From 7af33cfd4f92ec4ba9dd967b418050b4811b1fcb Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Sun, 8 Nov 2020 10:27:03 -0500 Subject: [PATCH 1/4] ryuktestfilestestfile --- tests/endpoint/ryuk_test_files_detected.test.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 tests/endpoint/ryuk_test_files_detected.test.yml diff --git a/tests/endpoint/ryuk_test_files_detected.test.yml b/tests/endpoint/ryuk_test_files_detected.test.yml new file mode 100644 index 0000000000..47ef34e331 --- /dev/null +++ b/tests/endpoint/ryuk_test_files_detected.test.yml @@ -0,0 +1,10 @@ +name: Ryuk Test Files Detected +detections: +- name: Ryuk Test Files Detected + file: detections/endpoint/ryuk_test_files_detected.yml + pass_condition: '| stats count | where count > 0' +- attack_data: + file_name: windows-sysmon.log + data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1486.all/Ryuk_Test_Files_Detected_57d44d70-28d9-4ed1-acf5-1c80ae2bbce3.json + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog From 2fd9f07c75176adf5c084ff4e0ac3e7a2302ec1a Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Sun, 8 Nov 2020 10:57:02 -0500 Subject: [PATCH 2/4] winconhostryuksearch --- .../Windows_connhost_exe_started_forcefully.test.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 tests/endpoint/Windows_connhost_exe_started_forcefully.test.yml diff --git a/tests/endpoint/Windows_connhost_exe_started_forcefully.test.yml b/tests/endpoint/Windows_connhost_exe_started_forcefully.test.yml new file mode 100644 index 0000000000..81df307b01 --- /dev/null +++ b/tests/endpoint/Windows_connhost_exe_started_forcefully.test.yml @@ -0,0 +1,10 @@ +name: Windows connhost exe started forcefully +detections: +- name: Windows connhost exe started forcefully + file: detections/endpoint/windows_connhost_exe_force_flag.yml + pass_condition: '| stats count | where count > 0' +- attack_data: + file_name: windows-sysmon.log + data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1059.all/Windows_connhost_exe_started_forcefully_c114aaca-68ee-41c2-ad8c-32bf21db8769.json + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog From e21455a145974e4e4df9094ac06d3c51dc041709 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Sun, 8 Nov 2020 11:10:49 -0500 Subject: [PATCH 3/4] fixnamedaddedantispyware --- ...est.yml => windows_conhost_exe_force_flag.test.yml} | 0 tests/endpoint/windows_disableantispyware_reg.test.yml | 10 ++++++++++ 2 files changed, 10 insertions(+) rename tests/endpoint/{Windows_connhost_exe_started_forcefully.test.yml => windows_conhost_exe_force_flag.test.yml} (100%) create mode 100644 tests/endpoint/windows_disableantispyware_reg.test.yml diff --git a/tests/endpoint/Windows_connhost_exe_started_forcefully.test.yml b/tests/endpoint/windows_conhost_exe_force_flag.test.yml similarity index 100% rename from tests/endpoint/Windows_connhost_exe_started_forcefully.test.yml rename to tests/endpoint/windows_conhost_exe_force_flag.test.yml diff --git a/tests/endpoint/windows_disableantispyware_reg.test.yml b/tests/endpoint/windows_disableantispyware_reg.test.yml new file mode 100644 index 0000000000..9862fece2a --- /dev/null +++ b/tests/endpoint/windows_disableantispyware_reg.test.yml @@ -0,0 +1,10 @@ +name: Windows DisableAntiSpyware Registry +detections: +- name: Windows DisableAntiSpyware Registry + file: detections/endpoint/windows_disableantispyware_reg.yml + pass_condition: '| stats count | where count > 0' +- attack_data: + file_name: windows-sysmon.log + data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1562.001/Windows_DisableAntiSpyware_Registry_23150a40-9301-4195-b802-5bb4f43067fb.json + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog From f8a131528d64198cf19699893293951862b52027 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Sun, 8 Nov 2020 11:30:34 -0500 Subject: [PATCH 4/4] widowswsecuritysamsearch --- .../windows_security_account_manager_stopped.test.yml | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 tests/endpoint/windows_security_account_manager_stopped.test.yml diff --git a/tests/endpoint/windows_security_account_manager_stopped.test.yml b/tests/endpoint/windows_security_account_manager_stopped.test.yml new file mode 100644 index 0000000000..337da0feca --- /dev/null +++ b/tests/endpoint/windows_security_account_manager_stopped.test.yml @@ -0,0 +1,10 @@ +name: Windows Security Account Manager Stopped +detections: +- name: Windows Security Account Manager Stopped + file: detections/endpoint/windows_security_account_manager_stopped.yml + pass_condition: '| stats count | where count > 0' +- attack_data: + file_name: windows-sysmon.log + data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1489.all/windows_security_account_manager_stopped_69c12d59-d951-431e-ab77-ec426b8d65e6.json + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog