diff --git a/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml b/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml similarity index 100% rename from detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml rename to detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml diff --git a/tests/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.test.yml b/tests/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.test.yml index 2e37ce8dfe..eb884c968f 100644 --- a/tests/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.test.yml +++ b/tests/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.test.yml @@ -1,6 +1,6 @@ -name: Splunk Persistent XSS in RapidDiag through User Interface Views Unit Test +name: Persistent XSS in RapidDiag through User Interface Views Unit Test tests: - - name: Splunk Persistent XSS in RapidDiag through User Interface Views + - name: Persistent XSS in RapidDiag through User Interface Views file: application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.yml pass_condition: "| stats count | where count > 0" earliest_time: -24h diff --git a/tests/application/splunk_risky_command_abuse_disclosed_february_2023.test.yml b/tests/application/splunk_risky_command_abuse_disclosed_february_2023.test.yml index dc67dca36c..3571b975fc 100644 --- a/tests/application/splunk_risky_command_abuse_disclosed_february_2023.test.yml +++ b/tests/application/splunk_risky_command_abuse_disclosed_february_2023.test.yml @@ -1,6 +1,6 @@ -name: Splunk risky command abuse disclosed february 2023 Unit Test +name: Splunk risky Command Abuse disclosed february 2023 Unit Test tests: - - name: Splunk risky command abuse disclosed february 2023 + - name: Splunk risky Command Abuse disclosed february 2023 file: application/splunk_risky_command_abuse_disclosed_february_2023.yml pass_condition: "| stats count | where count > 0" earliest_time: -24h diff --git a/tests/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.test.yml b/tests/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.test.yml index bb201fe9f9..87b5b1e2ba 100644 --- a/tests/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.test.yml +++ b/tests/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.test.yml @@ -1,6 +1,6 @@ -name: Splunk unnecesary file extensions allowed by lookup table uploads Unit Test +name: Splunk unnecessary file extensions allowed by lookup table uploads Unit Test tests: - - name: Splunk unnecesary file extensions allowed by lookup table uploads + - name: Splunk unnecessary file extensions allowed by lookup table uploads file: application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml pass_condition: "| stats count | where count > 0" earliest_time: -24h diff --git a/tests/application/splunk_xss_via_view.test.yml b/tests/application/splunk_xss_via_view.test.yml index 84048007f7..3cfecc5979 100644 --- a/tests/application/splunk_xss_via_view.test.yml +++ b/tests/application/splunk_xss_via_view.test.yml @@ -1,6 +1,6 @@ -name: Splunk XSS via View +name: Splunk XSS via View Unit Test tests: - - name: Splunk Stored XSS via view module tag layoutPanel attribute + - name: Splunk XSS via View file: application/splunk_xss_via_view.yml pass_condition: "| stats count | where count > 0" earliest_time: -24h diff --git a/tests/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml b/tests/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml index d9c577236c..bb2d421f69 100644 --- a/tests/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml +++ b/tests/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml @@ -1,13 +1,13 @@ -name: Windows AD Replication Request Initiated by User Account Test +name: Windows AD Replication Request Initiated by User Account Unit Test tests: -- name: Windows AD Replication Request Initiated by User Account - file: endpoint/windows_ad_replication_request_initiated_by_user_account.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: windows-security-xml.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log - source: XmlWinEventLog:Security - sourcetype: xmlwineventlog - update_timestamp: true \ No newline at end of file + - name: Windows AD Replication Request Initiated by User Account + file: endpoint/windows_ad_replication_request_initiated_by_user_account.yml + pass_condition: "| stats count | where count > 0" + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security-xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.test.yml b/tests/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.test.yml index 91d9608390..80fa144d8e 100644 --- a/tests/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.test.yml +++ b/tests/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.test.yml @@ -1,14 +1,13 @@ -name: Windows AD Replication Request Initiated from Unsanctioned Location Test +name: Windows AD Replication Request Initiated from Unsanctioned Location Unit Test tests: -- name: Windows AD Replication Request Initiated from Unsanctioned Location - file: endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: windows-security-xml.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log - source: XmlWinEventLog:Security - sourcetype: xmlwineventlog - update_timestamp: true - + - name: Windows AD Replication Request Initiated from Unsanctioned Location + file: endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml + pass_condition: "| stats count | where count > 0" + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security-xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_ad_sid_history_attribute_modified.test.yml b/tests/endpoint/windows_ad_sid_history_attribute_modified.test.yml index 2809d85fdb..d804ec9b46 100644 --- a/tests/endpoint/windows_ad_sid_history_attribute_modified.test.yml +++ b/tests/endpoint/windows_ad_sid_history_attribute_modified.test.yml @@ -1,13 +1,13 @@ -name: Windows AD SID History Attribute Modified +name: Windows AD SID History Attribute Modified Unit Test tests: -- name: Windows AD SID History Attribute Modified - file: endpoint/windows_ad_sid_history_attribute_modified.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134.005/sid_history2/windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog - update_timestamp: true + - name: Windows AD SID History Attribute Modified + file: endpoint/windows_ad_sid_history_attribute_modified.yml + pass_condition: "| stats count | where count > 0" + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134.005/sid_history2/windows-security.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog + update_timestamp: true diff --git a/tests/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.test.yml b/tests/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.test.yml deleted file mode 100644 index 493bf7a4f7..0000000000 --- a/tests/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Windows Multiple Disabled Users Failed To Authenticate W Kerberos Unit Test -tests: -- name: Windows Multiple Disabled Users Failed To Authenticate W Kerberos - file: endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog diff --git a/tests/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.test.yml b/tests/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.test.yml new file mode 100644 index 0000000000..a05a4bfd86 --- /dev/null +++ b/tests/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.test.yml @@ -0,0 +1,12 @@ +name: Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos Unit Test +tests: + - name: Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos + file: endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml + pass_condition: "| stats count | where count > 0" + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog diff --git a/tests/endpoint/windows_powershell_export_certificate.test.yml b/tests/endpoint/windows_powershell_export_certificate.test.yml index 5e9573be3c..844680d2ff 100644 --- a/tests/endpoint/windows_powershell_export_certificate.test.yml +++ b/tests/endpoint/windows_powershell_export_certificate.test.yml @@ -1,13 +1,13 @@ -name: Windows PowerShell Export PfxCertificate Unit Test +name: Windows PowerShell Export Certificate Unit Test tests: -- name: Windows PowerShell Export PfxCertificate - file: endpoint/windows_powershell_export_certificate.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: 4104_export_certificate.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_certificate.log - source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: xmlwineventlog - update_timestamp: true + - name: Windows PowerShell Export Certificate + file: endpoint/windows_powershell_export_certificate.yml + pass_condition: "| stats count | where count > 0" + earliest_time: -24h + latest_time: now + attack_data: + - file_name: 4104_export_certificate.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_certificate.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog + update_timestamp: true