From e698682bdf825430e51a7a59527f2e7afd95171d Mon Sep 17 00:00:00 2001 From: root Date: Fri, 30 Oct 2020 10:13:19 +0000 Subject: [PATCH] Added detection testing service results inCreate local admin accounts using net exe --- .../endpoint/create_local_admin_accounts_using_net_exe.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml index 7f12466e07..45ebe62b5b 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml @@ -34,3 +34,8 @@ tags: - DE.CM security_domain: endpoint asset_type: Endpoint + automated_detection_testing: passed + dataset: + - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1136.001/windows-security.log + - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1136.001/windows-system.log + - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1136.001/windows-sysmon.log