From b75b56b81d55bf055f7d24fb9cbfcdd66c8cca6f Mon Sep 17 00:00:00 2001 From: d1vious Date: Wed, 29 Jun 2022 14:18:47 -0400 Subject: [PATCH] removing test files --- ...or_hash_observed_at_the_destination_device.test.yml | 10 ---------- ...ash_observed_by_an_event_collecting_device.test.yml | 10 ---------- ...a___unusual_lolbas_in_short_period_of_time.test.yml | 10 ---------- 3 files changed, 30 deletions(-) delete mode 100644 tests/endpoint/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.test.yml delete mode 100644 tests/endpoint/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.test.yml delete mode 100644 tests/endpoint/ssa___unusual_lolbas_in_short_period_of_time.test.yml diff --git a/tests/endpoint/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.test.yml b/tests/endpoint/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.test.yml deleted file mode 100644 index b25ca49a47..0000000000 --- a/tests/endpoint/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Potential Pass the Token or Hash Observed at the Destination Device Unit Test -tests: - - name: Potential Pass the Token or Hash Observed at the Destination Device - file: endpoint/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml - pass_condition: '@count_gt(0)' - description: Test Pass the Hash or Pass the Token Detection Observed by a Destination Device - attack_data: - - file_name: ptt_pth_kerb_ntlm_anon_dest_dataset.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.002/extracts_from_real_data/ptt_pth_kerb_ntlm_anon_dest_dataset.log - source: WinEventLog:Security \ No newline at end of file diff --git a/tests/endpoint/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.test.yml b/tests/endpoint/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.test.yml deleted file mode 100644 index f988fd89fb..0000000000 --- a/tests/endpoint/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Potential Pass the Token or Hash Observed by an Event Collecting Device Unit Test -tests: - - name: Potential Pass the Token or Hash Observed by an Event Collecting Device - file: endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml - pass_condition: '@count_gt(0)' - description: Test Pass the Hash or Pass the Token Detection Observed by an Event Collecting Device - attack_data: - - file_name: ptt_pth_kerb_ntlm_anon_DC_dataset.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.002/extracts_from_real_data/ptt_pth_kerb_ntlm_anon_DC_dataset.log - source: WinEventLog:Security \ No newline at end of file diff --git a/tests/endpoint/ssa___unusual_lolbas_in_short_period_of_time.test.yml b/tests/endpoint/ssa___unusual_lolbas_in_short_period_of_time.test.yml deleted file mode 100644 index 3851135d93..0000000000 --- a/tests/endpoint/ssa___unusual_lolbas_in_short_period_of_time.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Unusual LOLBAS in short period of time Unit Test -tests: -- name: Unusual LOLBAS in short period of time - file: endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml - pass_condition: '@count_gt(0)' - description: Test more than usual lolbas being executed in a short period of time - attack_data: - - file_name: T1059.all.labeled.lolbas-test.json - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/T1059.all.labeled.lolbas-test.json - source: WinEventLog:Security