From 6c4516730d5c0da40d321cb8b6c8d01ac5e6699d Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 7 Apr 2022 15:44:24 -0700 Subject: [PATCH] Updated tests to remove update_timestamp and modified testing code to always update timestamp. This will cause some issues as not all sourcetypes are supported, yet. We will work to support them all before merging these changes to develop. --- bin/docker_detection_tester/modules/splunk_sdk.py | 13 +++++-------- .../modules/testing_service.py | 10 ++++------ .../splunk_dos_via_malformed_s2s_request.test.yml | 1 - ...umber_of_cloud_infrastructure_api_calls.test.yml | 1 - ...umber_of_cloud_security_group_api_calls.test.yml | 1 - ...e_policy_version_to_allow_all_resources.test.yml | 1 - tests/cloud/aws_createaccesskey.test.yml | 1 - tests/cloud/aws_createloginprofile.test.yml | 1 - ...activity_from_previously_unseen_account.test.yml | 1 - ...ng_keys_with_encrypt_policy_without_mfa.test.yml | 1 - ..._with_kms_keys_performing_encryption_s3.test.yml | 1 - .../cloud/aws_excessive_security_scanning.test.yml | 1 - .../aws_iam_accessdenied_discovery_events.test.yml | 1 - .../aws_iam_assume_role_policy_brute_force.test.yml | 1 - tests/cloud/aws_iam_delete_policy.test.yml | 1 - tests/cloud/aws_iam_failure_group_deletion.test.yml | 1 - .../aws_iam_successful_group_deletion.test.yml | 1 - tests/cloud/aws_lambda_updatefunctioncode.test.yml | 1 - ...ontrol_list_created_with_all_open_ports.test.yml | 1 - ...aws_network_access_control_list_deleted.test.yml | 1 - ...l_access_by_provider_user_and_principal.test.yml | 1 - .../aws_saml_update_identity_provider.test.yml | 1 - tests/cloud/aws_setdefaultpolicyversion.test.yml | 1 - tests/cloud/aws_updateloginprofile.test.yml | 1 - ...calls_from_previously_unseen_user_roles.test.yml | 1 - ...tance_created_by_previously_unseen_user.test.yml | 1 - ...nce_created_in_previously_unused_region.test.yml | 1 - ...ce_created_with_previously_unseen_image.test.yml | 1 - ...ed_with_previously_unseen_instance_type.test.yml | 1 - ...ce_modified_with_previously_unseen_user.test.yml | 1 - ...rovisioning_from_previously_unseen_city.test.yml | 1 - ...isioning_from_previously_unseen_country.test.yml | 1 - ...oning_from_previously_unseen_ip_address.test.yml | 1 - ...visioning_from_previously_unseen_region.test.yml | 1 - .../detect_aws_console_login_by_new_user.test.yml | 1 - ...aws_console_login_by_user_from_new_city.test.yml | 1 - ..._console_login_by_user_from_new_country.test.yml | 1 - ...s_console_login_by_user_from_new_region.test.yml | 1 - tests/cloud/detect_new_open_s3_buckets.test.yml | 1 - ...detect_new_open_s3_buckets_over_aws_cli.test.yml | 1 - tests/cloud/detect_shared_ec2_snapshot.test.yml | 1 - .../cloud/o365_new_federated_domain_added.test.yml | 1 - .../bcdedit_failure_recovery_modification.test.yml | 1 - ...eate_local_admin_accounts_using_net_exe.test.yml | 2 -- ...tivity_related_to_pass_the_hash_attacks.test.yml | 1 - ...xcessive_account_lockouts_from_endpoint.test.yml | 2 -- .../detect_excessive_user_account_lockouts.test.yml | 2 -- .../detect_new_local_admin_account.test.yml | 2 -- tests/endpoint/disable_registry_tool.test.yml | 2 -- tests/endpoint/disable_show_hidden_files.test.yml | 2 -- .../disable_windows_behavior_monitoring.test.yml | 2 -- .../disable_windows_smartscreen_protection.test.yml | 2 -- tests/endpoint/disabling_cmd_application.test.yml | 2 -- tests/endpoint/disabling_controlpanel.test.yml | 2 -- .../endpoint/disabling_firewall_with_netsh.test.yml | 2 -- ...disabling_folderoptions_windows_feature.test.yml | 2 -- tests/endpoint/disabling_norun_windows_app.test.yml | 2 -- .../disabling_systemrestore_in_registry.test.yml | 2 -- tests/endpoint/disabling_task_manager.test.yml | 2 -- ...ve_distinct_processes_from_windows_temp.test.yml | 1 - ...er_of_service_control_start_as_disabled.test.yml | 1 - .../excessive_number_of_taskhost_processes.test.yml | 1 - ...oasting_spn_request_with_rc4_encryption.test.yml | 1 - ...ion_flag_disabled_in_useraccountcontrol.test.yml | 1 - ...ntication_flag_disabled_with_powershell.test.yml | 1 - ...petitpotam_network_share_access_request.test.yml | 1 - ...itpotam_suspicious_kerberos_tgt_request.test.yml | 1 - .../endpoint/short_lived_windows_accounts.test.yml | 2 -- ...suspicious_computer_account_name_change.test.yml | 1 - .../suspicious_event_log_service_behavior.test.yml | 1 - ...picious_kerberos_service_ticket_request.test.yml | 1 - tests/endpoint/suspicious_msbuild_path.test.yml | 1 - tests/endpoint/suspicious_msbuild_rename.test.yml | 1 - tests/endpoint/suspicious_msbuild_spawn.test.yml | 1 - .../suspicious_mshta_child_process.test.yml | 1 - ...spicious_ticket_granting_ticket_request.test.yml | 1 - tests/endpoint/windows_event_log_cleared.test.yml | 2 -- ...t_scheduled_task_created_to_spawn_shell.test.yml | 1 - ...heduled_task_created_within_public_path.test.yml | 1 - 79 files changed, 9 insertions(+), 108 deletions(-) diff --git a/bin/docker_detection_tester/modules/splunk_sdk.py b/bin/docker_detection_tester/modules/splunk_sdk.py index f919502db1..ca7d40b790 100644 --- a/bin/docker_detection_tester/modules/splunk_sdk.py +++ b/bin/docker_detection_tester/modules/splunk_sdk.py @@ -194,8 +194,8 @@ def test_baseline_search(splunk_host, splunk_port, splunk_password, search, pass search = 'search ' + search kwargs = {"exec_mode": "blocking", - "dispatch.earliest_time": earliest_time, - "dispatch.latest_time": latest_time} + "earliest_time": earliest_time, + "latest_time": latest_time} splunk_search = search + ' ' + pass_condition @@ -230,8 +230,8 @@ def test_detection_search(splunk_host:str, splunk_port:int, splunk_password:str, search = 'search ' + search kwargs = {"exec_mode": "blocking", - "dispatch.earliest_time": "-1d", - "dispatch.latest_time": "now"} + "earliest_time": earliest_time, + "latest_time": latest_time} splunk_search = search + ' ' + pass_condition test_results = dict() @@ -328,10 +328,7 @@ def delete_attack_data(splunk_host:str, splunk_password:str, splunk_port:int, wa while (get_number_of_indexed_events(splunk_host, splunk_port, splunk_password, index=index) != 0) : splunk_search = f'search index={index} | delete' - kwargs = { - "exec_mode": "blocking", - "dispatch.earliest_time": "-1d", - "dispatch.latest_time": "now"} + kwargs = {"exec_mode": "blocking"} #no earliest_time and latest_time so that it defaults to all time try: job = service.jobs.create(splunk_search, **kwargs) diff --git a/bin/docker_detection_tester/modules/testing_service.py b/bin/docker_detection_tester/modules/testing_service.py index 8befb4691d..6d7f57c7d9 100644 --- a/bin/docker_detection_tester/modules/testing_service.py +++ b/bin/docker_detection_tester/modules/testing_service.py @@ -99,12 +99,10 @@ def test_detection(splunk_ip:str, splunk_port:int, container_name:str, splunk_pa #print(target_file) - # Update timestamps before replay - if 'update_timestamp' in attack_data: - if attack_data['update_timestamp'] == True: - data_manipulation = DataManipulation() - data_manipulation.manipulate_timestamp(target_file, attack_data['sourcetype'], attack_data['source']) - #replay_attack_dataset(container_name, splunk_password, folder_name, "test0", attack_data['sourcetype'], attack_data['source'], attack_data['file_name']) + # Update timestamps before replay - ALWAYS update timestamps! + data_manipulation = DataManipulation() + data_manipulation.manipulate_timestamp(target_file, attack_data['sourcetype'], attack_data['source']) + try: service = get_service(splunk_ip, splunk_port, splunk_password) diff --git a/tests/application/splunk_dos_via_malformed_s2s_request.test.yml b/tests/application/splunk_dos_via_malformed_s2s_request.test.yml index d2780a45e8..121d7b8090 100644 --- a/tests/application/splunk_dos_via_malformed_s2s_request.test.yml +++ b/tests/application/splunk_dos_via_malformed_s2s_request.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1498/splunk_indexer_dos/splunkd.log source: /opt/splunk/var/log/splunk/splunkd.log sourcetype: splunkd - update_timestamp: true diff --git a/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml b/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml index 290bc2758d..5ef35c3780 100644 --- a/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml +++ b/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml @@ -16,4 +16,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml b/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml index 0f73d485d2..4d3b71b906 100644 --- a/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml +++ b/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml @@ -16,4 +16,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_create_policy_version_to_allow_all_resources.test.yml b/tests/cloud/aws_create_policy_version_to_allow_all_resources.test.yml index 4a498b1b6b..8091771cb0 100644 --- a/tests/cloud/aws_create_policy_version_to_allow_all_resources.test.yml +++ b/tests/cloud/aws_create_policy_version_to_allow_all_resources.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_create_policy_version/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_createaccesskey.test.yml b/tests/cloud/aws_createaccesskey.test.yml index 120f78f97f..7273df14fa 100644 --- a/tests/cloud/aws_createaccesskey.test.yml +++ b/tests/cloud/aws_createaccesskey.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_createaccesskey/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_createloginprofile.test.yml b/tests/cloud/aws_createloginprofile.test.yml index 898e1a208d..6b93028c23 100644 --- a/tests/cloud/aws_createloginprofile.test.yml +++ b/tests/cloud/aws_createloginprofile.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_createloginprofile/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml b/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml index 5213f6b857..09f3e7b7cf 100644 --- a/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml +++ b/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.test.yml b/tests/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.test.yml index f8346d8581..bd06a8fbde 100644 --- a/tests/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.test.yml +++ b/tests/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/aws_kms_key/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.test.yml b/tests/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.test.yml index 3178457c5b..5c4d3a2c24 100644 --- a/tests/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.test.yml +++ b/tests/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/s3_file_encryption/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_excessive_security_scanning.test.yml b/tests/cloud/aws_excessive_security_scanning.test.yml index f664288e92..9b2c51201b 100644 --- a/tests/cloud/aws_excessive_security_scanning.test.yml +++ b/tests/cloud/aws_excessive_security_scanning.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/aws_security_scanner/aws_security_scanner.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_iam_accessdenied_discovery_events.test.yml b/tests/cloud/aws_iam_accessdenied_discovery_events.test.yml index 9e7a9186a0..1492e960d7 100644 --- a/tests/cloud/aws_iam_accessdenied_discovery_events.test.yml +++ b/tests/cloud/aws_iam_accessdenied_discovery_events.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/aws_iam_accessdenied_discovery_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_iam_assume_role_policy_brute_force.test.yml b/tests/cloud/aws_iam_assume_role_policy_brute_force.test.yml index 76e662f11c..bebe8caaf8 100644 --- a/tests/cloud/aws_iam_assume_role_policy_brute_force.test.yml +++ b/tests/cloud/aws_iam_assume_role_policy_brute_force.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_assume_role_policy_brute_force/aws_iam_assume_role_policy_brute_force.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_iam_delete_policy.test.yml b/tests/cloud/aws_iam_delete_policy.test.yml index dc9612fc34..dfa443a204 100644 --- a/tests/cloud/aws_iam_delete_policy.test.yml +++ b/tests/cloud/aws_iam_delete_policy.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_delete_policy/aws_iam_delete_policy.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_iam_failure_group_deletion.test.yml b/tests/cloud/aws_iam_failure_group_deletion.test.yml index c104d4e620..865c0b836d 100644 --- a/tests/cloud/aws_iam_failure_group_deletion.test.yml +++ b/tests/cloud/aws_iam_failure_group_deletion.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_failure_group_deletion/aws_iam_failure_group_deletion.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_iam_successful_group_deletion.test.yml b/tests/cloud/aws_iam_successful_group_deletion.test.yml index 9e41765b31..c67f7cd6b5 100644 --- a/tests/cloud/aws_iam_successful_group_deletion.test.yml +++ b/tests/cloud/aws_iam_successful_group_deletion.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/aws_iam_successful_group_deletion.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_lambda_updatefunctioncode.test.yml b/tests/cloud/aws_lambda_updatefunctioncode.test.yml index bc47b70de1..e04f632975 100644 --- a/tests/cloud/aws_lambda_updatefunctioncode.test.yml +++ b/tests/cloud/aws_lambda_updatefunctioncode.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204/aws_updatelambdafunctioncode/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: True diff --git a/tests/cloud/aws_network_access_control_list_created_with_all_open_ports.test.yml b/tests/cloud/aws_network_access_control_list_created_with_all_open_ports.test.yml index 2527b35388..e51e10ac62 100644 --- a/tests/cloud/aws_network_access_control_list_created_with_all_open_ports.test.yml +++ b/tests/cloud/aws_network_access_control_list_created_with_all_open_ports.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.007/aws_create_acl/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_network_access_control_list_deleted.test.yml b/tests/cloud/aws_network_access_control_list_deleted.test.yml index 734d8feaa6..51fa2e74df 100644 --- a/tests/cloud/aws_network_access_control_list_deleted.test.yml +++ b/tests/cloud/aws_network_access_control_list_deleted.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.007/aws_delete_acl/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_saml_access_by_provider_user_and_principal.test.yml b/tests/cloud/aws_saml_access_by_provider_user_and_principal.test.yml index 3232eb0fa2..c3006d117f 100644 --- a/tests/cloud/aws_saml_access_by_provider_user_and_principal.test.yml +++ b/tests/cloud/aws_saml_access_by_provider_user_and_principal.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/assume_role_with_saml/assume_role_with_saml.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_saml_update_identity_provider.test.yml b/tests/cloud/aws_saml_update_identity_provider.test.yml index e79d41fb86..f3165e1441 100644 --- a/tests/cloud/aws_saml_update_identity_provider.test.yml +++ b/tests/cloud/aws_saml_update_identity_provider.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/update_saml_provider/update_saml_provider.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_setdefaultpolicyversion.test.yml b/tests/cloud/aws_setdefaultpolicyversion.test.yml index 805fe8cc65..fbbcd8cb4f 100644 --- a/tests/cloud/aws_setdefaultpolicyversion.test.yml +++ b/tests/cloud/aws_setdefaultpolicyversion.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_setdefaultpolicyversion/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/aws_updateloginprofile.test.yml b/tests/cloud/aws_updateloginprofile.test.yml index 0551991ed5..25e56d6aca 100644 --- a/tests/cloud/aws_updateloginprofile.test.yml +++ b/tests/cloud/aws_updateloginprofile.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/aws_updateloginprofile/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml b/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml index 1554b96ffa..3ef2f28848 100644 --- a/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml +++ b/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml b/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml index f52b12aa01..6aac7a808c 100644 --- a/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml +++ b/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml b/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml index 9964e1d82b..2c346f262d 100644 --- a/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml +++ b/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml index bcb75a79e1..a1d17ccdeb 100644 --- a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml +++ b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml index 27e1083bf4..9886792502 100644 --- a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml +++ b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml b/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml index c5998f919f..5231fda744 100644 --- a/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml +++ b/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml index e1d4a7e3cd..aa6fae707f 100644 --- a/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml +++ b/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml index 9b32c57e92..806f5e805a 100644 --- a/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml +++ b/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml index 22095ed888..a3f3f4f2e2 100644 --- a/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml +++ b/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml index 9f5969eb7d..a9eef91223 100644 --- a/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml +++ b/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/detect_aws_console_login_by_new_user.test.yml b/tests/cloud/detect_aws_console_login_by_new_user.test.yml index 3ef59ba1c6..cc3d4b6bfd 100644 --- a/tests/cloud/detect_aws_console_login_by_new_user.test.yml +++ b/tests/cloud/detect_aws_console_login_by_new_user.