From bd5ca7860fa5f1d82e030d8ac16be163631027e3 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Thu, 26 Nov 2020 14:26:58 +0100 Subject: [PATCH] new detection test --- ..._installation_with_suspicious_parameters.test.yml | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 tests/endpoint/shim_database_installation_with_suspicious_parameters.test.yml diff --git a/tests/endpoint/shim_database_installation_with_suspicious_parameters.test.yml b/tests/endpoint/shim_database_installation_with_suspicious_parameters.test.yml new file mode 100644 index 0000000000..0f3991fbc0 --- /dev/null +++ b/tests/endpoint/shim_database_installation_with_suspicious_parameters.test.yml @@ -0,0 +1,12 @@ +name: Shim Database Installation With Suspicious Parameters Unit Test +tests: +- name: Shim Database Installation With Suspicious Parameters + file: endpoint/shim_database_installation_with_suspicious_parameters.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1546.011/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog