From 2c45dd93fe0e2ae969c1cf4532fc28259c88de7f Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Mon, 31 Jul 2023 16:27:16 -0700 Subject: [PATCH] Add missing tests to detections. --- .../splunk_risky_command_abuse_disclosed_february_2023.yml | 7 +++++++ detections/application/splunk_xss_via_view.yml | 7 +++++++ .../endpoint/windows_powershell_export_certificate.yml | 6 ++++++ detections/endpoint/windows_rundll32_webdav_request.yml | 6 ++++++ 4 files changed, 26 insertions(+) diff --git a/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml b/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml index 94804f1a3a..88952aa032 100644 --- a/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml +++ b/detections/application/splunk_risky_command_abuse_disclosed_february_2023.yml @@ -60,3 +60,10 @@ tags: - count risk_score: 25 security_domain: threat +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/splunk/splunk_createrss_command_abuse.log + source: audittrail + sourcetype: audittrail + custom_index: _audit diff --git a/detections/application/splunk_xss_via_view.yml b/detections/application/splunk_xss_via_view.yml index 3cd6320c74..19549286f9 100644 --- a/detections/application/splunk_xss_via_view.yml +++ b/detections/application/splunk_xss_via_view.yml @@ -48,3 +48,10 @@ tags: - fileName risk_score: 25 security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/splunk/splunk_xss_via_view.log + source: /opt/splunk/var/log/splunk/web_service.log + sourcetype: splunk_web_service + custom_index: _internal diff --git a/detections/endpoint/windows_powershell_export_certificate.yml b/detections/endpoint/windows_powershell_export_certificate.yml index bce91dd923..0651489eda 100644 --- a/detections/endpoint/windows_powershell_export_certificate.yml +++ b/detections/endpoint/windows_powershell_export_certificate.yml @@ -51,3 +51,9 @@ tags: - EventCode risk_score: 36 security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1649/atomic_red_team/4104_export_certificate.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_rundll32_webdav_request.yml b/detections/endpoint/windows_rundll32_webdav_request.yml index 88c6802e0a..2f0410210c 100644 --- a/detections/endpoint/windows_rundll32_webdav_request.yml +++ b/detections/endpoint/windows_rundll32_webdav_request.yml @@ -70,3 +70,9 @@ tags: - Processes.parent_process_id risk_score: 48 security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/cve-2023-23397/webdav_windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file