Branch was auto-updated.

detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml

@@ -60,3 +60,10 @@ tags:
   - count
   risk_score: 25
   security_domain: threat
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_createrss_command_abuse.log
+    source: audittrail
+    sourcetype: audittrail
+    custom_index: _audit

detections/application/splunk_xss_via_view.yml

@@ -48,3 +48,10 @@ tags:
   - fileName
   risk_score: 25
   security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_xss_via_view.log
+    source: /opt/splunk/var/log/splunk/web_service.log
+    sourcetype: splunk_web_service
+    custom_index: _internal

detections/endpoint/windows_powershell_export_certificate.yml

@@ -51,3 +51,9 @@ tags:
   - EventCode
   risk_score: 36
   security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_certificate.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_rundll32_webdav_request.yml

@@ -70,3 +70,9 @@ tags:
   - Processes.parent_process_id
   risk_score: 48
   security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/cve-2023-23397/webdav_windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog