diff --git a/tests/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.test.yml b/tests/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.test.yml index dc0e53e26f..f572408a4d 100644 --- a/tests/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.test.yml +++ b/tests/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.test.yml @@ -6,4 +6,7 @@ tests: description: Test credential extraction detections attack_data: - file_name: logFgdump.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logFgdump.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log + source: WinEventLog:Security + sourcetype: xmlwineventlog + update_timestamp: True \ No newline at end of file diff --git a/tests/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.test.yml b/tests/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.test.yml index 3c173cc10f..4e8e29d7cc 100644 --- a/tests/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.test.yml +++ b/tests/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.test.yml @@ -6,5 +6,7 @@ tests: description: Test credential extraction detections attack_data: - file_name: logPowerShellModule.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logPowerShellModule.log - + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logPowerShellModule.log + source: WinEventLog:Security + sourcetype: xmlwineventlog + update_timestamp: True diff --git a/tests/endpoint/ssa___credential_extraction_lazagne_command_options.test.yml b/tests/endpoint/ssa___credential_extraction_lazagne_command_options.test.yml index d4c9e06189..18ebe75967 100644 --- a/tests/endpoint/ssa___credential_extraction_lazagne_command_options.test.yml +++ b/tests/endpoint/ssa___credential_extraction_lazagne_command_options.test.yml @@ -6,5 +6,7 @@ tests: description: Test credential extraction detections attack_data: - file_name: logLazagneCredDump.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logLazagneCredDump.log - + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLazagneCredDump.log + source: WinEventLog:Security + sourcetype: xmlwineventlog + update_timestamp: True diff --git a/tests/endpoint/ssa___credential_extraction_mimikatz_modules.test.yml b/tests/endpoint/ssa___credential_extraction_mimikatz_modules.test.yml index e460bc3757..262e694420 100644 --- a/tests/endpoint/ssa___credential_extraction_mimikatz_modules.test.yml +++ b/tests/endpoint/ssa___credential_extraction_mimikatz_modules.test.yml @@ -6,5 +6,8 @@ tests: description: Test credential extraction detections attack_data: - file_name: logAllMimikatzModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log + source: WinEventLog:Security + sourcetype: xmlwineventlog + update_timestamp: True diff --git a/tests/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.test.yml b/tests/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.test.yml index 3b1d98728d..5969a15fd8 100644 --- a/tests/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.test.yml +++ b/tests/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.test.yml @@ -6,5 +6,7 @@ tests: description: Test credential extraction detections attack_data: - file_name: logLiveKDFullKernelDump.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logLiveKDFullKernelDump.log - + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log + source: WinEventLog:Security + sourcetype: xmlwineventlog + update_timestamp: True diff --git a/tests/endpoint/ssa___credential_extraction_ms_debuggers_z_option.test.yml b/tests/endpoint/ssa___credential_extraction_ms_debuggers_z_option.test.yml index f7d02548e6..a9d5d4b648 100644 --- a/tests/endpoint/ssa___credential_extraction_ms_debuggers_z_option.test.yml +++ b/tests/endpoint/ssa___credential_extraction_ms_debuggers_z_option.test.yml @@ -6,5 +6,7 @@ tests: description: Test credential extraction detections attack_data: - file_name: logLiveKDFullKernelDump.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logLiveKDFullKernelDump.log - + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log + source: WinEventLog:Security + sourcetype: xmlwineventlog + update_timestamp: True diff --git a/tests/endpoint/ssa___credential_extraction_powersploit_modules.test.yml b/tests/endpoint/ssa___credential_extraction_powersploit_modules.test.yml index c0dc7b4ab3..c238c25b02 100644 --- a/tests/endpoint/ssa___credential_extraction_powersploit_modules.test.yml +++ b/tests/endpoint/ssa___credential_extraction_powersploit_modules.test.yml @@ -6,5 +6,7 @@ tests: description: Test credential extraction detections attack_data: - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log - + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log + source: WinEventLog:Security + sourcetype: xmlwineventlog + update_timestamp: True