From bd47446ef89f0486c662f03f7bcf84feb858787c Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 25 Mar 2022 14:47:55 -0700 Subject: [PATCH] Updated with correct dataset paths --- .../windows_indirect_command_execution_via_forfiles.test.yml | 2 +- .../windows_indirect_command_execution_via_pcalua.test.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml b/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml index 0cb28311cf..20467cb95d 100644 --- a/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml +++ b/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/InDirectToVideoData/master/datasets/T1202/atomic_red_team/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/InDirectToVideo/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml b/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml index d8a12ad6bd..980cf02d28 100644 --- a/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml +++ b/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/InDirectToVideoData/datasets/T1202/atomic_red_team/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/InDirectToVideo/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file