Merge pull request #992 from splunk/update_new_attack_data_project

Update new attack data project

detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml

@@ -42,4 +42,4 @@ tags:
   risk_object: user
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json

detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml

@@ -43,4 +43,4 @@ tags:
   risk_object: user
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json

detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml

@@ -45,4 +45,4 @@ tags:
   risk_object: user
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json

detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml

@@ -40,4 +40,4 @@ tags:
   risk_object: user
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json

detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml

@@ -38,4 +38,4 @@ tags:
   risk_object: user
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json

detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml

@@ -44,4 +44,4 @@ tags:
   risk_object: user
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json

detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml

@@ -39,4 +39,4 @@ tags:
   risk_object: user
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json

detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml

@@ -39,4 +39,4 @@ tags:
   risk_object: user
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json

detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml

@@ -39,4 +39,4 @@ tags:
   risk_object: user
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json

detections/cloud/cloud_provisioning_from_previously_unseen_city.yml

@@ -54,4 +54,4 @@ tags:
   risk_object: user
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json

detections/cloud/cloud_provisioning_from_previously_unseen_country.yml

@@ -54,4 +54,4 @@ tags:
   risk_object: user
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json

detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml

@@ -53,4 +53,4 @@ tags:
   risk_object: user
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json

detections/cloud/cloud_provisioning_from_previously_unseen_region.yml

@@ -54,4 +54,4 @@ tags:
   risk_object: user
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json

detections/cloud/detect_aws_console_login_by_new_user.yml

@@ -43,4 +43,4 @@ tags:
   risk_object: user
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json

detections/cloud/detect_aws_console_login_by_user_from_new_city.yml

@@ -49,4 +49,4 @@ tags:
   risk_object: user
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json

detections/cloud/detect_aws_console_login_by_user_from_new_country.yml

@@ -49,4 +49,4 @@ tags:
   risk_object: user
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json

detections/cloud/detect_aws_console_login_by_user_from_new_region.yml

@@ -49,4 +49,4 @@ tags:
   risk_object: user
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json

detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml

@@ -5,6 +5,7 @@ date: '2020-07-21'
 description: This search looks for flags passed to schtasks.exe on the command-line
   that indicate that task names related to the execution of Bad Rabbit ransomware
   were created or deleted.
+  Deprecated because we already have a similar detection
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
   ingesting logs with both the process name and command line from your endpoints.

detections/endpoint/access_lsass_memory_for_dump_creation.yml

@@ -35,4 +35,4 @@ tags:
   asset_type: Windows
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.001/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log

detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml

@@ -39,4 +39,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1553.004/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1553.004/atomic_red_team/windows-sysmon.log

detections/endpoint/attempt_to_stop_security_service.yml

@@ -46,4 +46,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1562.001_custom_f3b70c45-3f9f-493d-b0b0-6be2ad9f158b/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon.log

detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -36,4 +36,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.002/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log

detections/endpoint/batch_file_write_to_system32.yml

@@ -40,4 +40,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1204.002_custom_b0162b8c-686d-4d97-83fe-7e80ac679cf4/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/batch_file_in_system32/windows-sysmon.log

detections/endpoint/common_ransomware_extensions.yml

@@ -51,4 +51,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1485_custom_215ee4f9-c027-4ea1-a882-d97b887d233d/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/ransomware_extensions/windows-sysmon.log

detections/endpoint/common_ransomware_notes.yml

@@ -37,4 +37,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1485_custom_cc81aa13-3899-4d33-b5c5-8a6e30eca28b/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/ransomware_notes/windows-sysmon.log

detections/endpoint/create_local_admin_accounts_using_net_exe.yml

@@ -36,6 +36,6 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1136.001/windows-security.log
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1136.001/windows-system.log
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1136.001/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-system.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log

detections/endpoint/create_remote_thread_into_lsass.yml

@@ -35,4 +35,4 @@ tags:
   asset_type: Windows
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.001/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log

detections/endpoint/creation_of_shadow_copy.yml

@@ -38,4 +38,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.003/windows-sysmon.log
+  - hhttps://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log

detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml

@@ -30,4 +30,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.003/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log

detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml

@@ -36,4 +36,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.003/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log

detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml

@@ -34,4 +34,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.003/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log

detections/endpoint/deleting_shadow_copies.yml

@@ -42,4 +42,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1490/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log

detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml

@@ -36,4 +36,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1550.002/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.002/atomic_red_team/windows-security.log

detections/endpoint/detect_credential_dumping_through_lsass_access.yml

@@ -42,4 +42,4 @@ tags:
   asset_type: Windows
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.001/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log

detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml

@@ -41,5 +41,5 @@ tags:
   asset_type: Windows
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1078.002_custom_49a0e495-4ecd-41e4-a9c7-4c0a1e841ba6/windows-security.log
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1078.002_custom_49a0e495-4ecd-41e4-a9c7-4c0a1e841ba6/windows-system.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_lockout/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_lockout/windows-system.log

detections/endpoint/detect_excessive_user_account_lockouts.yml

@@ -31,5 +31,5 @@ tags:
   asset_type: Windows
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1078.002_custom_49a0e495-4ecd-41e4-a9c7-4c0a1e841ba6/windows-security.log
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1078.002_custom_49a0e495-4ecd-41e4-a9c7-4c0a1e841ba6/windows-system.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_lockout/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_lockout/windows-system.log

detections/endpoint/detect_mshta_exe_running_scripts_in_command_line_arguments.yml

@@ -38,4 +38,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1218.005/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.005/atomic_red_team/windows-sysmon.log

detections/endpoint/detect_new_local_admin_account.yml

@@ -32,6 +32,6 @@ tags:
   asset_type: Windows
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1136.001/windows-security.log
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1136.001/windows-system.log
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1136.001/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-system.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log

detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml

@@ -33,4 +33,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1574.009/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.009/atomic_red_team/windows-sysmon.log

detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml

@@ -41,4 +41,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1016_custom_10e3118d-3785-4197-8152-1bf68a4c617e/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/discovery_commands/windows-sysmon.log

detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml

@@ -38,4 +38,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1059.003_custom_5967c616-f184-4a9d-afe4-758e0745d90e/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-sysmon.log

detections/endpoint/detect_psexec_with_accepteula_flag.yml

@@ -44,4 +44,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1021.002/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.002/atomic_red_team/windows-sysmon.log

detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml

@@ -37,4 +37,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1059.003_custom_a43d29e4-3a56-4208-a0a2-44e6045f3c48/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/cmd_spawns_cscript/windows-sysmon.log

detections/endpoint/disabling_remote_user_account_control.yml

@@ -37,4 +37,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1548.002/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.002/atomic_red_team/windows-sysmon.log

detections/endpoint/dump_lsass_via_comsvcs_dll.yml

@@ -35,4 +35,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.001/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log

detections/endpoint/execution_of_file_with_multiple_extensions.yml

@@ -37,4 +37,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1036.003/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/atomic_red_team/windows-sysmon.log

detections/endpoint/file_with_samsam_extension.yml

@@ -34,4 +34,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1036.003_custom_b4e0d323-9d98-4092-9757-032b598652bc/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036.003/samsam_extension/windows-sysmon.log

detections/endpoint/first_time_seen_child_process_of_zoom.yml

@@ -46,4 +46,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1068_custom_888ee699-7f28-4c16-85e5-d5d88aa6cdcd/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/zoom_child_process/windows-sysmon.log

detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml

@@ -37,4 +37,4 @@ tags:
   asset_type: ''
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1222.001/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/atomic_red_team/windows-sysmon.log

detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml

@@ -33,4 +33,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1558.003/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-security.log

detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml

@@ -46,4 +46,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1059.001_custom_03e301be-1bfc-4051-af4d-d0865079fb27/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/hidden_powershell/windows-sysmon.log

detections/endpoint/malicious_powershell_process___encoded_command.yml

@@ -40,4 +40,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1027/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027/atomic_red_team/windows-sysmon.log

detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml

@@ -41,6 +41,3 @@ tags:
   - PR.IP
   security_domain: endpoint
   asset_type: Endpoint
-  automated_detection_testing: passed
-  dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1059.001/windows-sysmon.log

detections/endpoint/monitor_registry_keys_for_print_monitors.yml

@@ -42,4 +42,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1547.010/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.010/atomic_red_team/windows-sysmon.log

detections/endpoint/overwriting_accessibility_binaries.yml

@@ -39,4 +39,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1546.008/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.008/atomic_red_team/windows-sysmon.log

detections/endpoint/process_execution_via_wmi.yml

@@ -36,4 +36,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1047/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log

detections/endpoint/processes_launching_netsh.yml

@@ -39,4 +39,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1562.004/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.004/atomic_red_team/windows-sysmon.log

detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml

@@ -39,4 +39,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1574.011_custom_eb03d0db-448b-446f-8b46-d9bc39cc8cc7/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.011/change_registry_path_service/windows-sysmon.log

detections/endpoint/registry_keys_for_creating_shim_databases.yml

@@ -36,4 +36,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1546.011/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.011/atomic_red_team/windows-sysmon.log

detections/endpoint/registry_keys_used_for_persistence.yml

@@ -48,4 +48,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1547.001/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.001/atomic_red_team/windows-sysmon.log

detections/endpoint/registry_keys_used_for_privilege_escalation.yml

@@ -41,4 +41,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1546.012/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.012/atomic_red_team/windows-sysmon.log

detections/endpoint/remote_process_instantiation_via_wmi.yml

@@ -41,4 +41,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1047/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log

detections/endpoint/rundll_loading_dll_by_ordinal.yml

@@ -38,4 +38,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1218.011/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.011/atomic_red_team/windows-sysmon.log

detections/endpoint/ryuk_test_files_detected.yml

@@ -33,4 +33,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/malware/ryuk/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ryuk/windows-sysmon.log

detections/endpoint/samsam_test_file_write.yml

@@ -18,6 +18,8 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | `security_content_ctime(firstTime)` | `samsam_test_file_write_filter`'
 known_false_positives: No false positives have been identified.
 tags:
+  mitre_attack_id:
+  - T1486
   analytics_story:
   - SamSam Ransomware
   kill_chain_phases:
@@ -29,3 +31,6 @@ tags:
   - DE.CM
   security_domain: endpoint
   asset_type: Endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1486/sam_sam_note/windows-sysmon.log

detections/endpoint/sc_exe_manipulating_windows_services.yml

@@ -39,3 +39,6 @@ tags:
   - DE.CM
   security_domain: endpoint
   asset_type: Endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1543.003/atomic_red_team/windows-sysmon.log

detections/endpoint/scheduled_task_name_used_by_dragonfly_threat_actors.yml

@@ -1,7 +1,7 @@
 name: Scheduled Task Name Used by Dragonfly Threat Actors
 id: d5af132c-7c17-439c-9d31-13d55340f36c
-version: 4
-date: '2020-07-21'
+version: 5
+date: '2020-12-07'
 description: This search looks for flags passed to schtasks.exe on the command-line
   that indicate a task name associated with the Dragonfly threat actor was created
   or deleted.
@@ -14,10 +14,10 @@ references: []
 author: Bhavin Patel, Splunk
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   as process values(Processes.parent_process) as parent_process min(_time) as firstTime
-  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe  by
-  Processes.user Processes.process_name Processes.parent_process_name Processes.dest  |
-  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-  | search (process=*delete* OR process=*create*) process=*reset* | `scheduled_task_name_used_by_dragonfly_threat_actors_filter` '
+  max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe
+  (Processes.process=*delete* OR Processes.process=*create*) by Processes.user Processes.process_name
+  Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `scheduled_task_name_used_by_dragonfly_threat_actors_filter` '
 known_false_positives: No known false positives
 tags:
   analytics_story:
@@ -32,3 +32,6 @@ tags:
   - PR.IP
   security_domain: endpoint
   asset_type: Endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-sysmon.log

detections/endpoint/schtasks_scheduling_job_on_remote_system.yml

@@ -14,10 +14,10 @@ references: []
 author: David Dorsey, Splunk
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name = schtasks.exe
-  Processes.process="*/create*" Processes.process="* /s *" by Processes.process_name
-  Processes.process Processes.parent_process_name Processes.dest Processes.user |
-  `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
-  | `schtasks_scheduling_job_on_remote_system_filter`'
+  Processes.process="*/create*" (Processes.process="* /s *" OR Processes.process="*
+  /S *") by Processes.process_name Processes.process Processes.parent_process_name
+  Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `schtasks_scheduling_job_on_remote_system_filter`'
 known_false_positives: Administrators may create jobs on remote systems, but this
   activity is usually limited to a small set of hosts or users. It is important to
   validate and investigate as appropriate.
@@ -36,4 +36,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1053.005/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-sysmon.log

detections/endpoint/schtasks_used_for_forcing_a_reboot.yml

@@ -1,7 +1,7 @@
 name: Schtasks used for forcing a reboot
 id: 1297fb80-f42a-4b4a-9c8a-88c066437cf6
-version: 3
-date: '2020-07-21'
+version: 4
+date: '2020-12-07'
 description: This search looks for flags passed to schtasks.exe on the command-line
   that indicate that a forced reboot of system is scheduled.
 how_to_implement: To successfully implement this search you need to be ingesting logs
@@ -12,8 +12,8 @@ references: []
 author: Bhavin Patel, Splunk
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.process_name = schtasks.exe Processes.process="*shutdown*" Processes.process="*/r*"
-  Processes.process="*/f*" by Processes.process_name Processes.parent_process_name
+  where Processes.process_name=schtasks.exe Processes.process="*shutdown*" Processes.process="*/create *"
+  by Processes.process_name Processes.parent_process_name
   Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `schtasks_used_for_forcing_a_reboot_filter`'
 known_false_positives: Administrators may create jobs on systems forcing reboots to

detections/endpoint/shim_database_installation_with_suspicious_parameters.yml

@@ -36,4 +36,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1546.011/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.011/atomic_red_team/windows-sysmon.log

detections/endpoint/short_lived_windows_accounts.yml

@@ -32,6 +32,6 @@ tags:
   asset_type: Windows
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1136.001/windows-security.log
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1136.001/windows-system.log
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1136.001/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-system.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log

detections/endpoint/suspicious_reg_exe_process.yml

@@ -44,4 +44,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1112/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1112/atomic_red_team/windows-sysmon.log

detections/endpoint/system_information_discovery_detection.yml

@@ -33,4 +33,4 @@ tags:
   security_domain: endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1082/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1082/atomic_red_team/windows-sysmon.log

detections/endpoint/unload_sysmon_filter_driver.yml

@@ -37,4 +37,4 @@ tags:
   asset_type: ''
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1562.001/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/atomic_red_team/windows-sysmon.log

detections/endpoint/windows_event_log_cleared.yml

@@ -37,5 +37,5 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1070.001/windows-security.log
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1070.001/windows-system.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-system.log

detections/endpoint/windows_security_account_manager_stopped.yml

@@ -35,4 +35,4 @@ tags:
   asset_type: Endpoint
   automated_detection_testing: passed
   dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/malware/ryuk/windows-sysmon.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ryuk/windows-sysmon.log

tests/application/first_time_seen_child_process_of_zoom.test.yml

@@ -7,6 +7,6 @@ tests:
   latest_time: 'now'
   attack_data:
   - file_name: windows-sysmon.log
-    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1068_custom_888ee699-7f28-4c16-85e5-d5d88aa6cdcd/windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1068/zoom_child_process/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog

tests/cloud/abnormally_high_cloud_instances_destroyed.test.yml

@@ -5,17 +5,15 @@ tests:
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
-
   baselines:
   - name: Baseline Of Cloud Instances Launched
     file: baselines/baseline_of_cloud_instances_destroyed.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-
   attack_data:
   - file_name: cloudtrail_behavioural_detections.json
-    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
     update_timestamp: True

tests/cloud/abnormally_high_cloud_instances_launched.test.yml

@@ -5,17 +5,15 @@ tests:
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
-
   baselines:
   - name: Baseline Of Cloud Instances Launched
     file: baselines/baseline_of_cloud_instances_launched.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-
   attack_data:
   - file_name: cloudtrail_behavioural_detections.json
-    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
     update_timestamp: True

tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml

@@ -5,17 +5,15 @@ tests:
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
-
   baselines:
   - name: Baseline Of Cloud Infrastructure API Calls Per User
     file: baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-
   attack_data:
   - file_name: cloudtrail_behavioural_detections.json
-    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
     update_timestamp: True

tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml

@@ -5,17 +5,15 @@ tests:
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
-
   baselines:
   - name: Baseline Of Cloud Security Group API Calls Per User
     file: baselines/baseline_of_cloud_security_group_api_calls_per_user.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-
   attack_data:
   - file_name: cloudtrail_behavioural_detections.json
-    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
     update_timestamp: True

tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml

@@ -5,23 +5,20 @@ tests:
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
-
   baselines:
   - name: Previously Seen AWS Cross Account Activity - Initial
     file: baselines/previously_seen_aws_cross_account_activity_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-
   - name: Previously Seen AWS Cross Account Activity - Update
     file: baselines/previously_seen_aws_cross_account_activity_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-
   attack_data:
   - file_name: cloudtrail_behavioural_detections.json
-    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
     update_timestamp: True

tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml

@@ -5,23 +5,20 @@ tests:
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
-
   baselines:
   - name: Previously Seen Cloud API Calls Per User Role - Initial
     file: baselines/previously_seen_cloud_api_calls_per_user_role_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-    
   - name: Previously Seen Cloud API Calls Per User Role - Update
     file: baselines/previously_seen_cloud_api_calls_per_user_role_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-
   attack_data:
   - file_name: cloudtrail_behavioural_detections.json
-    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
     update_timestamp: True

tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml

@@ -5,23 +5,20 @@ tests:
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
-
   baselines:
   - name: Previously Seen Cloud Compute Creations By User - Initial
     file: baselines/previously_seen_cloud_compute_creations_by_user_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-    
   - name: Previously Seen Cloud Compute Creations By User - Update
     file: baselines/previously_seen_cloud_compute_creations_by_user_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-
   attack_data:
   - file_name: cloudtrail_behavioural_detections.json
-    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
     update_timestamp: True

tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml

@@ -5,23 +5,20 @@ tests:
   pass_condition: '| outputlookup test_1.csv | stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
-
   baselines:
   - name: Previously Seen Cloud Regions - Initial
     file: baselines/previously_seen_cloud_regions_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-    
   - name: Previously Seen Cloud Regions - Update
     file: baselines/previously_seen_cloud_regions_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-
   attack_data:
   - file_name: cloudtrail_behavioural_detections.json
-    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
     update_timestamp: True

tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml

@@ -5,23 +5,20 @@ tests:
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
-
   baselines:
   - name: Previously Seen Cloud Compute Images - Initial
     file: baselines/previously_seen_cloud_compute_images_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-    
   - name: Previously Seen Cloud Compute Images - Update
     file: baselines/previously_seen_cloud_compute_images_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-
   attack_data:
   - file_name: cloudtrail_behavioural_detections.json
-    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
     update_timestamp: True

tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml

@@ -5,25 +5,20 @@ tests:
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
-
   baselines:
   - name: Previously Seen Cloud Compute Instance Types - Initial
     file: baselines/previously_seen_cloud_compute_instance_types_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-
-    
   - name: Previously Seen Cloud Compute Instance Types - Update
     file: baselines/previously_seen_cloud_compute_instance_types_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-
-
   attack_data:
   - file_name: cloudtrail_behavioural_detections.json
-    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
     update_timestamp: True

tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml

@@ -5,23 +5,20 @@ tests:
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
-
   baselines:
   - name: Previously Seen Cloud Instance Modifications By User - Initial
     file: baselines/previously_seen_cloud_instance_modifications_by_user_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-    
   - name: Previously Seen Cloud Instance Modifications By User - Update
     file: baselines/previously_seen_cloud_instance_modifications_by_user_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-
   attack_data:
   - file_name: cloudtrail_behavioural_detections.json
-    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
     update_timestamp: True

tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml

@@ -5,23 +5,20 @@ tests:
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
-
   baselines:
   - name: Previously Seen Cloud Provisioning Activity Sources - Initial
     file: baselines/previously_seen_cloud_provisioning_activity_sources_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-    
   - name: Previously Seen Cloud Provisioning Activity Sources - Update
     file: baselines/previously_seen_cloud_provisioning_activity_sources_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-
   attack_data:
   - file_name: cloudtrail_behavioural_detections.json
-    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
     update_timestamp: True

tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml

@@ -5,23 +5,20 @@ tests:
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
-
   baselines:
   - name: Previously Seen Cloud Provisioning Activity Sources - Initial
     file: baselines/previously_seen_cloud_provisioning_activity_sources_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-   
   - name: Previously Seen Cloud Provisioning Activity Sources - Update
     file: baselines/previously_seen_cloud_provisioning_activity_sources_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-
   attack_data:
   - file_name: cloudtrail_behavioural_detections.json
-    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
     update_timestamp: True

tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml

@@ -5,23 +5,20 @@ tests:
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
-
   baselines:
   - name: Previously Seen Cloud Provisioning Activity Sources - Initial
     file: baselines/previously_seen_cloud_provisioning_activity_sources_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-    
   - name: Previously Seen Cloud Provisioning Activity Sources - Update
     file: baselines/previously_seen_cloud_provisioning_activity_sources_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-
   attack_data:
   - file_name: cloudtrail_behavioural_detections.json
-    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
     update_timestamp: True

tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml

@@ -5,23 +5,20 @@ tests:
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
-
   baselines:
   - name: Previously Seen Cloud Provisioning Activity Sources - Initial
     file: baselines/previously_seen_cloud_provisioning_activity_sources_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-
   - name: Previously Seen Cloud Provisioning Activity Sources - Update
     file: baselines/previously_seen_cloud_provisioning_activity_sources_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-
   attack_data:
   - file_name: cloudtrail_behavioural_detections.json
-    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
     update_timestamp: True

tests/cloud/detect_aws_console_login_by_new_user.test.yml

@@ -5,23 +5,20 @@ tests:
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
-
   baselines:
   - name: Previously Seen Users In Cloudtrail - Initial
     file: baselines/previously_seen_users_in_cloudtrail_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-    
   - name: Previously Seen Users In Cloudtrail - Update
     file: baselines/previously_seen_users_in_cloudtrail_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-
   attack_data:
   - file_name: cloudtrail_behavioural_detections.json
-    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
     update_timestamp: True

tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml

@@ -5,23 +5,20 @@ tests:
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
-
   baselines:
   - name: Previously Seen Users In Cloudtrail - Initial
     file: baselines/previously_seen_users_in_cloudtrail_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-    
   - name: Previously Seen Users In Cloudtrail - Update
     file: baselines/previously_seen_users_in_cloudtrail_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-
   attack_data:
   - file_name: cloudtrail_behavioural_detections.json
-    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
     update_timestamp: True

tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml

@@ -5,23 +5,20 @@ tests:
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
-
   baselines:
   - name: Previously Seen Users In Cloudtrail - Initial
     file: baselines/previously_seen_users_in_cloudtrail_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-    
   - name: Previously Seen Users In Cloudtrail - Update
     file: baselines/previously_seen_users_in_cloudtrail_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-
   attack_data:
   - file_name: cloudtrail_behavioural_detections.json
-    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
     update_timestamp: True

tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml

@@ -5,23 +5,20 @@ tests:
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
-
   baselines:
   - name: Previously Seen Users In Cloudtrail - Initial
     file: baselines/previously_seen_users_in_cloudtrail_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-    
   - name: Previously Seen Users In Cloudtrail - Update
     file: baselines/previously_seen_users_in_cloudtrail_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: '-30d'
     latest_time: '-1d'
-
   attack_data:
   - file_name: cloudtrail_behavioural_detections.json
-    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/cloudtrail_behavioural_detections/cloudtrail_behavioural_detections.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
     sourcetype: aws:cloudtrail
     source: aws_cloudtrail
     update_timestamp: True

tests/endpoint/access_lsass_memory_for_dump_creation.test.yml

@@ -7,6 +7,6 @@ tests:
   latest_time: 'now'
   attack_data:
   - file_name: windows-sysmon.log
-    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.001/windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog

tests/endpoint/attempt_to_add_certificate_to_untrusted_store.test.yml

@@ -7,6 +7,6 @@ tests:
   latest_time: 'now'
   attack_data:
   - file_name: windows-sysmon.log
-    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1553.004/windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1553.004/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog

tests/endpoint/attempt_to_stop_security_service.test.yml

@@ -7,6 +7,6 @@ tests:
   latest_time: 'now'
   attack_data:
   - file_name: windows-sysmon.log
-    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1562.001_custom_f3b70c45-3f9f-493d-b0b0-6be2ad9f158b/windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_defend_service_stop/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog

tests/endpoint/attempted_credential_dump_from_registry_via_reg_exe.test.yml

@@ -7,6 +7,6 @@ tests:
   latest_time: 'now'
   attack_data:
   - file_name: windows-sysmon.log
-    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.002/windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog