Modified detection and test files to point to new test datasets containing raw multiline Windows events for SSA.

2026-06-08 17:32:49 +00:00 · 2021-02-23 23:48:03 -08:00
parent 5a6e68be32
commit 8632dcfe10
50 changed files with 128 additions and 26 deletions
@@ -31,6 +31,8 @@ tags:
  - CIS 20
  kill_chain_phases:
  - Actions on Objectives
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllMimikatzModules.log 
  mitre_attack_id:
  - T1055
  - T1068
@@ -33,6 +33,8 @@ tags:
  - CIS 20
  kill_chain_phases:
  - Actions on Objectives
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllPowerSploitModulesWithOldNames.log
  mitre_attack_id:
  - T1055
  - T1068
@@ -43,7 +45,7 @@ tags:
  - T1547
  - T1548
  - T1554
-  - T1556
+  - T1555
  - T1558
  nist:
  - PR.AC
@@ -38,6 +38,8 @@ tags:
  - CIS 16
  kill_chain_phases:
  - Actions on Objectives
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log
  mitre_attack_id:
  - T1003
  nist:
@@ -39,6 +39,8 @@ tags:
  - CIS 16
  kill_chain_phases:
  - Actions on Objectives
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log
  mitre_attack_id:
  - T1003
  nist:
@@ -35,6 +35,8 @@ tags:
  - CIS 16
  kill_chain_phases:
  - Actions on Objectives
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log
  mitre_attack_id:
  - T1003
  nist:
@@ -33,6 +33,8 @@ tags:
  - CIS 16
  kill_chain_phases:
  - Actions on Objectives
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log
  mitre_attack_id:
  - T1003
  nist:
@@ -31,6 +31,8 @@ tags:
  - CIS 16
  kill_chain_phases:
  - Actions on Objectives
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logPowerShellModule.log
  mitre_attack_id:
  - T1003
  nist:
@@ -29,6 +29,8 @@ tags:
  - CIS 16
  kill_chain_phases:
  - Actions on Objectives
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLazagneCredDump.log
  mitre_attack_id:
  - T1003
  - T1555
@@ -34,6 +34,8 @@ tags:
  - CIS 16
  kill_chain_phases:
  - Actions on Objectives
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
  mitre_attack_id:
  - T1003
  nist:
@@ -38,6 +38,8 @@ tags:
  - CIS 16
  kill_chain_phases:
  - Actions on Objectives
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log
  mitre_attack_id:
  - T1003
  nist:
@@ -34,6 +34,8 @@ tags:
  - CIS 16
  kill_chain_phases:
  - Actions on Objectives
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log
  mitre_attack_id:
  - T1003
  nist:
@@ -35,6 +35,8 @@ tags:
  - CIS 16
  kill_chain_phases:
  - Actions on Objectives
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
  mitre_attack_id:
  - T1003
  nist:
@@ -33,6 +33,8 @@ tags:
  - CIS 20
  kill_chain_phases:
  - Actions on Objectives
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021/illegal_access_to_content/logAllPowerSploitModulesWithOldNames.log
  mitre_attack_id:
  - T1021
  - T1113
@@ -28,6 +28,8 @@ tags:
  - CIS 20
  kill_chain_phases:
  - Actions on Objectives
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1585/illegal_account_creation/logAllPowerSploitModulesWithOldNames.log
  mitre_attack_id:
  - T1585
  nist:
@@ -29,6 +29,8 @@ tags:
  - CIS 20
  kill_chain_phases:
  - Actions on Objectives
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log
  mitre_attack_id:
  - T1078
  - T1098
@@ -29,6 +29,8 @@ tags:
  - CIS 20
  kill_chain_phases:
  - Actions on Objectives
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/illegal_log_deletion/logAllMimikatzModules.log
  mitre_attack_id:
  - T1070
  nist:
@@ -31,6 +31,8 @@ tags:
  - CIS 20
  kill_chain_phases:
  - Actions on Objectives
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/logAllDSInternalsModules.log
  mitre_attack_id:
  - T1098
  - T1207
@@ -32,6 +32,8 @@ tags:
  - CIS 20
  kill_chain_phases:
  - Actions on Objectives
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/logAllPowerSploitModulesWithOldNames.log
  mitre_attack_id:
  - T1098
  - T1207
@@ -32,6 +32,8 @@ tags:
  - CIS 20
  kill_chain_phases:
  - Actions on Objectives
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllPowerSploitModulesWithOldNames.log
  mitre_attack_id:
  - T1053
  - T1134
@@ -29,6 +29,8 @@ tags:
  - CIS 20
  kill_chain_phases:
  - Actions on Objectives
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllMimikatzModules.log
  mitre_attack_id:
  - T1134
  - T1548
@@ -32,6 +32,8 @@ tags:
  - CIS 20
  kill_chain_phases:
  - Actions on Objectives
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569/logAllMimikatzModules.log
  mitre_attack_id:
  - T1055
  - T1106
@@ -40,6 +40,8 @@ tags:
  - CIS 20
  kill_chain_phases:
  - Actions on Objectives
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569/logAllPowerSploitModulesWithOldNames.log
  mitre_attack_id:
  - T1055
  - T1106
@@ -34,6 +34,8 @@ tags:
  - CIS 20
  kill_chain_phases:
  - Actions on Objectives
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log
  mitre_attack_id:
  - T1068
  - T1078
@@ -29,6 +29,8 @@ tags:
  - CIS 20
  kill_chain_phases:
  - Actions on Objectives
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllMimikatzModules.log
  mitre_attack_id:
  - T1068
  - T1078
@@ -28,6 +28,8 @@ tags:
  - CIS 20
  kill_chain_phases:
  - Actions on Objectives
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllPowerSploitModulesWithOldNames.log
  mitre_attack_id:
  - T1068
  - T1078
@@ -6,5 +6,7 @@ tests:
    pass_condition: '@count_gt(0)'
    attack_data:
      - file_name: logAllMimikatzModules.log
-        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllMimikatzModules.log
+        source: WinEventLog:Security
+        sourcetype: WinEventLog

@@ -6,5 +6,7 @@ tests:
    description: Test applying stolen credentials detections
    attack_data:
      - file_name: logAllPowerSploitModulesWithOldNames.log
-        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllPowerSploitModulesWithOldNames.log
+        source: WinEventLog:Security
+        sourcetype: WinEventLog

@@ -6,5 +6,7 @@ tests:
    description: Test credential extraction detections
    attack_data:
      - file_name: logAllDSInternalsModules.log
-        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log
+        source: WinEventLog:Security
+        sourcetype: WinEventLog

@@ -6,5 +6,7 @@ tests:
    description: Test credential extraction detections
    attack_data:
      - file_name: logAllDSInternalsModules.log
-        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log
+        source: WinEventLog:Security
+        sourcetype: WinEventLog

@@ -6,5 +6,7 @@ tests:
    description: Test credential extraction detections
    attack_data:
      - file_name: logFgdump.log
-        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logFgdump.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log
+        source: WinEventLog:Security
+        sourcetype: WinEventLog

@@ -6,4 +6,7 @@ tests:
    description: Test credential extraction detections
    attack_data:
      - file_name: logFgdump.log
-        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logFgdump.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log
+        source: WinEventLog:Security
+        sourcetype: WinEventLog
+
@@ -6,5 +6,7 @@ tests:
    description: Test credential extraction detections
    attack_data:
      - file_name: logPowerShellModule.log
-        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logPowerShellModule.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logPowerShellModule.log
+        source: WinEventLog:Security
+        sourcetype: WinEventLog

@@ -6,5 +6,7 @@ tests:
    description: Test credential extraction detections
    attack_data:
      - file_name: logLazagneCredDump.log
-        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logLazagneCredDump.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLazagneCredDump.log
+        source: WinEventLog:Security
+        sourcetype: WinEventLog

@@ -6,5 +6,7 @@ tests:
    description: Test credential extraction detections
    attack_data:
      - file_name: logAllMimikatzModules.log
-        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
+        source: WinEventLog:Security
+        sourcetype: WinEventLog

@@ -6,5 +6,7 @@ tests:
    description: Test credential extraction detections
    attack_data:
      - file_name: logLiveKDFullKernelDump.log
-        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logLiveKDFullKernelDump.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log
+        source: WinEventLog:Security
+        sourcetype: WinEventLog

@@ -6,5 +6,7 @@ tests:
    description: Test credential extraction detections
    attack_data:
      - file_name: logLiveKDFullKernelDump.log
-        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logLiveKDFullKernelDump.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log
+        source: WinEventLog:Security
+        sourcetype: WinEventLog

@@ -6,5 +6,7 @@ tests:
    description: Test credential extraction detections
    attack_data:
      - file_name: logAllPowerSploitModulesWithOldNames.log
-        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
+        source: WinEventLog:Security
+        sourcetype: WinEventLog

@@ -6,5 +6,7 @@ tests:
    description: Test illegal access to user content detections
    attack_data:
      - file_name: logAllPowerSploitModulesWithOldNames.log
-        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021/illegal_access_to_content/logAllPowerSploitModulesWithOldNames.log
+        source: WinEventLog:Security
+        sourcetype: WinEventLog

@@ -6,5 +6,7 @@ tests:
    description: Test illegal account creation detections
    attack_data:
      - file_name: logAllPowerSploitModulesWithOldNames.log
-        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1585/illegal_account_creation/logAllPowerSploitModulesWithOldNames.log
+        source: WinEventLog:Security
+        sourcetype: WinEventLog

@@ -6,5 +6,7 @@ tests:
    description: Test enabling or disabling of accounts detections
    attack_data:
      - file_name: logAllDSInternalsModules.log
-        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log
+        source: WinEventLog:Security
+        sourcetype: WinEventLog

@@ -6,5 +6,7 @@ tests:
    description: Test illegal log deletion detections
    attack_data:
      - file_name: logAllMimikatzModules.log
-        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/illegal_log_deletion/logAllMimikatzModules.log
+        source: WinEventLog:Security
+        sourcetype: WinEventLog

@@ -6,4 +6,7 @@ tests:
    description: Test illegal management of Active Directory elements and policies detections
    attack_data:
      - file_name: logAllDSInternalsModules.log
-        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/logAllDSInternalsModules.log
+        source: WinEventLog:Security
+        sourcetype: WinEventLog
+
@@ -6,5 +6,7 @@ tests:
    description: Test illegal management of computers and Active Directory elements detections
    attack_data:
      - file_name: logAllPowerSploitModulesWithOldNames.log
-        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/logAllPowerSploitModulesWithOldNames.log
+        source: WinEventLog:Security
+        sourcetype: WinEventLog

@@ -6,5 +6,7 @@ tests:
    description: Test privilege elevation and persistence detections
    attack_data:
      - file_name: logAllPowerSploitModulesWithOldNames.log
-        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllPowerSploitModulesWithOldNames.log
+        source: WinEventLog:Security
+        sourcetype: WinEventLog

@@ -6,5 +6,7 @@ tests:
    description: Test illegal privilege elevation detections
    attack_data:
      - file_name: logAllMimikatzModules.log
-        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllMimikatzModules.log
+        source: WinEventLog:Security
+        sourcetype: WinEventLog

@@ -6,5 +6,7 @@ tests:
    description: Test illegal service and process control detections
    attack_data:
      - file_name: logAllMimikatzModules.log
-        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569/logAllMimikatzModules.log
+        source: WinEventLog:Security
+        sourcetype: WinEventLog

@@ -6,5 +6,7 @@ tests:
    description: Test illegal service and process control detections
    attack_data:
      - file_name: logAllPowerSploitModulesWithOldNames.log
-        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569/logAllPowerSploitModulesWithOldNames.log
+        source: WinEventLog:Security
+        sourcetype: WinEventLog

@@ -6,5 +6,7 @@ tests:
    description: Test illegal credential setting detections
    attack_data:
      - file_name: logAllDSInternalsModules.log
-        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log
+        source: WinEventLog:Security
+        sourcetype: WinEventLog

@@ -6,5 +6,7 @@ tests:
    description: Test illegal credential setting detections
    attack_data:
      - file_name: logAllMimikatzModules.log
-        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllMimikatzModules.log
+        source: WinEventLog:Security
+        sourcetype: WinEventLog

@@ -6,5 +6,7 @@ tests:
    description: Test illegal credential setting detections
    attack_data:
      - file_name: logAllPowerSploitModulesWithOldNames.log
-        data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllPowerSploitModulesWithOldNames.log
+        source: WinEventLog:Security
+        sourcetype: WinEventLog