From 8f84e76b4e112db7cd18039634e560e895b9c171 Mon Sep 17 00:00:00 2001 From: miskoSplunk <68617976+miskoSplunk@users.noreply.github.com> Date: Fri, 26 Feb 2021 14:01:41 -0800 Subject: [PATCH] Delete ssa___applying_stolen_credentials_via_mimikatz_modules.test.yml --- ..._stolen_credentials_via_mimikatz_modules.test.yml | 12 ------------ 1 file changed, 12 deletions(-) delete mode 100644 tests/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.test.yml diff --git a/tests/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.test.yml deleted file mode 100644 index 17f177709e..0000000000 --- a/tests/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Applying Stolen Credentials via Mimikatz modules - SSA Unit test -tests: - - name: Applying Stolen Credentials via Mimikatz modules - file: endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml - description: Test applying stolen credentials detections - pass_condition: '@count_gt(0)' - attack_data: - - file_name: logAllMimikatzModules.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllMimikatzModules.log - source: WinEventLog:Security - sourcetype: WinEventLog -