From 65cea954435bb07a3fdc426bb08f8a56cdb745d4 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 20 Jan 2025 18:33:03 +0100 Subject: [PATCH] Update windows_sensitive_registry_hive_dump_via_commandline.yml --- .../windows_sensitive_registry_hive_dump_via_commandline.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml index 97db28270b..c24d7977a0 100644 --- a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml +++ b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml @@ -77,12 +77,12 @@ tags: risk_score: 56 security_domain: endpoint tests: -- name: True Positive Test +- name: True Positive Test - Sysmon attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog -- name: True Positive Test +- name: True Positive Test - CrowdStrike attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/crowdstrike_falcon.log source: crowdstrike