admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
github-actions[bot]
2021-03-09 00:24:21 +00:00
committed by GitHub
parent d4887651bf 82b24ad2fb
commit 5d4d6bf9b4
2 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/detect_mshta_renamed.yml
+2 -1
View File
@@ -31,7 +31,7 @@ tags:
cis20:
- CIS 8
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -44,3 +44,4 @@ tags:
- Splunk Enterprise Security
- Splunk Cloud
security_domain: endpoint
automated_detection_testing: passed
tests/endpoint/detect_mshta_renamed.test.yml
+12
View File
@@ -0,0 +1,12 @@
name: Detect mshta Rename line test
tests:
- name: Detect mshta Rename
file: endpoint/detect_mshta_renamed.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-24h'
latest_time: 'now'
attack_data:
- file_name: windows-sysmon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog