From 85f349668cb4f6f65796f57c28757f5b671acdc0 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Fri, 6 Nov 2020 13:43:49 +0100 Subject: [PATCH] new detection testing file --- detections/endpoint/batch_file_write_to_system32.yml | 2 ++ tests/endpoint/batch_file_write_to_system32.test.yml | 10 ++++++++++ 2 files changed, 12 insertions(+) create mode 100644 tests/endpoint/batch_file_write_to_system32.test.yml diff --git a/detections/endpoint/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml index b654a689e7..bb09f13f20 100644 --- a/detections/endpoint/batch_file_write_to_system32.yml +++ b/detections/endpoint/batch_file_write_to_system32.yml @@ -27,6 +27,8 @@ known_false_positives: It is possible for this search to generate a notable even tags: analytics_story: - SamSam Ransomware + mitre_attack_id: + - T1204.002 kill_chain_phases: - Delivery cis20: diff --git a/tests/endpoint/batch_file_write_to_system32.test.yml b/tests/endpoint/batch_file_write_to_system32.test.yml new file mode 100644 index 0000000000..3168d43c5a --- /dev/null +++ b/tests/endpoint/batch_file_write_to_system32.test.yml @@ -0,0 +1,10 @@ +name: Batch File Write to System32 Unit Test +detections: +- name: Batch File Write to System32 + file: endpoint/batch_file_write_to_system32.yml + pass_condition: '| stats count | where count > 0' +attack_data: +- file_name: windows-sysmon.log + data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1204.002_custom_b0162b8c-686d-4d97-83fe-7e80ac679cf4/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog