From 742a34eefb85a18d08204f2eb8fe7a52db435f92 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 24 May 2023 10:11:41 +0200 Subject: [PATCH] iceid_dfir_coverage --- detections/endpoint/network_share_discovery_via_dir_command.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/network_share_discovery_via_dir_command.yml b/detections/endpoint/network_share_discovery_via_dir_command.yml index 4e4153caac..a82033348a 100644 --- a/detections/endpoint/network_share_discovery_via_dir_command.yml +++ b/detections/endpoint/network_share_discovery_via_dir_command.yml @@ -62,6 +62,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/net_share_discovery_via_dir/smbaccess-5140-security-xml2.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/net_share_discovery_via_dir/smb_access_security.log source: WinEventLog:Security sourcetype: WinEventLog