mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
remove conflicts
This commit is contained in:
@@ -1,12 +0,0 @@
|
||||
name: Detect AutoSUID post exploitation tool Unit Test
|
||||
tests:
|
||||
- name: Detect AutoSUID post exploitation tool
|
||||
file: endpoint/detect_autosuid_post_exploitation_tool.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: autoSUID.txt
|
||||
data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt
|
||||
source: "Syslog:Linux-Sysmon/Operational"
|
||||
sourcetype: "sysmon_linux"
|
||||
@@ -1,12 +0,0 @@
|
||||
name: Detect LinEnum execution unit Test
|
||||
tests:
|
||||
- name: Detect LinEnum execution
|
||||
file: endpoint/detect_linenum_execution.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: LinuxEnumd.txt
|
||||
data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt
|
||||
source: "Syslog:Linux-Sysmon/Operational"
|
||||
sourcetype: "sysmon_linux"
|
||||
@@ -1,12 +0,0 @@
|
||||
name: Detect LinPeas Execution Unit Test
|
||||
tests:
|
||||
- name: Detect LinPeas Execution
|
||||
file: endpoint/detect_linpeas_execution.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: linpeasdataset.txt
|
||||
data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linpeasdataset.txt
|
||||
source: "Syslog:Linux-Sysmon/Operational"
|
||||
sourcetype: "sysmon_linux"
|
||||
@@ -1,12 +0,0 @@
|
||||
name: Detect Linux Exploit Suggester Execution Unit Test
|
||||
tests:
|
||||
- name: Detect Linux Exploit Suggester Execution
|
||||
file: endpoint/detect_linux_exploit_suggester_execution.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: linuxexploitsuggesterdatasets.txt
|
||||
data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linuxexploitsuggesterdatasets.txt
|
||||
source: "Syslog:Linux-Sysmon/Operational"
|
||||
sourcetype: "sysmon_linux"
|
||||
@@ -1,12 +0,0 @@
|
||||
name: Detect MimiPenguin Unit Test
|
||||
tests:
|
||||
- name: Detect MimiPenguin
|
||||
file: endpoint/detect_mimipenguin.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: mimipenguin.txt
|
||||
data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/mimipenguin.txt
|
||||
source: "Syslog:Linux-Sysmon/Operational"
|
||||
sourcetype: "sysmon_linux"
|
||||
Reference in New Issue
Block a user