From 741f7344efff67f4221daf69e61cdeab48e319bb Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 28 Feb 2022 15:37:33 +0100 Subject: [PATCH] added validation --- ..._anomalous_usage_of_account_credentials.test.yml | 10 ---------- ...stolen_credentials_via_mimikatz_modules.test.yml | 10 ---------- ...len_credentials_via_powersploit_modules.test.yml | 10 ---------- ...ential_strength_via_dsinternals_modules.test.yml | 10 ---------- ...traction_dsinternals_conversion_modules.test.yml | 12 ------------ ...edential_extraction_dsinternals_modules.test.yml | 10 ---------- ...al_extraction_fgdump_cachedump_s_option.test.yml | 11 ----------- ...al_extraction_fgdump_cachedump_v_option.test.yml | 11 ----------- ...ial_extraction_getaddbaccount_from_dump.test.yml | 12 ------------ ...tial_extraction_lazagne_command_options.test.yml | 10 ---------- ..._credential_extraction_mimikatz_modules.test.yml | 10 ---------- ...ial_extraction_ms_debuggers_kernel_peek.test.yml | 10 ---------- ...ential_extraction_ms_debuggers_z_option.test.yml | 11 ----------- ...edential_extraction_powersploit_modules.test.yml | 10 ---------- tests/endpoint/ssa___detect_kerberoasting.test.yml | 10 ---------- ...rohibited_applications_spawning_cmd_exe.test.yml | 10 ---------- ...excessive_number_of_office_files_copied.test.yml | 10 ---------- .../ssa___first_time_seen_cmd_line.test.yml | 10 ---------- .../ssa___high_file_deletion_frequency.test.yml | 10 ---------- ...ss_user_content_via_powersploit_modules.test.yml | 10 ---------- ...ccount_creation_via_powersploit_modules.test.yml | 10 ---------- ..._enable_disable_via_dsinternals_modules.test.yml | 10 ---------- ...legal_log_deletion_via_mimikatz_modules.test.yml | 10 ---------- ...ts_and_policies_via_dsinternals_modules.test.yml | 12 ------------ ...and_AD_elements_via_powersploit_modules.test.yml | 13 ------------- ...and_persistence_via_powersploit_modules.test.yml | 10 ---------- ...rivilege_elevation_via_mimikatz_modules.test.yml | 10 ---------- ...nd_process_control_via_mimikatz_modules.test.yml | 10 ---------- ...process_control_via_powersploit_modules.test.yml | 10 ---------- ...len_credentials_via_powersploit_modules.test.yml | 10 ---------- ...rare_parent_process_relationship_lolbas.test.yml | 11 ----------- ...e_opportunities_via_powersploit_modules.test.yml | 11 ----------- ...groups_policies_via_powersploit_modules.test.yml | 12 ------------ ...se_accounts_groups_via_mimikatz_modules.test.yml | 10 ---------- ..._infrastructure_via_powersploit_modules.test.yml | 12 ------------ ...mputers_domains_via_powersploit_modules.test.yml | 11 ----------- ..._and_use_computers_via_mimikatz_modules.test.yml | 10 ---------- ...system_elements_via_powersploit_modules.test.yml | 11 ----------- ...con_and_use_shares_via_mimikatz_modules.test.yml | 10 ---------- ..._and_use_shares_via_powersploit_modules.test.yml | 10 ---------- ...on_connectivity_via_powersploit_modules.test.yml | 10 ---------- ...tores_and_services_via_mimikatz_modules.test.yml | 10 ---------- ...defensive_tools_via_powersploit_modules.test.yml | 10 ---------- ...n_opportunities_via_powersploit_modules.test.yml | 11 ----------- ..._service_hijacking_via_mimikatz_modules.test.yml | 12 ------------ ...esses_and_services_via_mimikatz_modules.test.yml | 11 ----------- ...ing_credentials_via_dsinternals_modules.test.yml | 10 ---------- ...etting_credentials_via_mimikatz_modules.test.yml | 10 ---------- ...ing_credentials_via_powersploit_modules.test.yml | 10 ---------- .../ssa___unusually_long_command_line.test.yml | 10 ---------- 50 files changed, 524 deletions(-) delete mode 100644 tests/endpoint/ssa___anomalous_usage_of_account_credentials.test.yml delete mode 100644 tests/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.test.yml delete mode 100644 tests/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.test.yml delete mode 100644 tests/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.test.yml delete mode 100644 tests/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.test.yml delete mode 100644 tests/endpoint/ssa___credential_extraction_dsinternals_modules.test.yml delete mode 100644 tests/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.test.yml delete mode 100644 tests/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.test.yml delete mode 100644 tests/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.test.yml delete mode 100644 tests/endpoint/ssa___credential_extraction_lazagne_command_options.test.yml delete mode 100644 tests/endpoint/ssa___credential_extraction_mimikatz_modules.test.yml delete mode 100644 tests/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.test.yml delete mode 100644 tests/endpoint/ssa___credential_extraction_ms_debuggers_z_option.test.yml delete mode 100644 tests/endpoint/ssa___credential_extraction_powersploit_modules.test.yml delete mode 100644 tests/endpoint/ssa___detect_kerberoasting.test.yml delete mode 100644 tests/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.test.yml delete mode 100644 tests/endpoint/ssa___excessive_number_of_office_files_copied.test.yml delete mode 100644 tests/endpoint/ssa___first_time_seen_cmd_line.test.yml delete mode 100644 tests/endpoint/ssa___high_file_deletion_frequency.test.yml delete mode 100644 tests/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.test.yml delete mode 100644 tests/endpoint/ssa___illegal_account_creation_via_powersploit_modules.test.yml delete mode 100644 tests/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.test.yml delete mode 100644 tests/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.test.yml delete mode 100644 tests/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.test.yml delete mode 100644 tests/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.test.yml delete mode 100644 tests/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.test.yml delete mode 100644 tests/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.test.yml delete mode 100644 tests/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.test.yml delete mode 100644 tests/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.test.yml delete mode 100644 tests/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.test.yml delete mode 100644 tests/endpoint/ssa___rare_parent_process_relationship_lolbas.test.yml delete mode 100644 tests/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.test.yml delete mode 100644 tests/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.test.yml delete mode 100644 tests/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.test.yml delete mode 100644 tests/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.test.yml delete mode 100644 tests/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.test.yml delete mode 100644 tests/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.test.yml delete mode 100644 tests/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.test.yml delete mode 100644 tests/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.test.yml delete mode 100644 tests/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.test.yml delete mode 100644 tests/endpoint/ssa___recon_connectivity_via_powersploit_modules.test.yml delete mode 100644 tests/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.test.yml delete mode 100644 tests/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.test.yml delete mode 100644 tests/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.test.yml delete mode 100644 tests/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.test.yml delete mode 100644 tests/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.test.yml delete mode 100644 tests/endpoint/ssa___setting_credentials_via_dsinternals_modules.test.yml delete mode 100644 tests/endpoint/ssa___setting_credentials_via_mimikatz_modules.test.yml delete mode 100644 tests/endpoint/ssa___setting_credentials_via_powersploit_modules.test.yml delete mode 100644 tests/endpoint/ssa___unusually_long_command_line.test.yml diff --git a/tests/endpoint/ssa___anomalous_usage_of_account_credentials.test.yml b/tests/endpoint/ssa___anomalous_usage_of_account_credentials.test.yml deleted file mode 100644 index b1c41573f8..0000000000 --- a/tests/endpoint/ssa___anomalous_usage_of_account_credentials.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Anomalous Usage of Account Credentials Unit Test -tests: - - name: Anomalous Usage of Account Credentials - file: endpoint/ssa___anomalous_usage_of_account_credentials.yml - pass_condition: '@count_gt(0)' - description: Test for Anomalous usage of Account Credentials - attack_data: - - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_login/windows-security.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.test.yml deleted file mode 100644 index 594490884c..0000000000 --- a/tests/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Applying Stolen Credentials via Mimikatz modules Unit Test -tests: -- name: Applying Stolen Credentials via Mimikatz modules - file: endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml - description: Test applying stolen credentials detections - pass_condition: '@count_gt(0)' - attack_data: - - file_name: logAllMimikatzModules.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.test.yml b/tests/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.test.yml deleted file mode 100644 index 4271931bd1..0000000000 --- a/tests/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Applying Stolen Credentials via PowerSploit Unit Test -tests: -- name: Applying Stolen Credentials via PowerSploit - file: endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml - pass_condition: '@count_gt(0)' - description: Test applying stolen credentials detections - attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllPowerSploitModulesWithOldNames.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.test.yml b/tests/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.test.yml deleted file mode 100644 index 0515b4f061..0000000000 --- a/tests/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Assessment of Credential Strength via DSInternals modules Unit Test -tests: -- name: Assessment of Credential Strength via DSInternals modules - file: endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml - pass_condition: '@count_gt(0)' - description: Test assessment of credential strength detections - attack_data: - - file_name: logAllDSInternalsModules.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.test.yml b/tests/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.test.yml deleted file mode 100644 index f4a8c78059..0000000000 --- a/tests/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Credential Extraction indicative of use of DSInternals credential conversion - modules Unit Test -tests: -- name: Credential Extraction indicative of use of DSInternals credential conversion - modules - file: endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml - pass_condition: '@count_gt(0)' - description: Test credential extraction detections - attack_data: - - file_name: logAllDSInternalsModules.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___credential_extraction_dsinternals_modules.test.yml b/tests/endpoint/ssa___credential_extraction_dsinternals_modules.test.yml deleted file mode 100644 index d8012c1be0..0000000000 --- a/tests/endpoint/ssa___credential_extraction_dsinternals_modules.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Credential Extraction indicative of use of DSInternals modules Unit Test -tests: -- name: Credential Extraction indicative of use of DSInternals modules - file: endpoint/ssa___credential_extraction_dsinternals_modules.yml - pass_condition: '@count_gt(0)' - description: Test credential extraction detections - attack_data: - - file_name: logAllDSInternalsModules.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.test.yml b/tests/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.test.yml deleted file mode 100644 index 7c4b13c445..0000000000 --- a/tests/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.test.yml +++ /dev/null @@ -1,11 +0,0 @@ -name: Credential Extraction indicative of FGDump and CacheDump with s option Unit - Test -tests: -- name: Credential Extraction indicative of FGDump and CacheDump with s option - file: endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml - pass_condition: '@count_gt(0)' - description: Test credential extraction detections - attack_data: - - file_name: logFgdump.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.test.yml b/tests/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.test.yml deleted file mode 100644 index 6c1e1a9237..0000000000 --- a/tests/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.test.yml +++ /dev/null @@ -1,11 +0,0 @@ -name: Credential Extraction indicative of FGDump and CacheDump with v option Unit - Test -tests: -- name: Credential Extraction indicative of FGDump and CacheDump with v option - file: endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml - pass_condition: '@count_gt(0)' - description: Test credential extraction detections - attack_data: - - file_name: logFgdump.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.test.yml b/tests/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.test.yml deleted file mode 100644 index 75ad019044..0000000000 --- a/tests/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Credential Extraction via Get-ADDBAccount module present in PowerSploit and - DSInternals Unit Test -tests: -- name: Credential Extraction via Get-ADDBAccount module present in PowerSploit and - DSInternals - file: endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml - pass_condition: '@count_gt(0)' - description: Test credential extraction detections - attack_data: - - file_name: logPowerShellModule.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logPowerShellModule.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___credential_extraction_lazagne_command_options.test.yml b/tests/endpoint/ssa___credential_extraction_lazagne_command_options.test.yml deleted file mode 100644 index 627e6fc205..0000000000 --- a/tests/endpoint/ssa___credential_extraction_lazagne_command_options.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Credential Extraction indicative of Lazagne command line options Unit Test -tests: -- name: Credential Extraction indicative of Lazagne command line options - file: endpoint/ssa___credential_extraction_lazagne_command_options.yml - pass_condition: '@count_gt(0)' - description: Test credential extraction detections - attack_data: - - file_name: logLazagneCredDump.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLazagneCredDump.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___credential_extraction_mimikatz_modules.test.yml b/tests/endpoint/ssa___credential_extraction_mimikatz_modules.test.yml deleted file mode 100644 index c08f3ec652..0000000000 --- a/tests/endpoint/ssa___credential_extraction_mimikatz_modules.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Credential Extraction indicative of use of Mimikatz modules Unit Test -tests: -- name: Credential Extraction indicative of use of Mimikatz modules - file: endpoint/ssa___credential_extraction_mimikatz_modules.yml - pass_condition: '@count_gt(0)' - description: Test credential extraction detections - attack_data: - - file_name: logAllMimikatzModules.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.test.yml b/tests/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.test.yml deleted file mode 100644 index 0888a66024..0000000000 --- a/tests/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Credential Extraction native Microsoft debuggers peek into the kernel Unit Test -tests: -- name: Credential Extraction native Microsoft debuggers peek into the kernel - file: endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml - pass_condition: '@count_gt(0)' - description: Test credential extraction detections - attack_data: - - file_name: logLiveKDFullKernelDump.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___credential_extraction_ms_debuggers_z_option.test.yml b/tests/endpoint/ssa___credential_extraction_ms_debuggers_z_option.test.yml deleted file mode 100644 index c2857e2505..0000000000 --- a/tests/endpoint/ssa___credential_extraction_ms_debuggers_z_option.test.yml +++ /dev/null @@ -1,11 +0,0 @@ -name: Credential Extraction native Microsoft debuggers via z command line option Unit - Test -tests: -- name: Credential Extraction native Microsoft debuggers via z command line option - file: endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml - pass_condition: '@count_gt(0)' - description: Test credential extraction detections - attack_data: - - file_name: logLiveKDFullKernelDump.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___credential_extraction_powersploit_modules.test.yml b/tests/endpoint/ssa___credential_extraction_powersploit_modules.test.yml deleted file mode 100644 index 162b4aee46..0000000000 --- a/tests/endpoint/ssa___credential_extraction_powersploit_modules.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Credential Extraction indicative of use of PowerSploit modules Unit Test -tests: -- name: Credential Extraction indicative of use of PowerSploit modules - file: endpoint/ssa___credential_extraction_powersploit_modules.yml - pass_condition: '@count_gt(0)' - description: Test credential extraction detections - attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___detect_kerberoasting.test.yml b/tests/endpoint/ssa___detect_kerberoasting.test.yml deleted file mode 100644 index b59f5cc9db..0000000000 --- a/tests/endpoint/ssa___detect_kerberoasting.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Detect Kerberoasting Unit Test -tests: -- name: Detect Kerberoasting - file: endpoint/ssa___detect_kerberoasting.yml - pass_condition: '@count_eq(0)' - description: Test detection of kerberoasting - attack_data: - - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-security.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.test.yml b/tests/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.test.yml deleted file mode 100644 index 14f8a1a204..0000000000 --- a/tests/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Detect Prohibited Applications Spawning cmd exe Unit Test -tests: -- name: Detect Prohibited Applications Spawning cmd exe - file: endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml - pass_condition: '@count_gt(0)' - description: Detect Prohibited Applications Spawning cmd exe - attack_data: - - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-security.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___excessive_number_of_office_files_copied.test.yml b/tests/endpoint/ssa___excessive_number_of_office_files_copied.test.yml deleted file mode 100644 index b35c7e90bb..0000000000 --- a/tests/endpoint/ssa___excessive_number_of_office_files_copied.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Excessive Number of Office Files Copied Unit Test -tests: -- name: Excessive Number of Office Files Copied - file: endpoint/ssa___excessive_number_of_office_files_copied.yml - pass_condition: '@count_gt(0)' - description: Test for Excessive Number of Office Files Copied - attack_data: - - file_name: sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/mass_file_creation/windows-sysmon.log - source: xmlwineventlog diff --git a/tests/endpoint/ssa___first_time_seen_cmd_line.test.yml b/tests/endpoint/ssa___first_time_seen_cmd_line.test.yml deleted file mode 100644 index f1f5fff00d..0000000000 --- a/tests/endpoint/ssa___first_time_seen_cmd_line.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: First time seen command line argument Unit Test -tests: -- name: First time seen command line argument - file: endpoint/ssa___first_time_seen_cmd_line.yml - pass_condition: '@count_gt(0)' - description: Test detection of first time seen command - attack_data: - - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/cmd_arguments/windows-security.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___high_file_deletion_frequency.test.yml b/tests/endpoint/ssa___high_file_deletion_frequency.test.yml deleted file mode 100644 index 487dca7d23..0000000000 --- a/tests/endpoint/ssa___high_file_deletion_frequency.