From 8632dcfe103f4169c07dc7dbdf51742e600d2e0c Mon Sep 17 00:00:00 2001 From: Stanislav Miskovic Date: Tue, 23 Feb 2021 23:48:03 -0800 Subject: [PATCH] Modified detection and test files to point to new test datasets containing raw multiline Windows events for SSA. --- ...sa___applying_stolen_credentials_via_mimikatz_modules.yml | 2 ++ ...__applying_stolen_credentials_via_powersploit_modules.yml | 4 +++- ..._credential_extraction_dsinternals_conversion_modules.yml | 2 ++ .../ssa___credential_extraction_dsinternals_modules.yml | 2 ++ ...ssa___credential_extraction_fgdump_cachedump_s_option.yml | 2 ++ ...ssa___credential_extraction_fgdump_cachedump_v_option.yml | 2 ++ .../ssa___credential_extraction_getaddbaccount_from_dump.yml | 2 ++ .../ssa___credential_extraction_lazagne_command_options.yml | 2 ++ .../ssa___credential_extraction_mimikatz_modules.yml | 2 ++ .../ssa___credential_extraction_ms_debuggers_kernel_peek.yml | 2 ++ .../ssa___credential_extraction_ms_debuggers_z_option.yml | 2 ++ .../ssa___credential_extraction_powersploit_modules.yml | 2 ++ ...__illegal_access_user_content_via_powersploit_modules.yml | 2 ++ ...sa___illegal_account_creation_via_powersploit_modules.yml | 2 ++ ...llegal_account_enable_disable_via_dsinternals_modules.yml | 2 ++ .../ssa___illegal_log_deletion_via_mimikatz_modules.yml | 2 ++ ...ment_AD_elements_and_policies_via_dsinternals_modules.yml | 2 ++ ...ent_computers_and_AD_elements_via_powersploit_modules.yml | 2 ++ ...ege_elevation_and_persistence_via_powersploit_modules.yml | 2 ++ ...sa___illegal_privilege_elevation_via_mimikatz_modules.yml | 2 ++ ...egal_service_and_process_control_via_mimikatz_modules.yml | 2 ++ ...l_service_and_process_control_via_powersploit_modules.yml | 2 ++ .../ssa___setting_credentials_via_dsinternals_modules.yml | 2 ++ .../ssa___setting_credentials_via_mimikatz_modules.yml | 2 ++ .../ssa___setting_credentials_via_powersploit_modules.yml | 2 ++ ...applying_stolen_credentials_via_mimikatz_modules.test.yml | 4 +++- ...lying_stolen_credentials_via_powersploit_modules.test.yml | 4 +++- ...ential_extraction_dsinternals_conversion_modules.test.yml | 4 +++- .../ssa___credential_extraction_dsinternals_modules.test.yml | 4 +++- ..._credential_extraction_fgdump_cachedump_s_option.test.yml | 4 +++- ..._credential_extraction_fgdump_cachedump_v_option.test.yml | 5 ++++- ...__credential_extraction_getaddbaccount_from_dump.test.yml | 4 +++- ...___credential_extraction_lazagne_command_options.test.yml | 4 +++- .../ssa___credential_extraction_mimikatz_modules.test.yml | 4 +++- ...__credential_extraction_ms_debuggers_kernel_peek.test.yml | 4 +++- ...sa___credential_extraction_ms_debuggers_z_option.test.yml | 4 +++- .../ssa___credential_extraction_powersploit_modules.test.yml | 4 +++- ...egal_access_user_content_via_powersploit_modules.test.yml | 4 +++- ...illegal_account_creation_via_powersploit_modules.test.yml | 4 +++- ...l_account_enable_disable_via_dsinternals_modules.test.yml | 4 +++- .../ssa___illegal_log_deletion_via_mimikatz_modules.test.yml | 4 +++- ...AD_elements_and_policies_via_dsinternals_modules.test.yml | 5 ++++- ...omputers_and_AD_elements_via_powersploit_modules.test.yml | 4 +++- ...levation_and_persistence_via_powersploit_modules.test.yml | 4 +++- ...illegal_privilege_elevation_via_mimikatz_modules.test.yml | 4 +++- ...service_and_process_control_via_mimikatz_modules.test.yml | 4 +++- ...vice_and_process_control_via_powersploit_modules.test.yml | 4 +++- ...sa___setting_credentials_via_dsinternals_modules.test.yml | 4 +++- .../ssa___setting_credentials_via_mimikatz_modules.test.yml | 4 +++- ...sa___setting_credentials_via_powersploit_modules.test.yml | 4 +++- 50 files changed, 128 insertions(+), 26 deletions(-) diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml index a9ef52f8a6..b652e0e507 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml @@ -31,6 +31,8 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllMimikatzModules.log mitre_attack_id: - T1055 - T1068 diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml index ff9570b530..c0fe207cd5 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml @@ -33,6 +33,8 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllPowerSploitModulesWithOldNames.log mitre_attack_id: - T1055 - T1068 @@ -43,7 +45,7 @@ tags: - T1547 - T1548 - T1554 - - T1556 + - T1555 - T1558 nist: - PR.AC diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml index 15a818e898..e3662298b1 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml @@ -38,6 +38,8 @@ tags: - CIS 16 kill_chain_phases: - Actions on Objectives + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log mitre_attack_id: - T1003 nist: diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml index 6eb4d35391..7f2b9dd4d2 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml @@ -39,6 +39,8 @@ tags: - CIS 16 kill_chain_phases: - Actions on Objectives + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log mitre_attack_id: - T1003 nist: diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml index 66165baa8a..d74a8fb91f 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml @@ -35,6 +35,8 @@ tags: - CIS 16 kill_chain_phases: - Actions on Objectives + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log mitre_attack_id: - T1003 nist: diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml index 6290060a2b..b83d4dfe80 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml @@ -33,6 +33,8 @@ tags: - CIS 16 kill_chain_phases: - Actions on Objectives + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log mitre_attack_id: - T1003 nist: diff --git a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml index 077bfe34eb..c1da11170c 100644 --- a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml +++ b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml @@ -31,6 +31,8 @@ tags: - CIS 16 kill_chain_phases: - Actions on Objectives + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logPowerShellModule.log mitre_attack_id: - T1003 nist: diff --git a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml index 16eccd2dfd..20733e8ca2 100644 --- a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml +++ b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml @@ -29,6 +29,8 @@ tags: - CIS 16 kill_chain_phases: - Actions on Objectives + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLazagneCredDump.log mitre_attack_id: - T1003 - T1555 diff --git a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml index ae9272f7b9..8076458660 100644 --- a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml @@ -34,6 +34,8 @@ tags: - CIS 16 kill_chain_phases: - Actions on Objectives + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log mitre_attack_id: - T1003 nist: diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml index cb9db98b20..9bf3d65b80 100644 --- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml +++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml @@ -38,6 +38,8 @@ tags: - CIS 16 kill_chain_phases: - Actions on Objectives + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log mitre_attack_id: - T1003 nist: diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml index 474b91d093..3170171fe9 100644 --- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml +++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml @@ -34,6 +34,8 @@ tags: - CIS 16 kill_chain_phases: - Actions on Objectives + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log mitre_attack_id: - T1003 nist: diff --git a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml index b571a165e0..5c8b44130e 100644 --- a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml @@ -35,6 +35,8 @@ tags: - CIS 16 kill_chain_phases: - Actions on Objectives + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log mitre_attack_id: - T1003 nist: diff --git a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml index b376126867..e6feb67223 100644 --- a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml @@ -33,6 +33,8 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021/illegal_access_to_content/logAllPowerSploitModulesWithOldNames.log mitre_attack_id: - T1021 - T1113 diff --git a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml index 957ba2115a..a604e6f726 100644 --- a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml @@ -28,6 +28,8 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1585/illegal_account_creation/logAllPowerSploitModulesWithOldNames.log mitre_attack_id: - T1585 nist: diff --git a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml index 68037b59c2..deb11f4d0c 100644 --- a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml @@ -29,6 +29,8 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log mitre_attack_id: - T1078 - T1098 diff --git a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml index a60f17bbc7..08c1b02b80 100644 --- a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml @@ -29,6 +29,8 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/illegal_log_deletion/logAllMimikatzModules.log mitre_attack_id: - T1070 nist: diff --git a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml index 336d4e8372..d9f9e6ea35 100644 --- a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml @@ -31,6 +31,8 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/logAllDSInternalsModules.log mitre_attack_id: - T1098 - T1207 diff --git a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml index c85690fd9a..288dd9d02f 100644 --- a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml @@ -32,6 +32,8 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/logAllPowerSploitModulesWithOldNames.log mitre_attack_id: - T1098 - T1207 diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml index af57bf40cd..f05bb22449 100644 --- a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml @@ -32,6 +32,8 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllPowerSploitModulesWithOldNames.log mitre_attack_id: - T1053 - T1134 diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml index abe229cae2..eac564d78f 100644 --- a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml @@ -29,6 +29,8 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllMimikatzModules.log mitre_attack_id: - T1134 - T1548 diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml index 48bc0d341c..39ec99edfc 100644 --- a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml @@ -32,6 +32,8 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569/logAllMimikatzModules.log mitre_attack_id: - T1055 - T1106 diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml index 35bcc45b53..e1b43f3d28 100644 --- a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml @@ -40,6 +40,8 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569/logAllPowerSploitModulesWithOldNames.log mitre_attack_id: - T1055 - T1106 diff --git a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml index 305ad3a7b3..45c216c5a3 100644 --- a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml @@ -34,6 +34,8 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log mitre_attack_id: - T1068 - T1078 diff --git a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml index e41310e82d..dba3172b82 100644 --- a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml @@ -29,6 +29,8 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllMimikatzModules.log mitre_attack_id: - T1068 - T1078 diff --git a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml index 137e20b0e0..ad957e3b98 100644 --- a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml @@ -28,6 +28,8 @@ tags: - CIS 20 kill_chain_phases: - Actions on Objectives + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllPowerSploitModulesWithOldNames.log mitre_attack_id: - T1068 - T1078 diff --git a/tests/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.test.yml index 14d0c0b8b2..17f177709e 100644 --- a/tests/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.test.yml +++ b/tests/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.test.yml @@ -6,5 +6,7 @@ tests: pass_condition: '@count_gt(0)' attack_data: - file_name: logAllMimikatzModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllMimikatzModules.log + source: WinEventLog:Security + sourcetype: WinEventLog diff --git a/tests/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.test.yml b/tests/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.test.yml index 0320b2baae..050495ad6d 100644 --- a/tests/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.test.yml +++ b/tests/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.test.yml @@ -6,5 +6,7 @@ tests: description: Test applying stolen credentials detections attack_data: - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllPowerSploitModulesWithOldNames.log + source: WinEventLog:Security + sourcetype: WinEventLog diff --git a/tests/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.test.yml b/tests/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.test.yml index 50545476f6..a5f2fd8a8c 100644 --- a/tests/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.test.yml +++ b/tests/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.test.yml @@ -6,5 +6,7 @@ tests: description: Test credential extraction detections attack_data: - file_name: logAllDSInternalsModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log + source: WinEventLog:Security + sourcetype: WinEventLog diff --git a/tests/endpoint/ssa___credential_extraction_dsinternals_modules.test.yml b/tests/endpoint/ssa___credential_extraction_dsinternals_modules.test.yml index 719452df65..0caa77343b 100644 --- a/tests/endpoint/ssa___credential_extraction_dsinternals_modules.test.yml +++ b/tests/endpoint/ssa___credential_extraction_dsinternals_modules.test.yml @@ -6,5 +6,7 @@ tests: description: Test credential extraction detections attack_data: - file_name: logAllDSInternalsModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log + source: WinEventLog:Security + sourcetype: WinEventLog diff --git a/tests/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.test.yml b/tests/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.test.yml index ce3bb8c001..3d8a04e2fa 100644 --- a/tests/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.test.yml +++ b/tests/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.test.yml @@ -6,5 +6,7 @@ tests: description: Test credential extraction detections attack_data: - file_name: logFgdump.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logFgdump.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log + source: WinEventLog:Security + sourcetype: WinEventLog diff --git a/tests/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.test.yml b/tests/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.test.yml index dc0e53e26f..dbcdda0cef 100644 --- a/tests/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.test.yml +++ b/tests/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.test.yml @@ -6,4 +6,7 @@ tests: description: Test credential extraction detections attack_data: - file_name: logFgdump.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logFgdump.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logFgdump.log + source: WinEventLog:Security + sourcetype: WinEventLog + diff --git a/tests/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.test.yml b/tests/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.test.yml index 3c173cc10f..bebdc5731c 100644 --- a/tests/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.test.yml +++ b/tests/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.test.yml @@ -6,5 +6,7 @@ tests: description: Test credential extraction detections attack_data: - file_name: logPowerShellModule.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logPowerShellModule.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logPowerShellModule.log + source: WinEventLog:Security + sourcetype: WinEventLog diff --git a/tests/endpoint/ssa___credential_extraction_lazagne_command_options.test.yml b/tests/endpoint/ssa___credential_extraction_lazagne_command_options.test.yml index d4c9e06189..4a4939a9cc 100644 --- a/tests/endpoint/ssa___credential_extraction_lazagne_command_options.test.yml +++ b/tests/endpoint/ssa___credential_extraction_lazagne_command_options.test.yml @@ -6,5 +6,7 @@ tests: description: Test credential extraction detections attack_data: - file_name: logLazagneCredDump.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logLazagneCredDump.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLazagneCredDump.log + source: WinEventLog:Security + sourcetype: WinEventLog diff --git a/tests/endpoint/ssa___credential_extraction_mimikatz_modules.test.yml b/tests/endpoint/ssa___credential_extraction_mimikatz_modules.test.yml index e460bc3757..af323822f1 100644 --- a/tests/endpoint/ssa___credential_extraction_mimikatz_modules.test.yml +++ b/tests/endpoint/ssa___credential_extraction_mimikatz_modules.test.yml @@ -6,5 +6,7 @@ tests: description: Test credential extraction detections attack_data: - file_name: logAllMimikatzModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log + source: WinEventLog:Security + sourcetype: WinEventLog diff --git a/tests/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.test.yml b/tests/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.test.yml index 3b1d98728d..c5f38a8be8 100644 --- a/tests/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.test.yml +++ b/tests/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.test.yml @@ -6,5 +6,7 @@ tests: description: Test credential extraction detections attack_data: - file_name: logLiveKDFullKernelDump.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logLiveKDFullKernelDump.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log + source: WinEventLog:Security + sourcetype: WinEventLog diff --git a/tests/endpoint/ssa___credential_extraction_ms_debuggers_z_option.test.yml b/tests/endpoint/ssa___credential_extraction_ms_debuggers_z_option.test.yml index f7d02548e6..63e33fdcd2 100644 --- a/tests/endpoint/ssa___credential_extraction_ms_debuggers_z_option.test.yml +++ b/tests/endpoint/ssa___credential_extraction_ms_debuggers_z_option.test.yml @@ -6,5 +6,7 @@ tests: description: Test credential extraction detections attack_data: - file_name: logLiveKDFullKernelDump.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logLiveKDFullKernelDump.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logLiveKDFullKernelDump.log + source: WinEventLog:Security + sourcetype: WinEventLog diff --git a/tests/endpoint/ssa___credential_extraction_powersploit_modules.test.yml b/tests/endpoint/ssa___credential_extraction_powersploit_modules.test.yml index c0dc7b4ab3..07852e8de9 100644 --- a/tests/endpoint/ssa___credential_extraction_powersploit_modules.test.yml +++ b/tests/endpoint/ssa___credential_extraction_powersploit_modules.test.yml @@ -6,5 +6,7 @@ tests: description: Test credential extraction detections attack_data: - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log + source: WinEventLog:Security + sourcetype: WinEventLog diff --git a/tests/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.test.yml b/tests/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.test.yml index fa30ad2024..4976fecc45 100644 --- a/tests/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.test.yml +++ b/tests/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.test.yml @@ -6,5 +6,7 @@ tests: description: Test illegal access to user content detections attack_data: - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021/illegal_access_to_content/logAllPowerSploitModulesWithOldNames.log + source: WinEventLog:Security + sourcetype: WinEventLog diff --git a/tests/endpoint/ssa___illegal_account_creation_via_powersploit_modules.test.yml b/tests/endpoint/ssa___illegal_account_creation_via_powersploit_modules.test.yml index 72e29e3c8e..853e214cd1 100644 --- a/tests/endpoint/ssa___illegal_account_creation_via_powersploit_modules.test.yml +++ b/tests/endpoint/ssa___illegal_account_creation_via_powersploit_modules.test.yml @@ -6,5 +6,7 @@ tests: description: Test illegal account creation detections attack_data: - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1585/illegal_account_creation/logAllPowerSploitModulesWithOldNames.log + source: WinEventLog:Security + sourcetype: WinEventLog diff --git a/tests/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.test.yml b/tests/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.test.yml index 937c8448a7..59ce39971a 100644 --- a/tests/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.test.yml +++ b/tests/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.test.yml @@ -6,5 +6,7 @@ tests: description: Test enabling or disabling of accounts detections attack_data: - file_name: logAllDSInternalsModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log + source: WinEventLog:Security + sourcetype: WinEventLog diff --git a/tests/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.test.yml index 7c612b8095..f2edfb66e3 100644 --- a/tests/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.test.yml +++ b/tests/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.test.yml @@ -6,5 +6,7 @@ tests: description: Test illegal log deletion detections attack_data: - file_name: logAllMimikatzModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/illegal_log_deletion/logAllMimikatzModules.log + source: WinEventLog:Security + sourcetype: WinEventLog diff --git a/tests/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.test.yml b/tests/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.test.yml index 46b465d5e4..77a139bf06 100644 --- a/tests/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.test.yml +++ b/tests/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.test.yml @@ -6,4 +6,7 @@ tests: description: Test illegal management of Active Directory elements and policies detections attack_data: - file_name: logAllDSInternalsModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/logAllDSInternalsModules.log + source: WinEventLog:Security + sourcetype: WinEventLog + diff --git a/tests/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.test.yml b/tests/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.test.yml index 1044d859c0..60acc6e527 100644 --- a/tests/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.test.yml +++ b/tests/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.test.yml @@ -6,5 +6,7 @@ tests: description: Test illegal management of computers and Active Directory elements detections attack_data: - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/logAllPowerSploitModulesWithOldNames.log + source: WinEventLog:Security + sourcetype: WinEventLog diff --git a/tests/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.test.yml b/tests/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.test.yml index a308e881c6..7199c102ea 100644 --- a/tests/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.test.yml +++ b/tests/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.test.yml @@ -6,5 +6,7 @@ tests: description: Test privilege elevation and persistence detections attack_data: - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllPowerSploitModulesWithOldNames.log + source: WinEventLog:Security + sourcetype: WinEventLog diff --git a/tests/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.test.yml index a76d25e773..3f66bd9c1a 100644 --- a/tests/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.test.yml +++ b/tests/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.test.yml @@ -6,5 +6,7 @@ tests: description: Test illegal privilege elevation detections attack_data: - file_name: logAllMimikatzModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllMimikatzModules.log + source: WinEventLog:Security + sourcetype: WinEventLog diff --git a/tests/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.test.yml index 928c6bbf91..c8b24e37c4 100644 --- a/tests/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.test.yml +++ b/tests/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.test.yml @@ -6,5 +6,7 @@ tests: description: Test illegal service and process control detections attack_data: - file_name: logAllMimikatzModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569/logAllMimikatzModules.log + source: WinEventLog:Security + sourcetype: WinEventLog diff --git a/tests/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.test.yml b/tests/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.test.yml index 8e18aaad1f..693e7a447c 100644 --- a/tests/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.test.yml +++ b/tests/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.test.yml @@ -6,5 +6,7 @@ tests: description: Test illegal service and process control detections attack_data: - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569/logAllPowerSploitModulesWithOldNames.log + source: WinEventLog:Security + sourcetype: WinEventLog diff --git a/tests/endpoint/ssa___setting_credentials_via_dsinternals_modules.test.yml b/tests/endpoint/ssa___setting_credentials_via_dsinternals_modules.test.yml index c152e45a64..26cf6d32f5 100644 --- a/tests/endpoint/ssa___setting_credentials_via_dsinternals_modules.test.yml +++ b/tests/endpoint/ssa___setting_credentials_via_dsinternals_modules.test.yml @@ -6,5 +6,7 @@ tests: description: Test illegal credential setting detections attack_data: - file_name: logAllDSInternalsModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllDSInternalsModules.log + source: WinEventLog:Security + sourcetype: WinEventLog diff --git a/tests/endpoint/ssa___setting_credentials_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___setting_credentials_via_mimikatz_modules.test.yml index 3be6db0fa2..4b4cb6235e 100644 --- a/tests/endpoint/ssa___setting_credentials_via_mimikatz_modules.test.yml +++ b/tests/endpoint/ssa___setting_credentials_via_mimikatz_modules.test.yml @@ -6,5 +6,7 @@ tests: description: Test illegal credential setting detections attack_data: - file_name: logAllMimikatzModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllMimikatzModules.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllMimikatzModules.log + source: WinEventLog:Security + sourcetype: WinEventLog diff --git a/tests/endpoint/ssa___setting_credentials_via_powersploit_modules.test.yml b/tests/endpoint/ssa___setting_credentials_via_powersploit_modules.test.yml index b6f2fa8a38..02cc1ca781 100644 --- a/tests/endpoint/ssa___setting_credentials_via_powersploit_modules.test.yml +++ b/tests/endpoint/ssa___setting_credentials_via_powersploit_modules.test.yml @@ -6,5 +6,7 @@ tests: description: Test illegal credential setting detections attack_data: - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/logAllPowerSploitModulesWithOldNames.log + source: WinEventLog:Security + sourcetype: WinEventLog