admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

iceid_dfir_coverage

Browse Source
This commit is contained in:
tccontre
2023-05-24 10:11:41 +02:00
parent 849a0885df
commit 742a34eefb
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/network_share_discovery_via_dir_command.yml
+1 -1
View File
@@ -62,6 +62,6 @@ tags:
tests:
- name: True Positive Test
attack_data:
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/net_share_discovery_via_dir/smbaccess-5140-security-xml2.log
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/net_share_discovery_via_dir/smb_access_security.log
source: WinEventLog:Security
sourcetype: WinEventLog