From 6a8ca61129dd05f67a809e6fc612640d01c60288 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 22 Mar 2023 11:40:39 -0700 Subject: [PATCH 1/4] Fixing test files that previously had incorrect paths. --- ..._users_failed_to_authenticate_w_kerberos.test.yml | 12 ------------ ...sers_failed_to_authenticate_wth_kerberos.test.yml | 12 ++++++++++++ 2 files changed, 12 insertions(+), 12 deletions(-) delete mode 100644 tests/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.test.yml create mode 100644 tests/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.test.yml diff --git a/tests/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.test.yml b/tests/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.test.yml deleted file mode 100644 index 493bf7a4f7..0000000000 --- a/tests/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Windows Multiple Disabled Users Failed To Authenticate W Kerberos Unit Test -tests: -- name: Windows Multiple Disabled Users Failed To Authenticate W Kerberos - file: endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log - source: XmlWinEventLog:Security - sourcetype: XmlWinEventLog diff --git a/tests/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.test.yml b/tests/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.test.yml new file mode 100644 index 0000000000..a05a4bfd86 --- /dev/null +++ b/tests/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.test.yml @@ -0,0 +1,12 @@ +name: Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos Unit Test +tests: + - name: Windows Multiple Disabled Users Failed To Authenticate Wth Kerberos + file: endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml + pass_condition: "| stats count | where count > 0" + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/purplesharp_disabled_users_kerberos_xml/windows-security.log + source: XmlWinEventLog:Security + sourcetype: XmlWinEventLog From 5cbd93a8d8777d1e8a4ff3b7fb1398cc7ad89184 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 22 Mar 2023 11:42:22 -0700 Subject: [PATCH 2/4] Fixing remaining test files that had incorrect paths. --- ...request_initiated_by_user_account.test.yml | 24 +++++++++--------- ...tiated_from_unsanctioned_location.test.yml | 25 +++++++++---------- ...ad_sid_history_attribute_modified.test.yml | 24 +++++++++--------- ...ows_powershell_export_certificate.test.yml | 24 +++++++++--------- 4 files changed, 48 insertions(+), 49 deletions(-) diff --git a/tests/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml b/tests/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml index d9c577236c..bb2d421f69 100644 --- a/tests/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml +++ b/tests/endpoint/windows_ad_replication_request_initiated_by_user_account.test.yml @@ -1,13 +1,13 @@ -name: Windows AD Replication Request Initiated by User Account Test +name: Windows AD Replication Request Initiated by User Account Unit Test tests: -- name: Windows AD Replication Request Initiated by User Account - file: endpoint/windows_ad_replication_request_initiated_by_user_account.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: windows-security-xml.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log - source: XmlWinEventLog:Security - sourcetype: xmlwineventlog - update_timestamp: true \ No newline at end of file + - name: Windows AD Replication Request Initiated by User Account + file: endpoint/windows_ad_replication_request_initiated_by_user_account.yml + pass_condition: "| stats count | where count > 0" + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security-xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.test.yml b/tests/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.test.yml index 91d9608390..80fa144d8e 100644 --- a/tests/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.test.yml +++ b/tests/endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.test.yml @@ -1,14 +1,13 @@ -name: Windows AD Replication Request Initiated from Unsanctioned Location Test +name: Windows AD Replication Request Initiated from Unsanctioned Location Unit Test tests: -- name: Windows AD Replication Request Initiated from Unsanctioned Location - file: endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: windows-security-xml.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log - source: XmlWinEventLog:Security - sourcetype: xmlwineventlog - update_timestamp: true - + - name: Windows AD Replication Request Initiated from Unsanctioned Location + file: endpoint/windows_ad_replication_request_initiated_from_unsanctioned_location.yml + pass_condition: "| stats count | where count > 0" + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security-xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.006/impacket/windows-security-xml.log + source: XmlWinEventLog:Security + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_ad_sid_history_attribute_modified.test.yml b/tests/endpoint/windows_ad_sid_history_attribute_modified.test.yml index 2809d85fdb..d804ec9b46 100644 --- a/tests/endpoint/windows_ad_sid_history_attribute_modified.test.yml +++ b/tests/endpoint/windows_ad_sid_history_attribute_modified.test.yml @@ -1,13 +1,13 @@ -name: Windows AD SID History Attribute Modified +name: Windows AD SID History Attribute Modified Unit Test tests: -- name: Windows AD SID History Attribute Modified - file: endpoint/windows_ad_sid_history_attribute_modified.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134.005/sid_history2/windows-security.log - source: XmlWinEventLog - sourcetype: XmlWinEventLog - update_timestamp: true + - name: Windows AD SID History Attribute Modified + file: endpoint/windows_ad_sid_history_attribute_modified.yml + pass_condition: "| stats count | where count > 0" + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1134.005/sid_history2/windows-security.log + source: XmlWinEventLog + sourcetype: XmlWinEventLog + update_timestamp: true diff --git a/tests/endpoint/windows_powershell_export_certificate.test.yml b/tests/endpoint/windows_powershell_export_certificate.test.yml index 5e9573be3c..844680d2ff 100644 --- a/tests/endpoint/windows_powershell_export_certificate.test.yml +++ b/tests/endpoint/windows_powershell_export_certificate.test.yml @@ -1,13 +1,13 @@ -name: Windows PowerShell Export PfxCertificate Unit Test +name: Windows PowerShell Export Certificate Unit Test tests: -- name: Windows PowerShell Export PfxCertificate - file: endpoint/windows_powershell_export_certificate.yml - pass_condition: '| stats count | where count > 0' - earliest_time: -24h - latest_time: now - attack_data: - - file_name: 4104_export_certificate.