remove conflicts

This commit is contained in:
patel-bhavin
2022-01-26 14:29:41 -08:00
5 changed files with 0 additions and 60 deletions
@@ -1,12 +0,0 @@
name: Detect AutoSUID post exploitation tool Unit Test
tests:
- name: Detect AutoSUID post exploitation tool
file: endpoint/detect_autosuid_post_exploitation_tool.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-24h'
latest_time: 'now'
attack_data:
- file_name: autoSUID.txt
data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/autoSUID.txt
source: "Syslog:Linux-Sysmon/Operational"
sourcetype: "sysmon_linux"
@@ -1,12 +0,0 @@
name: Detect LinEnum execution unit Test
tests:
- name: Detect LinEnum execution
file: endpoint/detect_linenum_execution.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-24h'
latest_time: 'now'
attack_data:
- file_name: LinuxEnumd.txt
data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/LinuxEnumd.txt
source: "Syslog:Linux-Sysmon/Operational"
sourcetype: "sysmon_linux"
@@ -1,12 +0,0 @@
name: Detect LinPeas Execution Unit Test
tests:
- name: Detect LinPeas Execution
file: endpoint/detect_linpeas_execution.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-24h'
latest_time: 'now'
attack_data:
- file_name: linpeasdataset.txt
data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linpeasdataset.txt
source: "Syslog:Linux-Sysmon/Operational"
sourcetype: "sysmon_linux"
@@ -1,12 +0,0 @@
name: Detect Linux Exploit Suggester Execution Unit Test
tests:
- name: Detect Linux Exploit Suggester Execution
file: endpoint/detect_linux_exploit_suggester_execution.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-24h'
latest_time: 'now'
attack_data:
- file_name: linuxexploitsuggesterdatasets.txt
data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/linuxexploitsuggesterdatasets.txt
source: "Syslog:Linux-Sysmon/Operational"
sourcetype: "sysmon_linux"
@@ -1,12 +0,0 @@
name: Detect MimiPenguin Unit Test
tests:
- name: Detect MimiPenguin
file: endpoint/detect_mimipenguin.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-24h'
latest_time: 'now'
attack_data:
- file_name: mimipenguin.txt
data: https://github.com/splunk/attack_data/raw/master/datasets/suspicious_behaviour/linux_post_exploitation/mimipenguin.txt
source: "Syslog:Linux-Sysmon/Operational"
sourcetype: "sysmon_linux"