From 623c8fee33cf352f318e7a06b7dc7e4b355feea6 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 3 Feb 2021 17:03:19 +0100 Subject: [PATCH] moved to experimental --- ...first_time_seen_running_windows_service.yml | 0 ..._time_seen_running_windows_service.test.yml | 18 ------------------ 2 files changed, 18 deletions(-) rename detections/{ => experimental}/endpoint/first_time_seen_running_windows_service.yml (100%) delete mode 100644 tests/endpoint/first_time_seen_running_windows_service.test.yml diff --git a/detections/endpoint/first_time_seen_running_windows_service.yml b/detections/experimental/endpoint/first_time_seen_running_windows_service.yml similarity index 100% rename from detections/endpoint/first_time_seen_running_windows_service.yml rename to detections/experimental/endpoint/first_time_seen_running_windows_service.yml diff --git a/tests/endpoint/first_time_seen_running_windows_service.test.yml b/tests/endpoint/first_time_seen_running_windows_service.test.yml deleted file mode 100644 index 3aaa4683f0..0000000000 --- a/tests/endpoint/first_time_seen_running_windows_service.test.yml +++ /dev/null @@ -1,18 +0,0 @@ -name: First Time Seen Running Windows Service Unit Test -tests: -- name: First Time Seen Running Windows Service - file: endpoint/first_time_seen_running_windows_service.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - baselines: - - name: Previously Seen Running Windows Services - Initial - file: baselines/previously_seen_running_windows_services.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: '-70m@m' - attack_data: - - file_name: windows-system.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/first_time_windows_service/windows-system.log - source: WinEventLog:System - sourcetype: WinEventLog