From 6a1edaa5f3e533386986080d04f525934bcbf687 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 14 Feb 2023 15:35:00 -0700 Subject: [PATCH] fixes --- .../windows_steal_authentication_certificates_cryptoapi.yml | 2 +- ...ndows_steal_authentication_certificates_cryptoapi.test.yml | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml b/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml index 616f0afd71..490f523376 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_cryptoapi.yml @@ -28,7 +28,7 @@ tags: context: - Source:Endpoint dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/capi2_operational.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/capi2-operational.log impact: 30 kill_chain_phases: - Actions on Objectives diff --git a/tests/endpoint/windows_steal_authentication_certificates_cryptoapi.test.yml b/tests/endpoint/windows_steal_authentication_certificates_cryptoapi.test.yml index 2983a0f5b0..3e65f56748 100644 --- a/tests/endpoint/windows_steal_authentication_certificates_cryptoapi.test.yml +++ b/tests/endpoint/windows_steal_authentication_certificates_cryptoapi.test.yml @@ -6,8 +6,8 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: capi2_operational.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/capi2_operational.log + - file_name: capi2-operational.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/capi2-operational.log source: XmlWinEventLog:Microsoft-Windows-CAPI2/Operational sourcetype: XmlWinEventLog update_timestamp: true