admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge remote-tracking branch 'origin/ryuktestsfiles' into ryuk-story

Browse Source
This commit is contained in:
divious1
2020-11-09 10:55:45 -05:00
parent 026bb228a0 f8a131528d
commit b1db736eb2
4 changed files with 40 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/endpoint/ryuk_test_files_detected.test.yml
+10
View File
@@ -0,0 +1,10 @@
name: Ryuk Test Files Detected
detections:
- name: Ryuk Test Files Detected
file: detections/endpoint/ryuk_test_files_detected.yml
pass_condition: '| stats count | where count > 0'
- attack_data:
file_name: windows-sysmon.log
data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1486.all/Ryuk_Test_Files_Detected_57d44d70-28d9-4ed1-acf5-1c80ae2bbce3.json
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
tests/endpoint/windows_conhost_exe_force_flag.test.yml
+10
View File
@@ -0,0 +1,10 @@
name: Windows connhost exe started forcefully
detections:
- name: Windows connhost exe started forcefully
file: detections/endpoint/windows_connhost_exe_force_flag.yml
pass_condition: '| stats count | where count > 0'
- attack_data:
file_name: windows-sysmon.log
data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1059.all/Windows_connhost_exe_started_forcefully_c114aaca-68ee-41c2-ad8c-32bf21db8769.json
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
tests/endpoint/windows_disableantispyware_reg.test.yml
+10
View File
@@ -0,0 +1,10 @@
name: Windows DisableAntiSpyware Registry
detections:
- name: Windows DisableAntiSpyware Registry
file: detections/endpoint/windows_disableantispyware_reg.yml
pass_condition: '| stats count | where count > 0'
- attack_data:
file_name: windows-sysmon.log
data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1562.001/Windows_DisableAntiSpyware_Registry_23150a40-9301-4195-b802-5bb4f43067fb.json
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
tests/endpoint/windows_security_account_manager_stopped.test.yml
+10
View File
@@ -0,0 +1,10 @@
name: Windows Security Account Manager Stopped
detections:
- name: Windows Security Account Manager Stopped
file: detections/endpoint/windows_security_account_manager_stopped.yml
pass_condition: '| stats count | where count > 0'
- attack_data:
file_name: windows-sysmon.log
data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1489.all/windows_security_account_manager_stopped_69c12d59-d951-431e-ab77-ec426b8d65e6.json
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog