diff --git a/tests/endpoint/ryuk_test_files_detected.test.yml b/tests/endpoint/ryuk_test_files_detected.test.yml new file mode 100644 index 0000000000..47ef34e331 --- /dev/null +++ b/tests/endpoint/ryuk_test_files_detected.test.yml @@ -0,0 +1,10 @@ +name: Ryuk Test Files Detected +detections: +- name: Ryuk Test Files Detected + file: detections/endpoint/ryuk_test_files_detected.yml + pass_condition: '| stats count | where count > 0' +- attack_data: + file_name: windows-sysmon.log + data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1486.all/Ryuk_Test_Files_Detected_57d44d70-28d9-4ed1-acf5-1c80ae2bbce3.json + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/windows_conhost_exe_force_flag.test.yml b/tests/endpoint/windows_conhost_exe_force_flag.test.yml new file mode 100644 index 0000000000..81df307b01 --- /dev/null +++ b/tests/endpoint/windows_conhost_exe_force_flag.test.yml @@ -0,0 +1,10 @@ +name: Windows connhost exe started forcefully +detections: +- name: Windows connhost exe started forcefully + file: detections/endpoint/windows_connhost_exe_force_flag.yml + pass_condition: '| stats count | where count > 0' +- attack_data: + file_name: windows-sysmon.log + data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1059.all/Windows_connhost_exe_started_forcefully_c114aaca-68ee-41c2-ad8c-32bf21db8769.json + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/windows_disableantispyware_reg.test.yml b/tests/endpoint/windows_disableantispyware_reg.test.yml new file mode 100644 index 0000000000..9862fece2a --- /dev/null +++ b/tests/endpoint/windows_disableantispyware_reg.test.yml @@ -0,0 +1,10 @@ +name: Windows DisableAntiSpyware Registry +detections: +- name: Windows DisableAntiSpyware Registry + file: detections/endpoint/windows_disableantispyware_reg.yml + pass_condition: '| stats count | where count > 0' +- attack_data: + file_name: windows-sysmon.log + data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1562.001/Windows_DisableAntiSpyware_Registry_23150a40-9301-4195-b802-5bb4f43067fb.json + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/windows_security_account_manager_stopped.test.yml b/tests/endpoint/windows_security_account_manager_stopped.test.yml new file mode 100644 index 0000000000..337da0feca --- /dev/null +++ b/tests/endpoint/windows_security_account_manager_stopped.test.yml @@ -0,0 +1,10 @@ +name: Windows Security Account Manager Stopped +detections: +- name: Windows Security Account Manager Stopped + file: detections/endpoint/windows_security_account_manager_stopped.yml + pass_condition: '| stats count | where count > 0' +- attack_data: + file_name: windows-sysmon.log + data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1489.all/windows_security_account_manager_stopped_69c12d59-d951-431e-ab77-ec426b8d65e6.json + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog