From 5e36ce1cf3e07721aa6d904acac2fe4d60f99e68 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Fri, 10 Dec 2021 11:49:41 -0700 Subject: [PATCH] curleddd --- .../ssa___windows_curl_upload_to_remote_destination.yml | 2 +- ...ssa___windows_curl_upload_to_remote_destination.test.yml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml b/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml index c77d32a57e..03049346b9 100644 --- a/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml +++ b/detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml @@ -58,7 +58,7 @@ tags: - Source:Endpoint - Stage:Defense Evasion dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-security.log impact: 80 kill_chain_phases: - Exfiltration diff --git a/tests/endpoint/ssa___windows_curl_upload_to_remote_destination.test.yml b/tests/endpoint/ssa___windows_curl_upload_to_remote_destination.test.yml index 57cd2b8000..b92fd512b0 100644 --- a/tests/endpoint/ssa___windows_curl_upload_to_remote_destination.test.yml +++ b/tests/endpoint/ssa___windows_curl_upload_to_remote_destination.test.yml @@ -4,6 +4,6 @@ tests: file: endpoint/ssa___windows_curl_upload_to_remote_destination.yml pass_condition: '@count_gt(0)' attack_data: - - file_name: windows-sysmon_curl_upload.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational \ No newline at end of file + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-security.log + source: WinEventLog:security \ No newline at end of file