admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

fixes

Browse Source
This commit is contained in:
Michael Haag
2023-02-14 15:35:00 -07:00
parent 5efc870783
commit 6a1edaa5f3
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml
+1 -1
View File
@@ -28,7 +28,7 @@ tags:
context:
- Source:Endpoint
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/capi2_operational.log
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/capi2-operational.log
impact: 30
kill_chain_phases:
- Actions on Objectives
tests/endpoint/windows_steal_authentication_certificates_cryptoapi.test.yml
+2 -2
View File
@@ -6,8 +6,8 @@ tests:
earliest_time: -24h
latest_time: now
attack_data:
- file_name: capi2_operational.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/capi2_operational.log
- file_name: capi2-operational.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/capi2-operational.log
source: XmlWinEventLog:Microsoft-Windows-CAPI2/Operational
sourcetype: XmlWinEventLog
update_timestamp: true