admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-06-29 11:55:53 -07:00
committed by GitHub
parent 2920c25c93 73ea092e8d
commit c24b800476
3 changed files with 0 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/endpoint/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.test.yml
-10
View File
@@ -1,10 +0,0 @@
name: Potential Pass the Token or Hash Observed at the Destination Device Unit Test
tests:
- name: Potential Pass the Token or Hash Observed at the Destination Device
file: endpoint/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml
pass_condition: '@count_gt(0)'
description: Test Pass the Hash or Pass the Token Detection Observed by a Destination Device
attack_data:
- file_name: ptt_pth_kerb_ntlm_anon_dest_dataset.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.002/extracts_from_real_data/ptt_pth_kerb_ntlm_anon_dest_dataset.log
source: WinEventLog:Security
tests/endpoint/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.test.yml
-10
View File
@@ -1,10 +0,0 @@
name: Potential Pass the Token or Hash Observed by an Event Collecting Device Unit Test
tests:
- name: Potential Pass the Token or Hash Observed by an Event Collecting Device
file: endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml
pass_condition: '@count_gt(0)'
description: Test Pass the Hash or Pass the Token Detection Observed by an Event Collecting Device
attack_data:
- file_name: ptt_pth_kerb_ntlm_anon_DC_dataset.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1550.002/extracts_from_real_data/ptt_pth_kerb_ntlm_anon_DC_dataset.log
source: WinEventLog:Security
tests/endpoint/ssa___unusual_lolbas_in_short_period_of_time.test.yml
-10
View File
@@ -1,10 +0,0 @@
name: Unusual LOLBAS in short period of time Unit Test
tests:
- name: Unusual LOLBAS in short period of time
file: endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml
pass_condition: '@count_gt(0)'
description: Test more than usual lolbas being executed in a short period of time
attack_data:
- file_name: T1059.all.labeled.lolbas-test.json
data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/T1059.all.labeled.lolbas-test.json
source: WinEventLog:Security