From c9ead8f05b2aeae6acc264c0b2d6a97571b8f6d1 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 14 Oct 2020 11:30:24 +0200 Subject: [PATCH] updates to new testing structure --- automated_detection_testing/detection_service.py | 2 +- tests/T1003_001.yml | 5 +++++ tests/T1003_002.yml | 1 + tests/T1082.yml | 1 + 4 files changed, 8 insertions(+), 1 deletion(-) diff --git a/automated_detection_testing/detection_service.py b/automated_detection_testing/detection_service.py index c0245eb825..315478ba8a 100644 --- a/automated_detection_testing/detection_service.py +++ b/automated_detection_testing/detection_service.py @@ -146,7 +146,7 @@ def main(args): for test in results['results']: if not test['error']: - file_path = 'security-content/detections/' + test['detection'].replace(' ', '_').replace('-','_').replace('.','_').replace('/','_').lower() + '.yml' + file_path = 'security-content/detections/' + test['detection_file'] detection_obj = load_file(file_path) detection_obj['tags']['automated_detection_testing'] = 'passed' if 'attack_data' in test_file: diff --git a/tests/T1003_001.yml b/tests/T1003_001.yml index 4b9a99ce00..337a5e819a 100644 --- a/tests/T1003_001.yml +++ b/tests/T1003_001.yml @@ -1,14 +1,19 @@ name: Credential Dumping LSASS memory test detections: - name: Access LSASS Memory for Dump Creation + file: endpoint/access_lsass_memory_for_dump_creation.yml pass_condition: '| stats count | where count > 0' - name: Create Remote Thread into LSASS + file: endpoint/create_remote_thread_into_lsass.yml pass_condition: '| stats count | where count > 0' - name: Detect Credential Dumping through LSASS access + file: endpoint/detect_credential_dumping_through_lsass_access.yml pass_condition: '| stats count | where count > 0' - name: Dump LSASS via comsvcs DLL + file: endpoint/dump_lsass_via_comsvcs_dll.yml pass_condition: '| stats count | where count > 0' - name: Unsigned Image Loaded by LSASS + file: endpoint/unsigned_image_loaded_by_lsass.yml pass_condition: '| stats count | where count > 0' description: Test credential dumping detections target: default-attack-range-windows-domain-controller diff --git a/tests/T1003_002.yml b/tests/T1003_002.yml index 436e9fff65..2e4517e40f 100644 --- a/tests/T1003_002.yml +++ b/tests/T1003_002.yml @@ -1,6 +1,7 @@ name: Credential Dumping sam test detections: - name: Attempted Credential Dump From Registry via Reg exe + file: endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml pass_condition: '| stats count | where count > 0' description: Test credential dumping detections target: default-attack-range-windows-domain-controller diff --git a/tests/T1082.yml b/tests/T1082.yml index fb234aaf6f..8efe645dd0 100644 --- a/tests/T1082.yml +++ b/tests/T1082.yml @@ -1,6 +1,7 @@ name: System Information Discovery detections: - name: System Information Discovery Detection + file: endpoint/system_information_discovery_detection.yml pass_condition: '| stats count | where count > 0' description: Test System Information Discovery Detection target: default-attack-range-windows-domain-controller