mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
added validation
This commit is contained in:
P4T12ICK
@@ -1,10 +0,0 @@
|
||||
name: Anomalous Usage of Account Credentials Unit Test
|
||||
tests:
|
||||
- name: Anomalous Usage of Account Credentials
|
||||
file: endpoint/ssa___anomalous_usage_of_account_credentials.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test for Anomalous usage of Account Credentials
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_login/windows-security.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,10 +0,0 @@
|
||||
name: Applying Stolen Credentials via Mimikatz modules Unit Test
|
||||
tests:
|
||||
- name: Applying Stolen Credentials via Mimikatz modules
|
||||
file: endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
|
||||
description: Test applying stolen credentials detections
|
||||
pass_condition: '@count_gt(0)'
|
||||
attack_data:
|
||||
- file_name: logAllMimikatzModules.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,10 +0,0 @@
|
||||
name: Applying Stolen Credentials via PowerSploit Unit Test
|
||||
tests:
|
||||
- name: Applying Stolen Credentials via PowerSploit
|
||||
file: endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test applying stolen credentials detections
|
||||
attack_data:
|
||||
- file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,10 +0,0 @@
|
||||
name: Assessment of Credential Strength via DSInternals modules Unit Test
|
||||
tests:
|
||||
- name: Assessment of Credential Strength via DSInternals modules
|
||||
file: endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test assessment of credential strength detections
|
||||
attack_data:
|
||||
- file_name: logAllDSInternalsModules.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,12 +0,0 @@
|
||||
name: Credential Extraction indicative of use of DSInternals credential conversion
|
||||
modules Unit Test
|
||||
tests:
|
||||
- name: Credential Extraction indicative of use of DSInternals credential conversion
|
||||
modules
|
||||
file: endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test credential extraction detections
|
||||
attack_data:
|
||||
- file_name: logAllDSInternalsModules.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,10 +0,0 @@
|
||||
name: Credential Extraction indicative of use of DSInternals modules Unit Test
|
||||
tests:
|
||||
- name: Credential Extraction indicative of use of DSInternals modules
|
||||
file: endpoint/ssa___credential_extraction_dsinternals_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test credential extraction detections
|
||||
attack_data:
|
||||
- file_name: logAllDSInternalsModules.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,11 +0,0 @@
|
||||
name: Credential Extraction indicative of FGDump and CacheDump with s option Unit
|
||||
Test
|
||||
tests:
|
||||
- name: Credential Extraction indicative of FGDump and CacheDump with s option
|
||||
file: endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test credential extraction detections
|
||||
attack_data:
|
||||
- file_name: logFgdump.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,11 +0,0 @@
|
||||
name: Credential Extraction indicative of FGDump and CacheDump with v option Unit
|
||||
Test
|
||||
tests:
|
||||
- name: Credential Extraction indicative of FGDump and CacheDump with v option
|
||||
file: endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test credential extraction detections
|
||||
attack_data:
|
||||
- file_name: logFgdump.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,12 +0,0 @@
|
||||
name: Credential Extraction via Get-ADDBAccount module present in PowerSploit and
|
||||
DSInternals Unit Test
|
||||
tests:
|
||||
- name: Credential Extraction via Get-ADDBAccount module present in PowerSploit and
|
||||
DSInternals
|
||||
file: endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test credential extraction detections
|
||||
attack_data:
|
||||
- file_name: logPowerShellModule.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logPowerShellModule.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,10 +0,0 @@
|
||||
name: Credential Extraction indicative of Lazagne command line options Unit Test
|
||||
tests:
|
||||
- name: Credential Extraction indicative of Lazagne command line options
|
||||
file: endpoint/ssa___credential_extraction_lazagne_command_options.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test credential extraction detections
|
||||
attack_data:
|
||||
- file_name: logLazagneCredDump.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLazagneCredDump.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,10 +0,0 @@
|
||||
name: Credential Extraction indicative of use of Mimikatz modules Unit Test
|
||||
tests:
|
||||
- name: Credential Extraction indicative of use of Mimikatz modules
|
||||
file: endpoint/ssa___credential_extraction_mimikatz_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test credential extraction detections
|
||||
attack_data:
|
||||
- file_name: logAllMimikatzModules.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,10 +0,0 @@
|
||||
name: Credential Extraction native Microsoft debuggers peek into the kernel Unit Test
|
||||
tests:
|
||||
- name: Credential Extraction native Microsoft debuggers peek into the kernel
|
||||
file: endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test credential extraction detections
|
||||
attack_data:
|
||||
- file_name: logLiveKDFullKernelDump.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,11 +0,0 @@
|
||||
name: Credential Extraction native Microsoft debuggers via z command line option Unit
|
||||
Test
|
||||
tests:
|
||||
- name: Credential Extraction native Microsoft debuggers via z command line option
|
||||
file: endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test credential extraction detections
|
||||
attack_data:
|
||||
- file_name: logLiveKDFullKernelDump.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,10 +0,0 @@
|
||||
name: Credential Extraction indicative of use of PowerSploit modules Unit Test
|
||||
tests:
|
||||
- name: Credential Extraction indicative of use of PowerSploit modules
|
||||
file: endpoint/ssa___credential_extraction_powersploit_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test credential extraction detections
|
||||
attack_data:
|
||||
- file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,10 +0,0 @@
|
||||
name: Detect Kerberoasting Unit Test
|
||||
tests:
|
||||
- name: Detect Kerberoasting
|
||||
file: endpoint/ssa___detect_kerberoasting.yml
|
||||
pass_condition: '@count_eq(0)'
|
||||
description: Test detection of kerberoasting
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-security.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,10 +0,0 @@
|
||||
name: Detect Prohibited Applications Spawning cmd exe Unit Test
|
||||
tests:
|
||||
- name: Detect Prohibited Applications Spawning cmd exe
|
||||
file: endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Detect Prohibited Applications Spawning cmd exe
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-security.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,10 +0,0 @@
|
||||
name: Excessive Number of Office Files Copied Unit Test
|
||||
tests:
|
||||
- name: Excessive Number of Office Files Copied
|
||||
file: endpoint/ssa___excessive_number_of_office_files_copied.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test for Excessive Number of Office Files Copied
|
||||
attack_data:
|
||||
- file_name: sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/mass_file_creation/windows-sysmon.log
|
||||
source: xmlwineventlog
|
||||
@@ -1,10 +0,0 @@
|
||||
name: First time seen command line argument Unit Test
|
||||
tests:
|
||||
- name: First time seen command line argument
|
||||
file: endpoint/ssa___first_time_seen_cmd_line.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test detection of first time seen command
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/cmd_arguments/windows-security.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,10 +0,0 @@
|
||||
name: High File Deletion Frequency Unit Test
|
||||
tests:
|
||||
- name: High File Deletion Frequency
|
||||
file: endpoint/ssa___high_file_deletion_frequency.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test for High File Deletion Frequency
|
||||
attack_data:
|
||||
- file_name: sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/excessive_file_deletions/windows-sysmon.log
|
||||
source: xmlwineventlog
|
||||
@@ -1,10 +0,0 @@
|
||||
name: Illegal Access To User Content via PowerSploit modules Unit Test
|
||||
tests:
|
||||
- name: Illegal Access To User Content via PowerSploit modules
|
||||
file: endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test illegal access to user content detections
|
||||
attack_data:
|
||||
- file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021/illegal_access_to_content/logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,10 +0,0 @@
|
||||
name: Illegal Account Creation via PowerSploit modules Unit Test
|
||||
tests:
|
||||
- name: Illegal Account Creation via PowerSploit modules
|
||||
file: endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test illegal account creation detections
|
||||
attack_data:
|
||||
- file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021/illegal_access_to_content/logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,10 +0,0 @@
|
||||
name: Illegal Enabling or Disabling of Accounts via DSInternals modules Unit Test
|
||||
tests:
|
||||
- name: Illegal Enabling or Disabling of Accounts via DSInternals modules
|
||||
file: endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test enabling or disabling of accounts detections
|
||||
attack_data:
|
||||
- file_name: logAllDSInternalsModules.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,10 +0,0 @@
|
||||
name: Illegal Deletion of Logs via Mimikatz modules Unit Test
|
||||
tests:
|
||||
- name: Illegal Deletion of Logs via Mimikatz modules
|
||||
file: endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test illegal log deletion detections
|
||||
attack_data:
|
||||
- file_name: logAllMimikatzModules.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/illegal_log_deletion/logAllMimikatzModules.log
|
||||
source: WinEventLog:Security
|
||||
-12
@@ -1,12 +0,0 @@
|
||||
name: Illegal Management of Active Directory Elements and Policies via DSInternals
|
||||
modules Unit Test
|
||||
tests:
|
||||
- name: Illegal Management of Active Directory Elements and Policies via DSInternals
|
||||
modules
|
||||
file: endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test illegal management of Active Directory elements and policies detections
|
||||
attack_data:
|
||||
- file_name: logAllDSInternalsModules.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/logAllDSInternalsModules.log
|
||||
source: WinEventLog:Security
|
||||
-13
@@ -1,13 +0,0 @@
|
||||
name: Illegal Management of Computers and Active Directory Elements via PowerSploit
|
||||
modules Unit Test
|
||||
tests:
|
||||
- name: Illegal Management of Computers and Active Directory Elements via PowerSploit
|
||||
modules
|
||||
file: endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test illegal management of computers and Active Directory elements
|
||||
detections
|
||||
attack_data:
|
||||
- file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
-10
@@ -1,10 +0,0 @@
|
||||
name: Illegal Privilege Elevation and Persistence via PowerSploit modules Unit Test
|
||||
tests:
|
||||
- name: Illegal Privilege Elevation and Persistence via PowerSploit modules
|
||||
file: endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test privilege elevation and persistence detections
|
||||
attack_data:
|
||||
- file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,10 +0,0 @@
|
||||
name: Illegal Privilege Elevation via Mimikatz modules Unit Test
|
||||
tests:
|
||||
- name: Illegal Privilege Elevation via Mimikatz modules
|
||||
file: endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test illegal privilege elevation detections
|
||||
attack_data:
|
||||
- file_name: logAllMimikatzModules.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllMimikatzModules.log
|
||||
source: WinEventLog:Security
|
||||
-10
@@ -1,10 +0,0 @@
|
||||
name: Illegal Service and Process Control via Mimikatz modules Unit Test
|
||||
tests:
|
||||
- name: Illegal Service and Process Control via Mimikatz modules
|
||||
file: endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test illegal service and process control detections
|
||||
attack_data:
|
||||
- file_name: logAllMimikatzModules.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
|
||||
source: WinEventLog:Security
|
||||
-10
@@ -1,10 +0,0 @@
|
||||
name: Illegal Service and Process Control via PowerSploit modules Unit Test
|
||||
tests:
|
||||
- name: Illegal Service and Process Control via PowerSploit modules
|
||||
file: endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test illegal service and process control detections
|
||||
attack_data:
|
||||
- file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
-10
@@ -1,10 +0,0 @@
|
||||
name: Probing Access with Stolen Credentials via PowerSploit modules Unit Test
|
||||
tests:
|
||||
- name: Probing Access with Stolen Credentials via PowerSploit modules
|
||||
file: endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test access probing with stolen credentials detections
|
||||
attack_data:
|
||||
- file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,11 +0,0 @@
|
||||
name: Rare Parent-Child Process Relationship Unit Test
|
||||
tests:
|
||||
- name: Rare Parent-Child Process Relationship
|
||||
file: endpoint/ssa___rare_parent_process_relationship_lolbas.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test detection looking for LOLBAS processes spawned by other processes
|
||||
that are rarely seen together
|
||||
attack_data:
|
||||
- file_name: windows-sec-events.out
|
||||
data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sec-events.out
|
||||
source: WinEventLog:Security
|
||||
-11
@@ -1,11 +0,0 @@
|
||||
name: Reconnaissance of Access and Persistence Opportunities via PowerSploit modules
|
||||
Unit Test
|
||||
tests:
|
||||
- name: Reconnaissance of Access and Persistence Opportunities via PowerSploit modules
|
||||
file: endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test reconnaissance of access and persistence detections
|
||||
attack_data:
|
||||
- file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
-12
@@ -1,12 +0,0 @@
|
||||
name: Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules
|
||||
Unit Test
|
||||
tests:
|
||||
- name: Reconnaissance and Access to Accounts Groups and Policies via PowerSploit
|
||||
modules
|
||||
file: endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test reconnaissance and access to accounts groups and policies detections
|
||||
attack_data:
|
||||
- file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,10 +0,0 @@
|
||||
name: Reconnaissance and Access to Accounts and Groups via Mimikatz modules Unit Test
|
||||
tests:
|
||||
- name: Reconnaissance and Access to Accounts and Groups via Mimikatz modules
|
||||
file: endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test reconnaissance and access to accounts and groups detections
|
||||
attack_data:
|
||||
- file_name: logAllMimikatzModules.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
|
||||
source: WinEventLog:Security
|
||||
-12
@@ -1,12 +0,0 @@
|
||||
name: Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit
|
||||
modules Unit Test
|
||||
tests:
|
||||
- name: Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit
|
||||
modules
|
||||
file: endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test reconnaissance and access to active directory infrastrucutre detections
|
||||
attack_data:
|
||||
- file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,11 +0,0 @@
|
||||
name: Reconnaissance and Access to Computers and Domains via PowerSploit modules Unit
|
||||
Test
|
||||
tests:
|
||||
- name: Reconnaissance and Access to Computers and Domains via PowerSploit modules
|
||||
file: endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test reconnaissance and access to computers and domains detections
|
||||
attack_data:
|
||||
- file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,10 +0,0 @@
|
||||
name: Reconnaissance and Access to Computers via Mimikatz modules Unit Test
|
||||
tests:
|
||||
- name: Reconnaissance and Access to Computers via Mimikatz modules
|
||||
file: endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test reconnaissance and access to computers detections
|
||||
attack_data:
|
||||
- file_name: logAllMimikatzModules.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
|
||||
source: WinEventLog:Security
|
||||
-11
@@ -1,11 +0,0 @@
|
||||
name: Reconnaissance and Access to Operating System Elements via PowerSploit modules
|
||||
Unit Test
|
||||
tests:
|
||||
- name: Reconnaissance and Access to Operating System Elements via PowerSploit modules
|
||||
file: endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test reconnaissance and access to operating system element detections
|
||||
attack_data:
|
||||
- file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,10 +0,0 @@
|
||||
name: Reconnaissance and Access to Shared Resources via Mimikatz modules Unit Test
|
||||
tests:
|
||||
- name: Reconnaissance and Access to Shared Resources via Mimikatz modules
|
||||
file: endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test reconnaissance and access to network shares detections
|
||||
attack_data:
|
||||
- file_name: logAllMimikatzModules.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,10 +0,0 @@
|
||||
name: Reconnaissance and Access to Shared Resources via PowerSploit modules Unit Test
|
||||
tests:
|
||||
- name: Reconnaissance and Access to Shared Resources via PowerSploit modules
|
||||
file: endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test reconnaissance and access to shares detections
|
||||
attack_data:
|
||||
- file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,10 +0,0 @@
|
||||
name: Reconnaissance of Connectivity via PowerSploit modules Unit Test
|
||||
tests:
|
||||
- name: Reconnaissance of Connectivity via PowerSploit modules
|
||||
file: endpoint/ssa___recon_connectivity_via_powersploit_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test reconnaissance of connectivity detections
|
||||
attack_data:
|
||||
- file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
-10
@@ -1,10 +0,0 @@
|
||||
name: Reconnaissance of Credential Stores and Services via Mimikatz modules Unit Test
|
||||
tests:
|
||||
- name: Reconnaissance of Credential Stores and Services via Mimikatz modules
|
||||
file: endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test reconnaissance of credential stores and services detections
|
||||
attack_data:
|
||||
- file_name: logAllMimikatzModules.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,10 +0,0 @@
|
||||
name: Reconnaissance of Defensive Tools via PowerSploit modules Unit Test
|
||||
tests:
|
||||
- name: Reconnaissance of Defensive Tools via PowerSploit modules
|
||||
file: endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test reconnaissance of presence of defensive tools detections
|
||||
attack_data:
|
||||
- file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
-11
@@ -1,11 +0,0 @@
|
||||
name: Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules
|
||||
Unit Test
|
||||
tests:
|
||||
- name: Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules
|
||||
file: endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test reconnaissance of privilege escalations opportunities detections
|
||||
attack_data:
|
||||
- file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,12 +0,0 @@
|
||||
name: Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules
|
||||
Unit Test
|
||||
tests:
|
||||
- name: Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz
|
||||
modules
|
||||
file: endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test reconnaissance of process or service hijacking detections
|
||||
attack_data:
|
||||
- file_name: logAllMimikatzModules.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,11 +0,0 @@
|
||||
name: Reconnaissance and Access to Processes and Services via Mimikatz modules Unit
|
||||
Test
|
||||
tests:
|
||||
- name: Reconnaissance and Access to Processes and Services via Mimikatz modules
|
||||
file: endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test reconnaissance of processes and services detections
|
||||
attack_data:
|
||||
- file_name: logAllMimikatzModules.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,10 +0,0 @@
|
||||
name: Setting Credentials via DSInternals modules Unit Test
|
||||
tests:
|
||||
- name: Setting Credentials via DSInternals modules
|
||||
file: endpoint/ssa___setting_credentials_via_dsinternals_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test illegal credential setting detections
|
||||
attack_data:
|
||||
- file_name: logAllDSInternalsModules.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,10 +0,0 @@
|
||||
name: Setting Credentials via Mimikatz modules Unit Test
|
||||
tests:
|
||||
- name: Setting Credentials via Mimikatz modules
|
||||
file: endpoint/ssa___setting_credentials_via_mimikatz_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test illegal credential setting detections
|
||||
attack_data:
|
||||
- file_name: logAllMimikatzModules.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,10 +0,0 @@
|
||||
name: Setting Credentials via PowerSploit modules Unit Test
|
||||
tests:
|
||||
- name: Setting Credentials via PowerSploit modules
|
||||
file: endpoint/ssa___setting_credentials_via_powersploit_modules.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test illegal credential setting detections
|
||||
attack_data:
|
||||
- file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
@@ -1,10 +0,0 @@
|
||||
name: Unusually Long Command Line Unit Test
|
||||
tests:
|
||||
- name: Unusually Long Command Line
|
||||
file: endpoint/ssa___unusually_long_command_line.yml
|
||||
pass_condition: '@count_gt(0)'
|
||||
description: Test unusually long command lines
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/unusally_cmd_line/windows-security.log
|
||||
source: WinEventLog:Security
|
||||
Reference in New Issue
Block a user