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: High File Deletion Frequency Unit Test -tests: -- name: High File Deletion Frequency - file: endpoint/ssa___high_file_deletion_frequency.yml - pass_condition: '@count_gt(0)' - description: Test for High File Deletion Frequency - attack_data: - - file_name: sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/excessive_file_deletions/windows-sysmon.log - source: xmlwineventlog diff --git a/tests/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.test.yml b/tests/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.test.yml deleted file mode 100644 index 463143cfc0..0000000000 --- a/tests/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Illegal Access To User Content via PowerSploit modules Unit Test -tests: -- name: Illegal Access To User Content via PowerSploit modules - file: endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml - pass_condition: '@count_gt(0)' - description: Test illegal access to user content detections - attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021/illegal_access_to_content/logAllPowerSploitModulesWithOldNames.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___illegal_account_creation_via_powersploit_modules.test.yml b/tests/endpoint/ssa___illegal_account_creation_via_powersploit_modules.test.yml deleted file mode 100644 index e9fa22c1b8..0000000000 --- a/tests/endpoint/ssa___illegal_account_creation_via_powersploit_modules.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Illegal Account Creation via PowerSploit modules Unit Test -tests: -- name: Illegal Account Creation via PowerSploit modules - file: endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml - pass_condition: '@count_gt(0)' - description: Test illegal account creation detections - attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021/illegal_access_to_content/logAllPowerSploitModulesWithOldNames.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.test.yml b/tests/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.test.yml deleted file mode 100644 index 1fe372f568..0000000000 --- a/tests/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Illegal Enabling or Disabling of Accounts via DSInternals modules Unit Test -tests: -- name: Illegal Enabling or Disabling of Accounts via DSInternals modules - file: endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml - pass_condition: '@count_gt(0)' - description: Test enabling or disabling of accounts detections - attack_data: - - file_name: logAllDSInternalsModules.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.test.yml deleted file mode 100644 index ccbb0e6d23..0000000000 --- a/tests/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Illegal Deletion of Logs via Mimikatz modules Unit Test -tests: -- name: Illegal Deletion of Logs via Mimikatz modules - file: endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml - pass_condition: '@count_gt(0)' - description: Test illegal log deletion detections - attack_data: - - file_name: logAllMimikatzModules.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/illegal_log_deletion/logAllMimikatzModules.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.test.yml b/tests/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.test.yml deleted file mode 100644 index 22467b9ba8..0000000000 --- a/tests/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Illegal Management of Active Directory Elements and Policies via DSInternals - modules Unit Test -tests: -- name: Illegal Management of Active Directory Elements and Policies via DSInternals - modules - file: endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml - pass_condition: '@count_gt(0)' - description: Test illegal management of Active Directory elements and policies detections - attack_data: - - file_name: logAllDSInternalsModules.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/logAllDSInternalsModules.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.test.yml b/tests/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.test.yml deleted file mode 100644 index e61344b2ed..0000000000 --- a/tests/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.test.yml +++ /dev/null @@ -1,13 +0,0 @@ -name: Illegal Management of Computers and Active Directory Elements via PowerSploit - modules Unit Test -tests: -- name: Illegal Management of Computers and Active Directory Elements via PowerSploit - modules - file: endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml - pass_condition: '@count_gt(0)' - description: Test illegal management of computers and Active Directory elements - detections - attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/logAllPowerSploitModulesWithOldNames.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.test.yml b/tests/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.test.yml deleted file mode 100644 index 20676d12dd..0000000000 --- a/tests/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Illegal Privilege Elevation and Persistence via PowerSploit modules Unit Test -tests: -- name: Illegal Privilege Elevation and Persistence via PowerSploit modules - file: endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml - pass_condition: '@count_gt(0)' - description: Test privilege elevation and persistence detections - attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllPowerSploitModulesWithOldNames.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.test.yml deleted file mode 100644 index bd7534441f..0000000000 --- a/tests/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Illegal Privilege Elevation via Mimikatz modules Unit Test -tests: -- name: Illegal Privilege Elevation via Mimikatz modules - file: endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml - pass_condition: '@count_gt(0)' - description: Test illegal privilege elevation detections - attack_data: - - file_name: logAllMimikatzModules.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllMimikatzModules.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.test.yml deleted file mode 100644 index e02ea69da4..0000000000 --- a/tests/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Illegal Service and Process Control via Mimikatz modules Unit Test -tests: -- name: Illegal Service and Process Control via Mimikatz modules - file: endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml - pass_condition: '@count_gt(0)' - description: Test illegal service and process control detections - attack_data: - - file_name: logAllMimikatzModules.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.test.yml b/tests/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.test.yml deleted file mode 100644 index bd5135af23..0000000000 --- a/tests/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Illegal Service and Process Control via PowerSploit modules Unit Test -tests: -- name: Illegal Service and Process Control via PowerSploit modules - file: endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml - pass_condition: '@count_gt(0)' - description: Test illegal service and process control detections - attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.test.yml b/tests/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.test.yml deleted file mode 100644 index 2bc3471079..0000000000 --- a/tests/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Probing Access with Stolen Credentials via PowerSploit modules Unit Test -tests: -- name: Probing Access with Stolen Credentials via PowerSploit modules - file: endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml - pass_condition: '@count_gt(0)' - description: Test access probing with stolen credentials detections - attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___rare_parent_process_relationship_lolbas.test.yml b/tests/endpoint/ssa___rare_parent_process_relationship_lolbas.test.yml deleted file mode 100644 index 5c47e29c1c..0000000000 --- a/tests/endpoint/ssa___rare_parent_process_relationship_lolbas.test.yml +++ /dev/null @@ -1,11 +0,0 @@ -name: Rare Parent-Child Process Relationship Unit Test -tests: -- name: Rare Parent-Child Process Relationship - file: endpoint/ssa___rare_parent_process_relationship_lolbas.yml - pass_condition: '@count_gt(0)' - description: Test detection looking for LOLBAS processes spawned by other processes - that are rarely seen together - attack_data: - - file_name: windows-sec-events.out - data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sec-events.out - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.test.yml b/tests/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.test.yml deleted file mode 100644 index 34560857fd..0000000000 --- a/tests/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.test.yml +++ /dev/null @@ -1,11 +0,0 @@ -name: Reconnaissance of Access and Persistence Opportunities via PowerSploit modules - Unit Test -tests: -- name: Reconnaissance of Access and Persistence Opportunities via PowerSploit modules - file: endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml - pass_condition: '@count_gt(0)' - description: Test reconnaissance of access and persistence detections - attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.test.yml b/tests/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.test.yml deleted file mode 100644 index 9cd82a2d4b..0000000000 --- a/tests/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules - Unit Test -tests: -- name: Reconnaissance and Access to Accounts Groups and Policies via PowerSploit - modules - file: endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml - pass_condition: '@count_gt(0)' - description: Test reconnaissance and access to accounts groups and policies detections - attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.test.yml deleted file mode 100644 index fca8049a95..0000000000 --- a/tests/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Reconnaissance and Access to Accounts and Groups via Mimikatz modules Unit Test -tests: -- name: Reconnaissance and Access to Accounts and Groups via Mimikatz modules - file: endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml - pass_condition: '@count_gt(0)' - description: Test reconnaissance and access to accounts and groups detections - attack_data: - - file_name: logAllMimikatzModules.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.test.yml b/tests/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.test.yml deleted file mode 100644 index b17d9080b7..0000000000 --- a/tests/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit - modules Unit Test -tests: -- name: Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit - modules - file: endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml - pass_condition: '@count_gt(0)' - description: Test reconnaissance and access to active directory infrastrucutre detections - attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.test.yml b/tests/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.test.yml deleted file mode 100644 index 2aef8c9935..0000000000 --- a/tests/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.test.yml +++ /dev/null @@ -1,11 +0,0 @@ -name: Reconnaissance and Access to Computers and Domains via PowerSploit modules Unit - Test -tests: -- name: Reconnaissance and Access to Computers and Domains via PowerSploit modules - file: endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml - pass_condition: '@count_gt(0)' - description: Test reconnaissance and access to computers and domains detections - attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.test.yml deleted file mode 100644 index 7d6fa6c16e..0000000000 --- a/tests/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Reconnaissance and Access to Computers via Mimikatz modules Unit Test -tests: -- name: Reconnaissance and Access to Computers via Mimikatz modules - file: endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml - pass_condition: '@count_gt(0)' - description: Test reconnaissance and access to computers detections - attack_data: - - file_name: logAllMimikatzModules.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.test.yml b/tests/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.test.yml deleted file mode 100644 index fe0761dc7f..0000000000 --- a/tests/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.test.yml +++ /dev/null @@ -1,11 +0,0 @@ -name: Reconnaissance and Access to Operating System Elements via PowerSploit modules - Unit Test -tests: -- name: Reconnaissance and Access to Operating System Elements via PowerSploit modules - file: endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml - pass_condition: '@count_gt(0)' - description: Test reconnaissance and access to operating system element detections - attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.test.yml deleted file mode 100644 index 72b909ee3d..0000000000 --- a/tests/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Reconnaissance and Access to Shared Resources via Mimikatz modules Unit Test -tests: -- name: Reconnaissance and Access to Shared Resources via Mimikatz modules - file: endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml - pass_condition: '@count_gt(0)' - description: Test reconnaissance and access to network shares detections - attack_data: - - file_name: logAllMimikatzModules.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.test.yml b/tests/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.test.yml deleted file mode 100644 index 55d4ea1c17..0000000000 --- a/tests/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Reconnaissance and Access to Shared Resources via PowerSploit modules Unit Test -tests: -- name: Reconnaissance and Access to Shared Resources via PowerSploit modules - file: endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml - pass_condition: '@count_gt(0)' - description: Test reconnaissance and access to shares detections - attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___recon_connectivity_via_powersploit_modules.test.yml b/tests/endpoint/ssa___recon_connectivity_via_powersploit_modules.test.yml deleted file mode 100644 index b8f21445b1..0000000000 --- a/tests/endpoint/ssa___recon_connectivity_via_powersploit_modules.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Reconnaissance of Connectivity via PowerSploit modules Unit Test -tests: -- name: Reconnaissance of Connectivity via PowerSploit modules - file: endpoint/ssa___recon_connectivity_via_powersploit_modules.yml - pass_condition: '@count_gt(0)' - description: Test reconnaissance of connectivity detections - attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.test.yml deleted file mode 100644 index 05d9690b36..0000000000 --- a/tests/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Reconnaissance of Credential Stores and Services via Mimikatz modules Unit Test -tests: -- name: Reconnaissance of Credential Stores and Services via Mimikatz modules - file: endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml - pass_condition: '@count_gt(0)' - description: Test reconnaissance of credential stores and services detections - attack_data: - - file_name: logAllMimikatzModules.