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml b/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml index 72ca7c23c9..4216e95c24 100644 --- a/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml +++ b/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml b/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml index 72cf23e6e2..e86c6800ad 100644 --- a/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml +++ b/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml b/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml index 23eb695f11..4252a91ddb 100644 --- a/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml +++ b/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml @@ -21,4 +21,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/detect_new_open_s3_buckets.test.yml b/tests/cloud/detect_new_open_s3_buckets.test.yml index aaf6277c1e..556b54d599 100644 --- a/tests/cloud/detect_new_open_s3_buckets.test.yml +++ b/tests/cloud/detect_new_open_s3_buckets.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1530/aws_s3_public_bucket/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/detect_new_open_s3_buckets_over_aws_cli.test.yml b/tests/cloud/detect_new_open_s3_buckets_over_aws_cli.test.yml index 06a32c78fc..851fa32503 100644 --- a/tests/cloud/detect_new_open_s3_buckets_over_aws_cli.test.yml +++ b/tests/cloud/detect_new_open_s3_buckets_over_aws_cli.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1530/aws_s3_public_bucket/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/detect_shared_ec2_snapshot.test.yml b/tests/cloud/detect_shared_ec2_snapshot.test.yml index a8c847b576..d563966179 100644 --- a/tests/cloud/detect_shared_ec2_snapshot.test.yml +++ b/tests/cloud/detect_shared_ec2_snapshot.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1537/aws_snapshot_exfil/aws_cloudtrail_events.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true diff --git a/tests/cloud/o365_new_federated_domain_added.test.yml b/tests/cloud/o365_new_federated_domain_added.test.yml index 203ad7d522..6b73632b55 100644 --- a/tests/cloud/o365_new_federated_domain_added.test.yml +++ b/tests/cloud/o365_new_federated_domain_added.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federated_domain/o365_new_federated_domain.json sourcetype: o365:management:activity source: exchange - update_timestamp: true diff --git a/tests/endpoint/bcdedit_failure_recovery_modification.test.yml b/tests/endpoint/bcdedit_failure_recovery_modification.test.yml index 57c11afd36..6595dd1887 100644 --- a/tests/endpoint/bcdedit_failure_recovery_modification.test.yml +++ b/tests/endpoint/bcdedit_failure_recovery_modification.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog - update_timestamp: true diff --git a/tests/endpoint/create_local_admin_accounts_using_net_exe.test.yml b/tests/endpoint/create_local_admin_accounts_using_net_exe.test.yml index 678150f5e1..0dd727dfba 100644 --- a/tests/endpoint/create_local_admin_accounts_using_net_exe.test.yml +++ b/tests/endpoint/create_local_admin_accounts_using_net_exe.test.yml @@ -10,12 +10,10 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/tests/endpoint/detect_activity_related_to_pass_the_hash_attacks.test.yml b/tests/endpoint/detect_activity_related_to_pass_the_hash_attacks.test.yml index 65c11615a4..1e214843ee 100644 --- a/tests/endpoint/detect_activity_related_to_pass_the_hash_attacks.test.yml +++ b/tests/endpoint/detect_activity_related_to_pass_the_hash_attacks.