diff --git a/.github/workflows/auto-approve.yml b/.github/workflows/auto-approve.yml index c149be16e8..ea7cb9209f 100644 --- a/.github/workflows/auto-approve.yml +++ b/.github/workflows/auto-approve.yml @@ -1,11 +1,15 @@ -name: auto-approve -on: pull_request +name: Auto approve PRs by dependabot + +# Trigger the workflow on pull request +on: pull_request_target jobs: - build: + autoapprove: + name: Auto-Approve a PR by dependabot runs-on: ubuntu-latest steps: - - uses: hmarr/auto-approve-action@v2.0.0 - if: github.actor == 'dependabot[bot]' || github.actor == 'dependabot-preview[bot]' - with: - github-token: "${{ secrets.GITHUB_TOKEN }}" + - name: Auto approve + uses: cognitedata/auto-approve-dependabot-action@v3.0.1 + if: github.actor == 'dependabot[bot]' || github.actor == 'dependabot-preview[bot]' + with: + github-token: ${{ secrets.GITHUB_TOKEN }} \ No newline at end of file diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 5182fa1312..204eeb14aa 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -38,7 +38,7 @@ MarkupSafe==2.0.1 mock==4.0.3 more-itertools==8.7.0 nodeenv==1.6.0 -mysql-connector-python==8.0.25 +mysql-connector-python==8.0.26 ntlm-auth==1.5.0 packaging==21.0 path==15.1.2 @@ -79,3 +79,4 @@ wget==3.2 wrapt==1.12.1 xmltodict==0.12.0 zipp==3.4.1 + diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml new file mode 100644 index 0000000000..3c7fd85f4c --- /dev/null +++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml @@ -0,0 +1,73 @@ +name: Get ADDefaultDomainPasswordPolicy with Powershell +id: 36e46ebe-065a-11ec-b4c7-acde48001122 +version: 1 +date: '2021-08-26' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy. + This command can be used by attacker to mapped all password policy in a target host. + This command may cause some noise especially in admin user that can execute this + for policy audit. This hunting query is a good pivot to start investigating possible + lateral movement or credential dumping as post attack. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" + OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADDefaultDomainPasswordPolicy*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `get_addefaultdomainpasswordpolicy_with_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: network operator may use this command +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1201 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 30 + confidence: 30 + risk_score: 9 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + automated_detection_testing: passed + diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml new file mode 100644 index 0000000000..4493f83d9e --- /dev/null +++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml @@ -0,0 +1,61 @@ +name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block +id: 1ff7ccc8-065a-11ec-91e4-acde48001122 +version: 1 +date: '2021-08-26' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy. + This command can be used by attacker to mapped all password policy in a target host. + This command may cause some noise especially in admin user that can execute this + for policy audit. This hunting query is a good pivot to start investigating possible + lateral movement or credential dumping as post attack. +search: '`powershell` EventCode=4104 Message ="*Get-ADDefaultDomainPasswordPolicy*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message + ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `get_addefaultdomainpasswordpolicy_with_powershell_script_block_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: network operator may use this command +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1201 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 30 + confidence: 30 + risk_score: 9 + context: + - source:endpoint + - stage:Reconnaissance + message: powershell process having commandline $Message$ to query domain password + policy + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml new file mode 100644 index 0000000000..ad490becb3 --- /dev/null +++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml @@ -0,0 +1,72 @@ +name: Get ADUserResultantPasswordPolicy with Powershell +id: 8b5ef342-065a-11ec-b0fc-acde48001122 +version: 1 +date: '2021-08-26' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy. + This command can be used by attacker to mapped all password policy in a target host. + This command may cause some noise especially in admin user that can execute this + for policy audit. This hunting query is a good pivot to start investigating possible + lateral movement or credential dumping as post attack. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" + OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADUserResultantPasswordPolicy*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `get_aduserresultantpasswordpolicy_with_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: network operator or admin may use this command +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1201 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 50 + confidence: 50 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + automated_detection_testing: passed diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml new file mode 100644 index 0000000000..6dd5fd9fbb --- /dev/null +++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml @@ -0,0 +1,61 @@ +name: Get ADUserResultantPasswordPolicy with Powershell Script Block +id: 737e1eb0-065a-11ec-921a-acde48001122 +version: 1 +date: '2021-08-26' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy. + This command can be used by attacker to mapped all password policy in a target host. + This command may cause some noise especially in admin user that can execute this + for policy audit. This hunting query is a good pivot to start investigating possible + lateral movement or credential dumping as post attack. +search: '`powershell` EventCode=4104 Message ="*Get-ADUserResultantPasswordPolicy*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message + ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `get_aduserresultantpasswordpolicy_with_powershell_script_block_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: network operator may use this command +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1201 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 30 + confidence: 30 + risk_score: 9 + context: + - source:endpoint + - stage:Reconnaissance + message: powershell process having commandline $Message$ to query domain user password + policy. + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/get_domainpolicy_with_powershell.yml b/detections/endpoint/get_domainpolicy_with_powershell.yml new file mode 100644 index 0000000000..133acaf599 --- /dev/null +++ b/detections/endpoint/get_domainpolicy_with_powershell.yml @@ -0,0 +1,71 @@ +name: Get DomainPolicy with Powershell +id: b8f9947e-065a-11ec-aafb-acde48001122 +version: 1 +date: '2021-08-26' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a possible execution of powerview pentesting + tool for domain controller recon. This search look for function Get-DomainPolicy + to parse the domain policy of the targeted host. This TTP may be a good pivot to + look for credential dumping technique or lateral movement. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" + OR Processes.process_name="powershell*") AND Processes.process = "*Get-DomainPolicy*" + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `get_domainpolicy_with_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: network operator or admin may use this command +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1201 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 50 + confidence: 60 + risk_score: 30 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + automated_detection_testing: passed diff --git a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml new file mode 100644 index 0000000000..f0f5889b81 --- /dev/null +++ b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml @@ -0,0 +1,58 @@ +name: Get DomainPolicy with Powershell Script Block +id: a360d2b2-065a-11ec-b0bf-acde48001122 +version: 1 +date: '2021-08-26' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: This search is to detect a possible execution of powerview pentesting + tool for domain controller recon. This search look for function Get-DomainPolicy + to parse the domain policy of the targeted host. This TTP may be a good pivot to + look for credential dumping technique or lateral movement. +search: '`powershell` EventCode=4104 Message ="*Get-DomainPolicy*" | stats count min(_time) + as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `get_domainpolicy_with_powershell_script_block_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: unknown +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1201 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 50 + confidence: 60 + risk_score: 30 + context: + - source:endpoint + - stage:Reconnaissance + message: powershell process having commandline $Message$ to query domain policy. + observable: + - name: ComputerName + type: Hostname + role: + - Victim + - name: User + type: User + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/password_policy_discovery_with_net.yml b/detections/endpoint/password_policy_discovery_with_net.yml new file mode 100644 index 0000000000..0ba6d0f025 --- /dev/null +++ b/detections/endpoint/password_policy_discovery_with_net.yml @@ -0,0 +1,72 @@ +name: Password Policy Discovery with Net +id: 09336538-065a-11ec-8665-acde48001122 +version: 1 +date: '2021-08-26' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: This search is to detect a net application command to discover password + policy. This commandline can be used by IT and admin to list all account domain + policy but also can be use by attacker as part of recon. this hunting query can + be a good pivot to locate credential dumping or lateral movement as part of post + attack. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" + OR Processes.process_name="net1.exe") AND Processes.process = "*accounts*" AND Processes.process + = "*/domain*" by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `password_policy_discovery_with_net_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: network operator or admin may use this command +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1201 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + - Processes.parent_process_name + security_domain: endpoint + impact: 30 + confidence: 30 + risk_score: 9 + context: + - Source:Endpoint + - Stage:Reconnaissance + message: an instance of process $process_name$ with commandline $process$ in $dest$ + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + automated_detection_testing: passed diff --git a/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.test.yml b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.test.yml new file mode 100644 index 0000000000..40479d3a9a --- /dev/null +++ b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.test.yml @@ -0,0 +1,12 @@ +name: Get ADDefaultDomainPasswordPolicy with Powershell Unit Test +tests: +- name: Get ADDefaultDomainPasswordPolicy with Powershell + file: endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml new file mode 100644 index 0000000000..15b4775f0f --- /dev/null +++ b/tests/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.test.yml @@ -0,0 +1,12 @@ +name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block Unit Test +tests: +- name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block + file: endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml new file mode 100644 index 0000000000..ace51f6c21 --- /dev/null +++ b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_.test.yml @@ -0,0 +1,12 @@ +name: Get ADUserResultantPasswordPolicy with Powershell Unit Test +tests: +- name: Get ADUserResultantPasswordPolicy with Powershell + file: endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml new file mode 100644 index 0000000000..1e9fd7eb85 --- /dev/null +++ b/tests/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.test.yml @@ -0,0 +1,12 @@ +name: Get ADUserResultantPasswordPolicy with Powershell Script Block Unit Test +tests: +- name: Get ADUserResultantPasswordPolicy with Powershell Script Block + file: endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/get_domainpolicy_with_powershell.test.yml b/tests/endpoint/get_domainpolicy_with_powershell.test.yml new file mode 100644 index 0000000000..f484567632 --- /dev/null +++ b/tests/endpoint/get_domainpolicy_with_powershell.test.yml @@ -0,0 +1,12 @@ +name: Get DomainPolicy with Powershell Unit Test +tests: +- name: Get DomainPolicy with Powershell + file: endpoint/get_domainpolicy_with_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml b/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml new file mode 100644 index 0000000000..705eb31b67 --- /dev/null +++ b/tests/endpoint/get_domainpolicy_with_powershell_script_block.test.yml @@ -0,0 +1,12 @@ +name: Get DomainPolicy with Powershell Script Block Unit Test +tests: +- name: Get DomainPolicy with Powershell Script Block + file: endpoint/get_domainpolicy_with_powershell_script_block.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/password_policy_discovery_with_net.test.yml b/tests/endpoint/password_policy_discovery_with_net.test.yml new file mode 100644 index 0000000000..7513d219d9 --- /dev/null +++ b/tests/endpoint/password_policy_discovery_with_net.test.yml @@ -0,0 +1,12 @@ +name: Password Policy Discovery with Net Unit Test +tests: +- name: Password Policy Discovery with Net + file: endpoint/password_policy_discovery_with_net.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file