Branch was auto-updated.

.github/workflows/auto-approve.yml

@@ -1,11 +1,15 @@
-name: auto-approve
-on: pull_request
+name: Auto approve PRs by dependabot
+
+# Trigger the workflow on pull request
+on: pull_request_target
 
 jobs:
-  build:
+  autoapprove:
+    name: Auto-Approve a PR by dependabot
     runs-on: ubuntu-latest
     steps:
-    - uses: hmarr/auto-approve-action@v2.0.0
-      if: github.actor == 'dependabot[bot]' || github.actor == 'dependabot-preview[bot]'
-      with:
-        github-token: "${{ secrets.GITHUB_TOKEN }}"
+      - name: Auto approve
+        uses: cognitedata/auto-approve-dependabot-action@v3.0.1
+        if: github.actor == 'dependabot[bot]' || github.actor == 'dependabot-preview[bot]'
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}

automated_detection_testing/requirements.txt

@@ -38,7 +38,7 @@ MarkupSafe==2.0.1
 mock==4.0.3
 more-itertools==8.7.0
 nodeenv==1.6.0
-mysql-connector-python==8.0.25
+mysql-connector-python==8.0.26
 ntlm-auth==1.5.0
 packaging==21.0
 path==15.1.2
@@ -79,3 +79,4 @@ wget==3.2
 wrapt==1.12.1
 xmltodict==0.12.0
 zipp==3.4.1
+

detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml

@@ -0,0 +1,73 @@
+name: Get ADDefaultDomainPasswordPolicy with Powershell
+id: 36e46ebe-065a-11ec-b4c7-acde48001122
+version: 1
+date: '2021-08-26'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy.
+  This command can be used by attacker to mapped all password policy in a target host.
+  This command may cause some noise especially in admin user that can execute this
+  for policy audit. This hunting query is a good pivot to start investigating possible
+  lateral movement or credential dumping as post attack.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
+  OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADDefaultDomainPasswordPolicy*"
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `get_addefaultdomainpasswordpolicy_with_powershell_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: network operator may use this command
+references:
+- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1201
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
+  security_domain: endpoint
+  impact: 30
+  confidence: 30
+  risk_score: 9
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: an instance of process $process_name$ with commandline $process$ in $dest$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  automated_detection_testing: passed
+  

detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml

@@ -0,0 +1,61 @@
+name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block
+id: 1ff7ccc8-065a-11ec-91e4-acde48001122
+version: 1
+date: '2021-08-26'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy.
+  This command can be used by attacker to mapped all password policy in a target host.
+  This command may cause some noise especially in admin user that can execute this
+  for policy audit. This hunting query is a good pivot to start investigating possible
+  lateral movement or credential dumping as post attack.
+search: '`powershell` EventCode=4104 Message ="*Get-ADDefaultDomainPasswordPolicy*"
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
+  ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter`'
+how_to_implement: The following Hunting analytic requires PowerShell operational logs
+  to be imported. Modify the powershell macro as needed to match the sourcetype or
+  add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
+known_false_positives: network operator may use this command
+references:
+- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1201
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  impact: 30
+  confidence: 30
+  risk_score: 9
+  context:
+  - source:endpoint
+  - stage:Reconnaissance
+  message: powershell process having commandline $Message$ to query domain password
+    policy
+  observable:
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml

@@ -0,0 +1,72 @@
+name: Get ADUserResultantPasswordPolicy with Powershell
+id: 8b5ef342-065a-11ec-b0fc-acde48001122
+version: 1
+date: '2021-08-26'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy.
+  This command can be used by attacker to mapped all password policy in a target host.
+  This command may cause some noise especially in admin user that can execute this
+  for policy audit. This hunting query is a good pivot to start investigating possible
+  lateral movement or credential dumping as post attack.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
+  OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADUserResultantPasswordPolicy*"
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `get_aduserresultantpasswordpolicy_with_powershell_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: network operator or admin may use this command
+references:
+- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1201
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
+  security_domain: endpoint
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: an instance of process $process_name$ with commandline $process$ in $dest$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  automated_detection_testing: passed

detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml

@@ -0,0 +1,61 @@
+name: Get ADUserResultantPasswordPolicy with Powershell Script Block
+id: 737e1eb0-065a-11ec-921a-acde48001122
+version: 1
+date: '2021-08-26'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy.
+  This command can be used by attacker to mapped all password policy in a target host.
+  This command may cause some noise especially in admin user that can execute this
+  for policy audit. This hunting query is a good pivot to start investigating possible
+  lateral movement or credential dumping as post attack.
+search: '`powershell` EventCode=4104 Message ="*Get-ADUserResultantPasswordPolicy*"
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
+  ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `get_aduserresultantpasswordpolicy_with_powershell_script_block_filter`'
+how_to_implement: The following Hunting analytic requires PowerShell operational logs
+  to be imported. Modify the powershell macro as needed to match the sourcetype or
+  add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
+known_false_positives: network operator may use this command
+references:
+- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1201
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  impact: 30
+  confidence: 30
+  risk_score: 9
+  context:
+  - source:endpoint
+  - stage:Reconnaissance
+  message: powershell process having commandline $Message$ to query domain user password
+    policy.
+  observable:
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/get_domainpolicy_with_powershell.yml

@@ -0,0 +1,71 @@
+name: Get DomainPolicy with Powershell
+id: b8f9947e-065a-11ec-aafb-acde48001122
+version: 1
+date: '2021-08-26'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search is to detect a possible execution of powerview pentesting
+  tool for domain controller recon. This search look for function Get-DomainPolicy
+  to parse the domain policy of the targeted host. This TTP may be a good pivot to
+  look for credential dumping technique or lateral movement.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe"
+  OR Processes.process_name="powershell*") AND Processes.process = "*Get-DomainPolicy*"
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `get_domainpolicy_with_powershell_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: network operator or admin may use this command
+references:
+- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1201
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
+  security_domain: endpoint
+  impact: 50
+  confidence: 60
+  risk_score: 30
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: an instance of process $process_name$ with commandline $process$ in $dest$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  automated_detection_testing: passed

detections/endpoint/get_domainpolicy_with_powershell_script_block.yml

@@ -0,0 +1,58 @@
+name: Get DomainPolicy with Powershell Script Block
+id: a360d2b2-065a-11ec-b0bf-acde48001122
+version: 1
+date: '2021-08-26'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: This search is to detect a possible execution of powerview pentesting
+  tool for domain controller recon. This search look for function Get-DomainPolicy
+  to parse the domain policy of the targeted host. This TTP may be a good pivot to
+  look for credential dumping technique or lateral movement.
+search: '`powershell` EventCode=4104 Message ="*Get-DomainPolicy*" | stats count min(_time)
+  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `get_domainpolicy_with_powershell_script_block_filter`'
+how_to_implement: The following Hunting analytic requires PowerShell operational logs
+  to be imported. Modify the powershell macro as needed to match the sourcetype or
+  add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
+known_false_positives: unknown
+references:
+- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1201
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  impact: 50
+  confidence: 60
+  risk_score: 30
+  context:
+  - source:endpoint
+  - stage:Reconnaissance
+  message: powershell process having commandline $Message$ to query domain policy.
+  observable:
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim
+  automated_detection_testing: passed

detections/endpoint/password_policy_discovery_with_net.yml

@@ -0,0 +1,72 @@
+name: Password Policy Discovery with Net
+id: 09336538-065a-11ec-8665-acde48001122
+version: 1
+date: '2021-08-26'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: This search is to detect a net application command to discover password
+  policy. This commandline can be used by IT and admin to list all account domain
+  policy but also can be use by attacker as part of recon. this hunting query can
+  be a good pivot to locate credential dumping or lateral movement as part of post
+  attack.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe"
+  OR Processes.process_name="net1.exe") AND Processes.process = "*accounts*" AND Processes.process
+  = "*/domain*" by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `password_policy_discovery_with_net_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: network operator or admin may use this command
+references:
+- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
+tags:
+  analytic_story:
+  - Active Directory Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log
+  kill_chain_phases:
+  - Reconnaissance
+  mitre_attack_id:
+  - T1201
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_id
+  - Processes.parent_process_name
+  security_domain: endpoint
+  impact: 30
+  confidence: 30
+  risk_score: 9
+  context:
+  - Source:Endpoint
+  - Stage:Reconnaissance
+  message: an instance of process $process_name$ with commandline $process$ in $dest$
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  - name: parent_process_name
+    type: Parent Process
+    role:
+    - Parent Process
+  automated_detection_testing: passed

tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.test.yml

@@ -0,0 +1,12 @@
+name: Get ADDefaultDomainPasswordPolicy with Powershell Unit Test
+tests:
+- name: Get ADDefaultDomainPasswordPolicy with Powershell
+  file: endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml

@@ -0,0 +1,12 @@
+name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block Unit Test
+tests:
+- name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block
+  file: endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog

tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml

@@ -0,0 +1,12 @@
+name: Get ADUserResultantPasswordPolicy with Powershell Unit Test
+tests:
+- name: Get ADUserResultantPasswordPolicy with Powershell 
+  file: endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml

@@ -0,0 +1,12 @@
+name: Get ADUserResultantPasswordPolicy with Powershell Script Block Unit Test
+tests:
+- name: Get ADUserResultantPasswordPolicy with Powershell Script Block
+  file: endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog

tests/endpoint/get_domainpolicy_with_powershell.test.yml

@@ -0,0 +1,12 @@
+name: Get DomainPolicy with Powershell Unit Test
+tests:
+- name: Get DomainPolicy with Powershell
+  file: endpoint/get_domainpolicy_with_powershell.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml

@@ -0,0 +1,12 @@
+name: Get DomainPolicy with Powershell Script Block Unit Test
+tests:
+- name: Get DomainPolicy with Powershell Script Block
+  file: endpoint/get_domainpolicy_with_powershell_script_block.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog

tests/endpoint/password_policy_discovery_with_net.test.yml

@@ -0,0 +1,12 @@
+name: Password Policy Discovery with Net Unit Test
+tests:
+- name: Password Policy Discovery with Net
+  file: endpoint/password_policy_discovery_with_net.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog