From 962925bbeac9e499722936c916e0bc630318d526 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 8 Mar 2021 16:27:06 -0700 Subject: [PATCH 1/2] Create detect_mshta_renamed.test.yml --- tests/endpoint/detect_mshta_renamed.test.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 tests/endpoint/detect_mshta_renamed.test.yml diff --git a/tests/endpoint/detect_mshta_renamed.test.yml b/tests/endpoint/detect_mshta_renamed.test.yml new file mode 100644 index 0000000000..6fb5022a26 --- /dev/null +++ b/tests/endpoint/detect_mshta_renamed.test.yml @@ -0,0 +1,12 @@ +name: Detect mshta Rename line test +tests: +- name: Detect mshta Rename + file: endpoint/detect_mshta_renamed.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 060dd6c883918cfcb2ffc1057f82cd4977beb3b4 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 8 Mar 2021 23:47:23 +0000 Subject: [PATCH 2/2] Added detection testing service results inDetect mshta Rename --- detections/endpoint/detect_mshta_renamed.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml index eb067a7225..1138be6148 100644 --- a/detections/endpoint/detect_mshta_renamed.yml +++ b/detections/endpoint/detect_mshta_renamed.yml @@ -31,7 +31,7 @@ tags: cis20: - CIS 8 dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -44,3 +44,4 @@ tags: - Splunk Enterprise Security - Splunk Cloud security_domain: endpoint + automated_detection_testing: passed