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_certificate.log - source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: xmlwineventlog - update_timestamp: true + - name: Windows PowerShell Export Certificate + file: endpoint/windows_powershell_export_certificate.yml + pass_condition: "| stats count | where count > 0" + earliest_time: -24h + latest_time: now + attack_data: + - file_name: 4104_export_certificate.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_certificate.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog + update_timestamp: true From d0b3b0769ff5994793763c89345786f26a02a38b Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 22 Mar 2023 11:58:25 -0700 Subject: [PATCH 3/4] Fixing wrong naming in test file --- ...ltiple_disabled_users_failed_to_authenticate_wth_kerberos.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename detections/endpoint/{windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml => windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml} (100%) diff --git a/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml b/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml similarity index 100% rename from detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml rename to detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml From 607dd9d4f98b19c76e704ab7d67749b85b21c2db Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Wed, 22 Mar 2023 15:11:28 -0700 Subject: [PATCH 4/4] Fixing more test files that have some incorrect information in them. Updating the name of a detection file to reflect the name field of the detection. --- ...le_disabled_users_failed_to_authenticate_wth_kerberos.yml} | 0 ...ent_xss_in_rapiddiag_through_user_interface_views.test.yml | 4 ++-- ...plunk_risky_command_abuse_disclosed_february_2023.test.yml | 4 ++-- ...y_file_extensions_allowed_by_lookup_table_uploads.test.yml | 4 ++-- tests/application/splunk_xss_via_view.test.yml | 4 ++-- 5 files changed, 8 insertions(+), 8 deletions(-) rename detections/endpoint/{windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml => windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml} (100%) diff --git a/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml b/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml similarity index 100% rename from detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml rename to detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos.yml diff --git a/tests/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.test.yml b/tests/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.test.yml index 2e37ce8dfe..eb884c968f 100644 --- a/tests/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.test.yml +++ b/tests/application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.test.yml @@ -1,6 +1,6 @@ -name: Splunk Persistent XSS in RapidDiag through User Interface Views Unit Test +name: Persistent XSS in RapidDiag through User Interface Views Unit Test tests: - - name: Splunk Persistent XSS in RapidDiag through User Interface Views + - name: Persistent XSS in RapidDiag through User Interface Views file: application/splunk_persistent_xss_in_rapiddiag_through_user_interface_views.yml pass_condition: "| stats count | where count > 0" earliest_time: -24h diff --git a/tests/application/splunk_risky_command_abuse_disclosed_february_2023.test.yml b/tests/application/splunk_risky_command_abuse_disclosed_february_2023.test.yml index dc67dca36c..3571b975fc 100644 --- a/tests/application/splunk_risky_command_abuse_disclosed_february_2023.test.yml +++ b/tests/application/splunk_risky_command_abuse_disclosed_february_2023.test.yml @@ -1,6 +1,6 @@ -name: Splunk risky command abuse disclosed february 2023 Unit Test +name: Splunk risky Command Abuse disclosed february 2023 Unit Test tests: - - name: Splunk risky command abuse disclosed february 2023 + - name: Splunk risky Command Abuse disclosed february 2023 file: application/splunk_risky_command_abuse_disclosed_february_2023.yml pass_condition: "| stats count | where count > 0" earliest_time: -24h diff --git a/tests/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.test.yml b/tests/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.test.yml index bb201fe9f9..87b5b1e2ba 100644 --- a/tests/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.test.yml +++ b/tests/application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.test.yml @@ -1,6 +1,6 @@ -name: Splunk unnecesary file extensions allowed by lookup table uploads Unit Test +name: Splunk unnecessary file extensions allowed by lookup table uploads Unit Test tests: - - name: Splunk unnecesary file extensions allowed by lookup table uploads + - name: Splunk unnecessary file extensions allowed by lookup table uploads file: application/splunk_unnecessary_file_extensions_allowed_by_lookup_table_uploads.yml pass_condition: "| stats count | where count > 0" earliest_time: -24h diff --git a/tests/application/splunk_xss_via_view.test.yml b/tests/application/splunk_xss_via_view.test.yml index 84048007f7..3cfecc5979 100644 --- a/tests/application/splunk_xss_via_view.test.yml +++ b/tests/application/splunk_xss_via_view.test.yml @@ -1,6 +1,6 @@ -name: Splunk XSS via View +name: Splunk XSS via View Unit Test tests: - - name: Splunk Stored XSS via view module tag layoutPanel attribute + - name: Splunk XSS via View file: application/splunk_xss_via_view.yml pass_condition: "| stats count | where count > 0" earliest_time: -24h