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.002/atomic_red_team/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true diff --git a/tests/endpoint/detect_excessive_account_lockouts_from_endpoint.test.yml b/tests/endpoint/detect_excessive_account_lockouts_from_endpoint.test.yml index 3f147407b0..ce2926769c 100644 --- a/tests/endpoint/detect_excessive_account_lockouts_from_endpoint.test.yml +++ b/tests/endpoint/detect_excessive_account_lockouts_from_endpoint.test.yml @@ -10,9 +10,7 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_lockout/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_lockout/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true diff --git a/tests/endpoint/detect_excessive_user_account_lockouts.test.yml b/tests/endpoint/detect_excessive_user_account_lockouts.test.yml index 4abed7735e..211b7e2dcd 100644 --- a/tests/endpoint/detect_excessive_user_account_lockouts.test.yml +++ b/tests/endpoint/detect_excessive_user_account_lockouts.test.yml @@ -10,9 +10,7 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_lockout/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_lockout/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true diff --git a/tests/endpoint/detect_new_local_admin_account.test.yml b/tests/endpoint/detect_new_local_admin_account.test.yml index eaf5e28fcb..701c6b151a 100644 --- a/tests/endpoint/detect_new_local_admin_account.test.yml +++ b/tests/endpoint/detect_new_local_admin_account.test.yml @@ -10,12 +10,10 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/tests/endpoint/disable_registry_tool.test.yml b/tests/endpoint/disable_registry_tool.test.yml index b0693dd04e..7ad4f2334f 100644 --- a/tests/endpoint/disable_registry_tool.test.yml +++ b/tests/endpoint/disable_registry_tool.test.yml @@ -10,12 +10,10 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/tests/endpoint/disable_show_hidden_files.test.yml b/tests/endpoint/disable_show_hidden_files.test.yml index 01f66718a6..3f4d0842d0 100644 --- a/tests/endpoint/disable_show_hidden_files.test.yml +++ b/tests/endpoint/disable_show_hidden_files.test.yml @@ -10,12 +10,10 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/tests/endpoint/disable_windows_behavior_monitoring.test.yml b/tests/endpoint/disable_windows_behavior_monitoring.test.yml index f9198c5b00..c723645390 100644 --- a/tests/endpoint/disable_windows_behavior_monitoring.test.yml +++ b/tests/endpoint/disable_windows_behavior_monitoring.test.yml @@ -10,12 +10,10 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/tests/endpoint/disable_windows_smartscreen_protection.test.yml b/tests/endpoint/disable_windows_smartscreen_protection.test.yml index f4e70f3667..41c2d05446 100644 --- a/tests/endpoint/disable_windows_smartscreen_protection.test.yml +++ b/tests/endpoint/disable_windows_smartscreen_protection.test.yml @@ -10,12 +10,10 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/tests/endpoint/disabling_cmd_application.test.yml b/tests/endpoint/disabling_cmd_application.test.yml index 24ba75bce5..540feddf07 100644 --- a/tests/endpoint/disabling_cmd_application.test.yml +++ b/tests/endpoint/disabling_cmd_application.test.yml @@ -10,12 +10,10 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/tests/endpoint/disabling_controlpanel.test.yml b/tests/endpoint/disabling_controlpanel.test.yml index e35dd44e69..efb6f279a5 100644 --- a/tests/endpoint/disabling_controlpanel.test.yml +++ b/tests/endpoint/disabling_controlpanel.test.yml @@ -10,12 +10,10 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/tests/endpoint/disabling_firewall_with_netsh.test.yml b/tests/endpoint/disabling_firewall_with_netsh.test.yml index 9dac643ad4..2b391a23df 100644 --- a/tests/endpoint/disabling_firewall_with_netsh.test.yml +++ b/tests/endpoint/disabling_firewall_with_netsh.test.yml @@ -10,12 +10,10 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/tests/endpoint/disabling_folderoptions_windows_feature.test.yml b/tests/endpoint/disabling_folderoptions_windows_feature.test.yml index b5252c8271..6853a8c524 100644 --- a/tests/endpoint/disabling_folderoptions_windows_feature.test.yml +++ b/tests/endpoint/disabling_folderoptions_windows_feature.test.yml @@ -10,12 +10,10 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/tests/endpoint/disabling_norun_windows_app.test.yml b/tests/endpoint/disabling_norun_windows_app.test.yml index ef8ad59d3b..667cbe7893 100644 --- a/tests/endpoint/disabling_norun_windows_app.test.yml +++ b/tests/endpoint/disabling_norun_windows_app.test.yml @@ -10,12 +10,10 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/tests/endpoint/disabling_systemrestore_in_registry.test.yml b/tests/endpoint/disabling_systemrestore_in_registry.test.yml index 1ae373a5d2..88b456fb33 100644 --- a/tests/endpoint/disabling_systemrestore_in_registry.test.yml +++ b/tests/endpoint/disabling_systemrestore_in_registry.test.yml @@ -10,12 +10,10 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/tests/endpoint/disabling_task_manager.test.yml b/tests/endpoint/disabling_task_manager.test.yml index 03163501ec..167d5e7e62 100644 --- a/tests/endpoint/disabling_task_manager.test.yml +++ b/tests/endpoint/disabling_task_manager.test.yml @@ -10,12 +10,10 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/tests/endpoint/excessive_distinct_processes_from_windows_temp.test.yml b/tests/endpoint/excessive_distinct_processes_from_windows_temp.test.yml index 8711c1c859..f3e59b34ba 100644 --- a/tests/endpoint/excessive_distinct_processes_from_windows_temp.test.yml +++ b/tests/endpoint/excessive_distinct_processes_from_windows_temp.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/meterpreter/windows_temp_processes/logExcessiveWindowsTemp.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true diff --git a/tests/endpoint/excessive_number_of_service_control_start_as_disabled.test.yml b/tests/endpoint/excessive_number_of_service_control_start_as_disabled.test.yml index 82084f5c7b..cf3de310dd 100644 --- a/tests/endpoint/excessive_number_of_service_control_start_as_disabled.test.yml +++ b/tests/endpoint/excessive_number_of_service_control_start_as_disabled.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/sc_service_start_disabled/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog - update_timestamp: true diff --git a/tests/endpoint/excessive_number_of_taskhost_processes.test.yml b/tests/endpoint/excessive_number_of_taskhost_processes.test.yml index b71a857e10..3ae4a95ca7 100644 --- a/tests/endpoint/excessive_number_of_taskhost_processes.test.yml +++ b/tests/endpoint/excessive_number_of_taskhost_processes.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/meterpreter/taskhost_processes/logExcessiveTaskHost.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true diff --git a/tests/endpoint/kerberoasting_spn_request_with_rc4_encryption.test.yml b/tests/endpoint/kerberoasting_spn_request_with_rc4_encryption.test.yml index 0ccedf2ad7..a49c490522 100644 --- a/tests/endpoint/kerberoasting_spn_request_with_rc4_encryption.test.yml +++ b/tests/endpoint/kerberoasting_spn_request_with_rc4_encryption.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/rubeus/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true diff --git a/tests/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.test.yml b/tests/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.test.yml index df1569133d..f9646f6fa6 100644 --- a/tests/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.test.yml +++ b/tests/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: True \ No newline at end of file diff --git a/tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml b/tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml index 2abcf3d741..e967f73018 100644 --- a/tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml +++ b/tests/endpoint/kerberos_pre_authentication_flag_disabled_with_powershell.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-powershell.log source: WinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: wineventlog - update_timestamp: True \ No newline at end of file diff --git a/tests/endpoint/petitpotam_network_share_access_request.test.yml b/tests/endpoint/petitpotam_network_share_access_request.test.yml index 10629b0169..e6c1e6f1ce 100644 --- a/tests/endpoint/petitpotam_network_share_access_request.test.yml +++ b/tests/endpoint/petitpotam_network_share_access_request.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1187/petitpotam/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true diff --git a/tests/endpoint/petitpotam_suspicious_kerberos_tgt_request.test.yml b/tests/endpoint/petitpotam_suspicious_kerberos_tgt_request.test.yml index 8786c00653..1438d89d39 100644 --- a/tests/endpoint/petitpotam_suspicious_kerberos_tgt_request.test.yml +++ b/tests/endpoint/petitpotam_suspicious_kerberos_tgt_request.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1187/petitpotam/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true diff --git a/tests/endpoint/short_lived_windows_accounts.test.yml b/tests/endpoint/short_lived_windows_accounts.test.yml index 23507c66b0..34c9713d68 100644 --- a/tests/endpoint/short_lived_windows_accounts.test.yml +++ b/tests/endpoint/short_lived_windows_accounts.test.yml @@ -10,12 +10,10 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true - file_name: windows-sysmon.