoint/ssa___setting_credentials_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___setting_credentials_via_mimikatz_modules.test.yml index 68e7006d00..ad59b88b93 100644 --- a/tests/endpoint/ssa___setting_credentials_via_mimikatz_modules.test.yml +++ b/tests/endpoint/ssa___setting_credentials_via_mimikatz_modules.test.yml @@ -1,10 +1,10 @@ name: Setting Credentials via Mimikatz modules - SSA Unit test -detections: +tests: - name: Setting Credentials via Mimikatz modules file: endpoint/ssa___setting_credentials_via_mimikatz_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test illegal credential setting detections -attack_data: - - file_name: logAllMimikatzModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log + description: Test illegal credential setting detections + attack_data: + - file_name: logAllMimikatzModules.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log diff --git a/tests/endpoint/ssa___setting_credentials_via_powersploit_modules.test.yml b/tests/endpoint/ssa___setting_credentials_via_powersploit_modules.test.yml index bdbe72c3fa..f4940af6df 100644 --- a/tests/endpoint/ssa___setting_credentials_via_powersploit_modules.test.yml +++ b/tests/endpoint/ssa___setting_credentials_via_powersploit_modules.test.yml @@ -1,10 +1,10 @@ name: Setting Credentials via PowerSploit modules - SSA Unit test -detections: +tests: - name: Setting Credentials via PowerSploit modules file: endpoint/ssa___setting_credentials_via_powersploit_modules.yml pass_condition: '| stats count(body) as count_events by body, span(start_time, 7d) | where count_events > 0' -description: Test illegal credential setting detections -attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log + description: Test illegal credential setting detections + attack_data: + - file_name: logAllPowerSploitModulesWithOldNames.log + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log diff --git a/tests/endpoint/system_process_running_unexpected_location___ssa.test.yml b/tests/endpoint/system_process_running_unexpected_location___ssa.test.yml index 1a0aca7a6e..e8c0677fa7 100644 --- a/tests/endpoint/system_process_running_unexpected_location___ssa.test.yml +++ b/tests/endpoint/system_process_running_unexpected_location___ssa.test.yml @@ -1,9 +1,9 @@ name: System Process Running from Unexpected Location - SSA Unit Test -detections: +tests: - name: System Process Running from Unexpected Location - SSA file: endpoint/system_process_running_unexpected_location___ssa.yml pass_condition: '' -description: Test process running from other locations -attack_data: - - file_name: unusual-location-test.json - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unusual-location-test.json + description: Test process running from other locations + attack_data: + - file_name: unusual-location-test.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unusual-location-test.json diff --git a/tests/endpoint/unusual_lolbas_in_short_period_of_time___ssa.test.yml b/tests/endpoint/unusual_lolbas_in_short_period_of_time___ssa.test.yml index 47fe0e7c06..b940922261 100644 --- a/tests/endpoint/unusual_lolbas_in_short_period_of_time___ssa.test.yml +++ b/tests/endpoint/unusual_lolbas_in_short_period_of_time___ssa.test.yml @@ -1,9 +1,9 @@ name: More than usual number of LOLBAS applications in short time period - SSA Unit Test -detections: +tests: - name: More than usual number of LOLBAS applications in short time period file: endpoint/unusual_lolbas_in_short_period_of_time___ssa.yml pass_condition: '' -description: Test more than usual lolbas being executed in a short period of time -attack_data: - - file_name: T1059.all.labeled.lolbas-test.json - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/T1059.all.labeled.lolbas-test.json + description: Test more than usual lolbas being executed in a short period of time + attack_data: + - file_name: T1059.all.labeled.lolbas-test.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/T1059.all.labeled.lolbas-test.json diff --git a/tests/endpoint/unusually_long_command_line___ssa.test.yml b/tests/endpoint/unusually_long_command_line___ssa.test.yml index 6a4ed98811..05140288bd 100644 --- a/tests/endpoint/unusually_long_command_line___ssa.test.yml +++ b/tests/endpoint/unusually_long_command_line___ssa.test.yml @@ -1,10 +1,10 @@ name: Unusually Long Command Line - SSA Unit Test -detections: +tests: - name: Unusually Long Command Line file: endpoint/unusually_long_command_line___ssa.yml pass_condition: '' -description: Test unusually long command lines -attack_data: - - file_name: unusual_commandline.json - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unusual_commandline.json + description: Test unusually long command lines + attack_data: + - file_name: unusual_commandline.json + data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unusual_commandline.json