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.test.yml b/tests/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.test.yml deleted file mode 100644 index a977aed793..0000000000 --- a/tests/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Reconnaissance of Defensive Tools via PowerSploit modules Unit Test -tests: -- name: Reconnaissance of Defensive Tools via PowerSploit modules - file: endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml - pass_condition: '@count_gt(0)' - description: Test reconnaissance of presence of defensive tools detections - attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.test.yml b/tests/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.test.yml deleted file mode 100644 index 6596416274..0000000000 --- a/tests/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.test.yml +++ /dev/null @@ -1,11 +0,0 @@ -name: Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules - Unit Test -tests: -- name: Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules - file: endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml - pass_condition: '@count_gt(0)' - description: Test reconnaissance of privilege escalations opportunities detections - attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.test.yml deleted file mode 100644 index 9eeff4f292..0000000000 --- a/tests/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules - Unit Test -tests: -- name: Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz - modules - file: endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml - pass_condition: '@count_gt(0)' - description: Test reconnaissance of process or service hijacking detections - attack_data: - - file_name: logAllMimikatzModules.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.test.yml deleted file mode 100644 index c99b8f59e3..0000000000 --- a/tests/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.test.yml +++ /dev/null @@ -1,11 +0,0 @@ -name: Reconnaissance and Access to Processes and Services via Mimikatz modules Unit - Test -tests: -- name: Reconnaissance and Access to Processes and Services via Mimikatz modules - file: endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml - pass_condition: '@count_gt(0)' - description: Test reconnaissance of processes and services detections - attack_data: - - file_name: logAllMimikatzModules.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___setting_credentials_via_dsinternals_modules.test.yml b/tests/endpoint/ssa___setting_credentials_via_dsinternals_modules.test.yml deleted file mode 100644 index 769d1e23a8..0000000000 --- a/tests/endpoint/ssa___setting_credentials_via_dsinternals_modules.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Setting Credentials via DSInternals modules Unit Test -tests: -- name: Setting Credentials via DSInternals modules - file: endpoint/ssa___setting_credentials_via_dsinternals_modules.yml - pass_condition: '@count_gt(0)' - description: Test illegal credential setting detections - attack_data: - - file_name: logAllDSInternalsModules.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___setting_credentials_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___setting_credentials_via_mimikatz_modules.test.yml deleted file mode 100644 index 8e83c1151f..0000000000 --- a/tests/endpoint/ssa___setting_credentials_via_mimikatz_modules.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Setting Credentials via Mimikatz modules Unit Test -tests: -- name: Setting Credentials via Mimikatz modules - file: endpoint/ssa___setting_credentials_via_mimikatz_modules.yml - pass_condition: '@count_gt(0)' - description: Test illegal credential setting detections - attack_data: - - file_name: logAllMimikatzModules.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___setting_credentials_via_powersploit_modules.test.yml b/tests/endpoint/ssa___setting_credentials_via_powersploit_modules.test.yml deleted file mode 100644 index 50f0d1dd30..0000000000 --- a/tests/endpoint/ssa___setting_credentials_via_powersploit_modules.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Setting Credentials via PowerSploit modules Unit Test -tests: -- name: Setting Credentials via PowerSploit modules - file: endpoint/ssa___setting_credentials_via_powersploit_modules.yml - pass_condition: '@count_gt(0)' - description: Test illegal credential setting detections - attack_data: - - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log - source: WinEventLog:Security diff --git a/tests/endpoint/ssa___unusually_long_command_line.test.yml b/tests/endpoint/ssa___unusually_long_command_line.test.yml deleted file mode 100644 index b16dddf7ce..0000000000 --- a/tests/endpoint/ssa___unusually_long_command_line.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Unusually Long Command Line Unit Test -tests: -- name: Unusually Long Command Line - file: endpoint/ssa___unusually_long_command_line.yml - pass_condition: '@count_gt(0)' - description: Test unusually long command lines - attack_data: - - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/unusally_cmd_line/windows-security.log - source: WinEventLog:Security