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/tests/endpoint/suspicious_computer_account_name_change.test.yml b/tests/endpoint/suspicious_computer_account_name_change.test.yml index 18b1023943..3f9553b3dd 100644 --- a/tests/endpoint/suspicious_computer_account_name_change.test.yml +++ b/tests/endpoint/suspicious_computer_account_name_change.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true diff --git a/tests/endpoint/suspicious_event_log_service_behavior.test.yml b/tests/endpoint/suspicious_event_log_service_behavior.test.yml index 74537d7506..60bb710a27 100644 --- a/tests/endpoint/suspicious_event_log_service_behavior.test.yml +++ b/tests/endpoint/suspicious_event_log_service_behavior.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true diff --git a/tests/endpoint/suspicious_kerberos_service_ticket_request.test.yml b/tests/endpoint/suspicious_kerberos_service_ticket_request.test.yml index aaf1852223..9c05b5e4e6 100644 --- a/tests/endpoint/suspicious_kerberos_service_ticket_request.test.yml +++ b/tests/endpoint/suspicious_kerberos_service_ticket_request.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true diff --git a/tests/endpoint/suspicious_msbuild_path.test.yml b/tests/endpoint/suspicious_msbuild_path.test.yml index 3a5d86ad5f..5932aed4c9 100644 --- a/tests/endpoint/suspicious_msbuild_path.test.yml +++ b/tests/endpoint/suspicious_msbuild_path.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog - update_timestamp: true diff --git a/tests/endpoint/suspicious_msbuild_rename.test.yml b/tests/endpoint/suspicious_msbuild_rename.test.yml index 6a47ac212a..5a06dfa7ab 100644 --- a/tests/endpoint/suspicious_msbuild_rename.test.yml +++ b/tests/endpoint/suspicious_msbuild_rename.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog - update_timestamp: true diff --git a/tests/endpoint/suspicious_msbuild_spawn.test.yml b/tests/endpoint/suspicious_msbuild_spawn.test.yml index 15545353db..d736988764 100644 --- a/tests/endpoint/suspicious_msbuild_spawn.test.yml +++ b/tests/endpoint/suspicious_msbuild_spawn.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog - update_timestamp: true diff --git a/tests/endpoint/suspicious_mshta_child_process.test.yml b/tests/endpoint/suspicious_mshta_child_process.test.yml index bb6eae1dfb..bbd486f704 100644 --- a/tests/endpoint/suspicious_mshta_child_process.test.yml +++ b/tests/endpoint/suspicious_mshta_child_process.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog - update_timestamp: true diff --git a/tests/endpoint/suspicious_ticket_granting_ticket_request.test.yml b/tests/endpoint/suspicious_ticket_granting_ticket_request.test.yml index cc3af5a079..37c19d0eb0 100644 --- a/tests/endpoint/suspicious_ticket_granting_ticket_request.test.yml +++ b/tests/endpoint/suspicious_ticket_granting_ticket_request.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true diff --git a/tests/endpoint/windows_event_log_cleared.test.yml b/tests/endpoint/windows_event_log_cleared.test.yml index 606e84c79b..b967c17bb5 100644 --- a/tests/endpoint/windows_event_log_cleared.test.yml +++ b/tests/endpoint/windows_event_log_cleared.test.yml @@ -10,9 +10,7 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true - file_name: windows-system.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-system.log source: WinEventLog:System sourcetype: WinEventLog - update_timestamp: true diff --git a/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml b/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml index d58142a54b..418ed117fd 100644 --- a/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml +++ b/tests/endpoint/winevent_scheduled_task_created_to_spawn_shell.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true diff --git a/tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml b/tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml index fd0bca9456..f39173498e 100644 --- a/tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml +++ b/tests/endpoint/winevent_scheduled_task_created_within_public_path.test.yml @@ -10,4 +10,3 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/taskschedule/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog - update_timestamp: true