From 75b8c1a03d680f40fdff568eec956ccda8704dbb Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 17 Feb 2021 10:09:38 -0800 Subject: [PATCH] _timeupdate --- ...tect_path_interception_by_creation_of_program_exe.test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/endpoint/detect_path_interception_by_creation_of_program_exe.test.yml b/tests/endpoint/detect_path_interception_by_creation_of_program_exe.test.yml index 040deaff7d..53f7ced227 100644 --- a/tests/endpoint/detect_path_interception_by_creation_of_program_exe.test.yml +++ b/tests/endpoint/detect_path_interception_by_creation_of_program_exe.test.yml @@ -2,8 +2,8 @@ name: Detect Path Interception By Creation Of program exe Unit Test tests: - name: Detect Path Interception By Creation Of program exe file: endpoint/detect_path_interception_by_creation_of_program_exe.yml - pass_condition: '| stats count | where count = 1' - earliest_time: '-24h' + pass_condition: '| stats count | where count > 0' + earliest_time: '-7d' latest_time: 'now' attack_data: - file_name: windows-sysmon.log