From b32ec1ca07936ec0add74247fa56190775d5ec41 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 10 Jan 2023 12:14:26 +0100 Subject: [PATCH] fixed missing test files --- ...usual_number_of_failed_authentications_from_ip.yml | 7 +++++++ ...pted_credential_dump_from_registry_via_reg_exe.yml | 11 +++++++++++ detections/endpoint/bits_job_persistence.yml | 11 +++++++++++ detections/endpoint/bitsadmin_download_file.yml | 11 +++++++++++ detections/endpoint/creation_of_shadow_copy.yml | 11 +++++++++++ detections/endpoint/dump_lsass_via_procdump.yml | 11 +++++++++++ detections/endpoint/living_off_the_land.yml | 3 --- .../endpoint/windows_disable_memory_crash_dump.yml | 6 ++++++ .../windows_indirect_command_execution_via_pcalua.yml | 6 ++++++ 9 files changed, 74 insertions(+), 3 deletions(-) diff --git a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml index 68ed8ce149..7879170539 100644 --- a/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml @@ -67,3 +67,10 @@ tags: - Splunk Cloud risk_score: 54 security_domain: access +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azuread/azure-audit.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml index a70c414c67..b7df11a0bb 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -63,3 +63,14 @@ tags: - Splunk Cloud risk_score: 90 security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/crowdstrike_falcon.log + source: crowdstrike + sourcetype: crowdstrike:events:sensor diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml index 6b906a69bc..b9a8092158 100644 --- a/detections/endpoint/bits_job_persistence.yml +++ b/detections/endpoint/bits_job_persistence.yml @@ -68,3 +68,14 @@ tags: - Splunk Cloud risk_score: 56 security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log + source: crowdstrike + sourcetype: crowdstrike:events:sensor diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml index b7e1ee5981..140a699864 100644 --- a/detections/endpoint/bitsadmin_download_file.yml +++ b/detections/endpoint/bitsadmin_download_file.yml @@ -74,3 +74,14 @@ tags: - Splunk Cloud risk_score: 49 security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log + source: crowdstrike + sourcetype: crowdstrike:events:sensor diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml index 7b17b8fe24..1d24b36a53 100644 --- a/detections/endpoint/creation_of_shadow_copy.yml +++ b/detections/endpoint/creation_of_shadow_copy.yml @@ -59,3 +59,14 @@ tags: - Splunk Cloud risk_score: 81 security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/crowdstrike_falcon.log + source: crowdstrike + sourcetype: crowdstrike:events:sensor diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index 939a5bad5a..e05d67b4c4 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -69,3 +69,14 @@ tags: - Splunk Cloud risk_score: 80 security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/crowdstrike_falcon.log + source: crowdstrike + sourcetype: crowdstrike:events:sensor diff --git a/detections/endpoint/living_off_the_land.yml b/detections/endpoint/living_off_the_land.yml index 9cbca391e4..5e655a8383 100644 --- a/detections/endpoint/living_off_the_land.yml +++ b/detections/endpoint/living_off_the_land.yml @@ -38,9 +38,6 @@ tags: - Living Off The Land asset_type: Endpoint confidence: 70 - drilldown_search: '| from datamodel:"Risk.All_Risk" - | search risk_object="$risk_object$" risk_object_type="$risk_object_type$" annotations.analytic_story="$annotations.analytic_story$" annotations.mitre_attack.mitre_tactic="$annotations.mitre_attack.mitre_tactic$" - | `get_correlations` | rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique' impact: 90 message: An increase of Living Off The Land behavior has been detected on $affected_systems$ mitre_attack_id: diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml index 9e7eb21fc9..ebc52f4f11 100644 --- a/detections/endpoint/windows_disable_memory_crash_dump.yml +++ b/detections/endpoint/windows_disable_memory_crash_dump.yml @@ -70,3 +70,9 @@ tags: - Splunk Cloud risk_score: 90 security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml index 4ebecf9013..14c31271e8 100644 --- a/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml +++ b/detections/endpoint/windows_indirect_command_execution_via_pcalua.yml @@ -46,3 +46,9 @@ tags: - Splunk Cloud risk_score: 25 security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog