From 53dc410071a8e8eacffdf72d614b169cd869a2d4 Mon Sep 17 00:00:00 2001
From: mhaag-spl <5632822+MHaggis@users.noreply.github.com>
Date: Fri, 10 Dec 2021 11:39:45 -0700
Subject: [PATCH] rcloned 4688 logs

---
 .../endpoint/ssa___detect_rclone_command_line_usage.yml     | 2 +-
 .../ssa___detect_rclone_command_line_usage.test.yml         | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/ssa___detect_rclone_command_line_usage.yml b/detections/endpoint/ssa___detect_rclone_command_line_usage.yml
index f88b4a2fb7..521ff7a8eb 100644
--- a/detections/endpoint/ssa___detect_rclone_command_line_usage.yml
+++ b/detections/endpoint/ssa___detect_rclone_command_line_usage.yml
@@ -49,7 +49,7 @@ tags:
   - Source:Endpoint
   - Stage:Exfiltration
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-security.log
   impact: 50
   kill_chain_phases:
   - Exfiltration
diff --git a/tests/endpoint/ssa___detect_rclone_command_line_usage.test.yml b/tests/endpoint/ssa___detect_rclone_command_line_usage.test.yml
index 26bdade65a..407a7d7975 100644
--- a/tests/endpoint/ssa___detect_rclone_command_line_usage.test.yml
+++ b/tests/endpoint/ssa___detect_rclone_command_line_usage.test.yml
@@ -4,6 +4,6 @@ tests:
   file: endpoint/ssa___detect_rclone_command_line_usage.yml
   pass_condition: '@count_gt(0)'
   attack_data:
-  - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log
-    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
\ No newline at end of file
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-security.log
+    source: WinEventLog:Security
\ No newline at end of file