From c9ecc29065fd014a3cb5ca396d966818e9cfce02 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 26 Apr 2022 12:06:47 -0600 Subject: [PATCH] recon --- detections/endpoint/recon_using_wmi_class.yml | 2 +- tests/endpoint/recon_using_wmi_class.test.yml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/recon_using_wmi_class.yml b/detections/endpoint/recon_using_wmi_class.yml index 7b7bf1ef0b..28a0a9ead6 100644 --- a/detections/endpoint/recon_using_wmi_class.yml +++ b/detections/endpoint/recon_using_wmi_class.yml @@ -37,7 +37,7 @@ tags: - Source:Endpoint - Stage:Discovery dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reconusingwmi.log impact: 75 kill_chain_phases: - Reconnaissance diff --git a/tests/endpoint/recon_using_wmi_class.test.yml b/tests/endpoint/recon_using_wmi_class.test.yml index 83de3af306..4cc79e8a7a 100644 --- a/tests/endpoint/recon_using_wmi_class.test.yml +++ b/tests/endpoint/recon_using_wmi_class.test.yml @@ -7,6 +7,6 @@ tests: latest_time: now attack_data: - file_name: windows-powershell.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/pwsh/windows-powershell.log - source: WinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: WinEventLog + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reconusingwmi.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog