diff --git a/automated_detection_testing/detection_service.py b/automated_detection_testing/detection_service.py index bb025e0042..551082241b 100644 --- a/automated_detection_testing/detection_service.py +++ b/automated_detection_testing/detection_service.py @@ -105,13 +105,6 @@ def main(args): with open('attack_range/attack_range.conf', 'w') as file: file.write(filedata) - # check if terraform is installed - if which('terraform') is None: - sys.exit(1) - else: - # init terraform - os.system('cd attack_range/terraform/aws && terraform init && cd ../../..') - module = __import__('attack_range') module.sys.argv = ['attack_range', '--config', 'attack_range/attack_range.conf', 'test', '--test_file', 'security_content/tests/' + test_file_name] diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index 66340c90e9..15b2561964 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -70,7 +70,7 @@ splunk-sdk==1.6.15 tabulate==0.8.9 termcolor==1.1.0 toml==0.10.2 -urllib3==1.26.4 +urllib3==1.26.5 virtualenv==20.4.6 wcwidth==0.2.5 wget==3.2 diff --git a/bin/appinspect.sh b/bin/appinspect.sh index 7ac93bb9f7..ddc16870d6 100755 --- a/bin/appinspect.sh +++ b/bin/appinspect.sh @@ -40,7 +40,7 @@ APPINSPECT_TOKEN=$(curl -s --location --request GET 'https://api.splunk.com/2.0/ sleep 1 # submit a inspection job EXPECTS app on same directory #REQUEST_ID=$(curl -s --location --request POST 'https://appinspect.splunk.com/v1/app/validate' --header "Authorization: bearer $APPINSPECT_TOKEN" --form 'app_package=@"/home/circleci/DA-ESS-ContentUpdate-latest.tar.gz"' | jq -r '.request_id') -REQUEST_ID=$(curl -s --location --request POST 'https://appinspect.splunk.com/v1/app/validate' --header "Authorization: bearer $APPINSPECT_TOKEN" --form 'app_package=@'$PACKAGE_PATH | jq -r '.request_id') +REQUEST_ID=$(curl -s --location --request POST 'https://appinspect.splunk.com/v1/app/validate' --header "Authorization: bearer $APPINSPECT_TOKEN" --form 'included_tags="cloud"' --form 'app_package=@'$PACKAGE_PATH | jq -r '.request_id') echo "app inspect request: $REQUEST_ID" sleep 5 STATUS=$(curl -s --location --request GET https://appinspect.splunk.com/v1/app/validate/status/$REQUEST_ID --header "Authorization: bearer $APPINSPECT_TOKEN" | jq -r '.status') diff --git a/bin/jinja2_templates/savedsearches.j2 b/bin/jinja2_templates/savedsearches.j2 index d80c836797..ba0df448e9 100644 --- a/bin/jinja2_templates/savedsearches.j2 +++ b/bin/jinja2_templates/savedsearches.j2 @@ -84,11 +84,11 @@ action.email.useNSSubject = 1 alert.digest_mode = 1 {% if detection.disabled is defined %} disabled = false -allow_skew = 100% {% else %} disabled = true {% endif %} enableSched = 1 +allow_skew = 100% counttype = number of events relation = greater than quantity = 0 diff --git a/bin/ssa-end-to-end-testing/requirements.txt b/bin/ssa-end-to-end-testing/requirements.txt index df929bb9d2..6d5ea588d1 100644 --- a/bin/ssa-end-to-end-testing/requirements.txt +++ b/bin/ssa-end-to-end-testing/requirements.txt @@ -20,4 +20,4 @@ six==1.15.0 smmap==3.0.5 toml==0.10.2 u-msgpack-python==2.7.1 -urllib3==1.26.4 +urllib3==1.26.5 diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml new file mode 100644 index 0000000000..c991e648d7 --- /dev/null +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -0,0 +1,49 @@ +name: Allow Inbound Traffic By Firewall Rule Registry +id: 0a46537c-be02-11eb-92ca-acde48001122 +version: 1 +date: '2021-05-26' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic detects a potential suspicious modification of firewall + rule registry allowing inbound traffic in specific port with public profile. This + technique was seen in some attacker want to have a remote access to a machine by + allowing the traffic in firewall rule. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" + Registry.registry_value_name = "*|Action=Allow|*" Registry.registry_value_name = + "*|Dir=In|*" Registry.registry_value_name = "*|Profile=Public|*" Registry.registry_value_name + = "*|LPort=*" by Registry.registry_path Registry.registry_key_name Registry.user + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `allow_inbound_traffic_by_firewall_rule_registry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: network admin may add/remove/modify public inbound firewall + rule that may cause this rule to be triggered. +references: +- https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps +tags: + analytic_story: + - Prohibited Traffic Allowed or Protocol Mismatch + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1021.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_path + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.dest + - Registry.user + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log diff --git a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml new file mode 100644 index 0000000000..8193070f70 --- /dev/null +++ b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml @@ -0,0 +1,44 @@ +name: Allow Inbound Traffic In Firewall Rule +id: a5d85486-b89c-11eb-8267-acde48001122 +version: 1 +date: '2021-05-19' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect suspicious powershell command to allow inbound + traffic in specific local port with public profile. This technique was seen in some + attacker want to have a remote access to a machine by allowing the traffic in firewall + rule. +search: '`powershell` EventCode=4104 Message = "*firewall*" Message = "*Public*" Message + = "*Inbound*" Message = "*Allow*" Message = "*-LocalPort*" | stats count min(_time) + as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `allow_inbound_traffic_in_firewall_rule_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the powershell logs from your endpoints. make sure you enable needed + registry to monitor this event. +known_false_positives: administrator may allow inbound traffic in certain network + or machine. +references: +- https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps +tags: + analytic_story: + - Prohibited Traffic Allowed or Protocol Mismatch + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1021.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml new file mode 100644 index 0000000000..eaf7807ce6 --- /dev/null +++ b/detections/endpoint/enable_rdp_in_other_port_number.yml @@ -0,0 +1,46 @@ +name: Enable RDP In Other Port Number +id: 99495452-b899-11eb-96dc-acde48001122 +version: 1 +date: '2021-05-19' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a modification to registry to enable rdp to + a machine with different port number. This technique was seen in some atttacker + tries to do lateral movement and remote access to a compromised machine to gain + control of it. +search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) + as registry_key_name values(Registry.registry_path) as registry_path min(_time) + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal + Server\\WinStations\\RDP-Tcp*" Registry.registry_key_name = "PortNumber" by Registry.dest + Registry.user Registry.registry_value_name | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `enable_rdp_in_other_port_number_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: unknown +references: +- https://www.mvps.net/docs/how-to-secure-remote-desktop-rdp/ +tags: + analytic_story: + - Prohibited Traffic Allowed or Protocol Mismatch + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1021 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_path + - Registry.dest + - Registry.user + - Registry.registry_value_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index daafa2b2bf..8edf6f4e6e 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -2,7 +2,7 @@ name: Excessive Usage of NSLOOKUP App id: 0a69fdaa-a2b8-11eb-b16d-acde48001122 version: 1 date: '2021-04-21' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Stanislav Miskovic, Splunk type: batch datamodel: - Endpoint @@ -12,12 +12,12 @@ description: this search is to detect potential DNS exfiltration using nslookup use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. -search: '| tstats `security_content_summariesonly` values(Processes.process) as process - values(Processes.process_id) as process_id values(Processes.parent_process) as parent_process - count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process_name = "nslookup.exe" by Processes.dest Processes.user Processes.process_name - | where count >= 30 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`| `excessive_usage_of_nslookup_app_filter`' +search: '`sysmon` EventCode = 1 process_name = "nslookup.exe" | bucket _time span=15m + | stats count as numNsLookup by Computer, _time | eventstats avg(numNsLookup) as + avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer | eval + upperThreshold=(avgNsLookup + stdNsLookup *3) | eval isOutlier=if(avgNsLookup > + 20 and avgNsLookup >= upperThreshold, 1, 0) | search isOutlier=1 | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `excessive_usage_of_nslookup_app_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the diff --git a/detections/endpoint/mailsniper_invoke_functions.yml b/detections/endpoint/mailsniper_invoke_functions.yml new file mode 100644 index 0000000000..b91f27648b --- /dev/null +++ b/detections/endpoint/mailsniper_invoke_functions.yml @@ -0,0 +1,45 @@ +name: Mailsniper Invoke functions +id: a36972c8-b894-11eb-9f78-acde48001122 +version: 1 +date: '2021-05-19' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect known mailsniper.ps1 functions executed in a + machine. This technique was seen in some attacker to harvest some sensitive e-mail + in a compromised exchange server. +search: '`powershell` EventCode=4104 Message IN ("*Invoke-GlobalO365MailSearch*", + "*Invoke-GlobalMailSearch*", "*Invoke-SelfSearch*", "*Invoke-PasswordSprayOWA*", + "*Invoke-PasswordSprayEWS*","*Invoke-DomainHarvestOWA*", "*Invoke-UsernameHarvestOWA*","*Invoke-OpenInboxFinder*","*Invoke-InjectGEventAPI*","*Invoke-InjectGEvent*","*Invoke-SearchGmail*", + "*Invoke-MonitorCredSniper*", "*Invoke-AddGmailRule*","*Invoke-PasswordSprayEAS*","*Invoke-UsernameHarvestEAS*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message + ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `mailsniper_invoke_functions_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the powershell logs from your endpoints. make sure you enable needed + registry to monitor this event. +known_false_positives: unknown +references: +- https://www.blackhillsinfosec.com/introducing-mailsniper-a-tool-for-searching-every-users-email-for-sensitive-data/ +tags: + analytic_story: + - Data Exfiltration + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1114.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml index ace3740572..89173358c8 100644 --- a/detections/endpoint/ransomware_notes_bulk_creation.yml +++ b/detections/endpoint/ransomware_notes_bulk_creation.yml @@ -9,7 +9,7 @@ datamodel: description: The following analytics identifies a big number of instance of ransomware notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This behavior is a good sensor if the ransomware note filename is quite new for security - industry or the ransomware note filename is not in your lookup table list for monitoring. + industry or the ransomware note filename is not in your ransomware lookup table list for monitoring. search: '`sysmon` EventCode=11 file_name IN ("*\.txt","*\.html","*\.hta") |bin _time span=10s | stats min(_time) as firstTime max(_time) as lastTime dc(TargetFilename) as unique_readme_path_count values(TargetFilename) as list_of_readme_path by Computer diff --git a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml new file mode 100644 index 0000000000..1a91a7be88 --- /dev/null +++ b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml @@ -0,0 +1,51 @@ +name: SecretDumps Offline NTDS Dumping Tool +id: 5672819c-be09-11eb-bbfb-acde48001122 +version: 1 +date: '2021-05-26' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic detects a potential usage of secretsdump.py tool for dumping + credentials (ntlm hash) from a copy of ntds.dit and SAM.Security,SYSTEM registrry + hive. This technique was seen in some attacker that dump ntlm hashes offline after + having a copy of ntds.dit and SAM/SYSTEM/SECURITY registry hive. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "python*.exe" + Processes.process = "*.py*" Processes.process = "*-ntds*" (Processes.process = "*-system*" + OR Processes.process = "*-sam*" OR Processes.process = "*-security*" OR Processes.process + = "*-bootkey*") by Processes.process_name Processes.process Processes.parent_process_name + Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `secretdumps_offline_ntds_dumping_tool_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py +tags: + analytic_story: + - Credential Dumping + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1003.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.parent_process + - Processes.dest Processes.user + - Processes.process_id + - Processes.process_guid + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log diff --git a/lookups/ransomware_extensions.csv b/lookups/ransomware_extensions.csv index 9e8fe7eff6..c50ec5dc9b 100644 --- a/lookups/ransomware_extensions.csv +++ b/lookups/ransomware_extensions.csv @@ -287,4 +287,12 @@ Extensions,Name .WNCRYT,WannaCry .RYK,Ryuk .Clop,Clop -.Cllp,Clop \ No newline at end of file +.Cllp,Clop +.JSWORM,JSWorm +.NEMTY_*,Nemty +.NEFILIM,Nefilim +.OFFWHITE,Offwhite +.TELEGRAM,Telegram +.FUSION,Fusion +.MILIHPEN,Milihpen +.GANGBANG,Gangbang \ No newline at end of file diff --git a/lookups/ransomware_extensions_lookup.yml b/lookups/ransomware_extensions_lookup.yml index eed0adad33..58bc6fde38 100644 --- a/lookups/ransomware_extensions_lookup.yml +++ b/lookups/ransomware_extensions_lookup.yml @@ -1,6 +1,7 @@ default_match: 'false' description: A list of file extensions that are associated with ransomware filename: ransomware_extensions.csv +match_type: WILDCARD(Extensions) min_matches: 1 name: ransomware_extensions_lookup case_sensitive_match: 'false' \ No newline at end of file diff --git a/lookups/ransomware_notes.csv b/lookups/ransomware_notes.csv index ecdfd2479d..04bf840433 100644 --- a/lookups/ransomware_notes.csv +++ b/lookups/ransomware_notes.csv @@ -58,4 +58,12 @@ HELP_DECRYPT_YOUR_FILES.HTML,True *-READ-FOR-HELLPP.html,True RyukReadMe.html,True ClopReadMe.txt,True -README_README.txt,True \ No newline at end of file +README_README.txt,True +JSWORM-DECRYPT.html,True +NEMTY_*-DECRYPT.txt,True +NEFILIM-DECRYPT.txt,True +OFFWHITE-MANUAL.txt,True +TELEGRAM-RECOVER.txt,True +FUSION-README.txt,True +MILIHPEN-INSTRUCT.txt,True +GANGBANG-NOTE.txt,True \ No newline at end of file diff --git a/requirements.txt b/requirements.txt index bde9d72885..cb37874b26 100644 --- a/requirements.txt +++ b/requirements.txt @@ -65,7 +65,7 @@ termcolor==1.1.0 toml==0.10.2 typing==3.7.4.3 tzlocal==2.1 -urllib3==1.26.4 +urllib3==1.26.5 virtualenv==20.4.6 wcwidth==0.2.5 webencodings==0.5.1 diff --git a/tests/endpoint/allow_inbound_traffic_by_firewall_rule_registry.test.yml b/tests/endpoint/allow_inbound_traffic_by_firewall_rule_registry.test.yml new file mode 100644 index 0000000000..39d282bf2b --- /dev/null +++ b/tests/endpoint/allow_inbound_traffic_by_firewall_rule_registry.test.yml @@ -0,0 +1,12 @@ +name: Allow Inbound Traffic By Firewall Rule Registry Unit Test +tests: +- name: Allow Inbound Traffic By Firewall Rule Registry + file: endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/allow_inbound_traffic_in_firewall_rule.test.yml b/tests/endpoint/allow_inbound_traffic_in_firewall_rule.test.yml new file mode 100644 index 0000000000..ac2dd09fa0 --- /dev/null +++ b/tests/endpoint/allow_inbound_traffic_in_firewall_rule.test.yml @@ -0,0 +1,12 @@ +name: Allow Inbound Traffic In Firewall Rule Unit Test +tests: +- name: Allow Inbound Traffic In Firewall Rule + file: endpoint/allow_inbound_traffic_in_firewall_rule.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/enable_rdp_in_other_port_number.test.yml b/tests/endpoint/enable_rdp_in_other_port_number.test.yml new file mode 100644 index 0000000000..25e3995cc1 --- /dev/null +++ b/tests/endpoint/enable_rdp_in_other_port_number.test.yml @@ -0,0 +1,12 @@ +name: Enable RDP In Other Port Number Unit Test +tests: +- name: Enable RDP In Other Port Number + file: endpoint/enable_rdp_in_other_port_number.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/mailsniper_invoke_functions.test.yml b/tests/endpoint/mailsniper_invoke_functions.test.yml new file mode 100644 index 0000000000..067c1bc19f --- /dev/null +++ b/tests/endpoint/mailsniper_invoke_functions.test.yml @@ -0,0 +1,12 @@ +name: Mailsniper Invoke functions Unit Test +tests: +- name: Mailsniper Invoke functions + file: endpoint/mailsniper_invoke_functions.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/secretdumps_offline_ntds_dumping_tool.test.yml b/tests/endpoint/secretdumps_offline_ntds_dumping_tool.test.yml new file mode 100644 index 0000000000..061bd35c35 --- /dev/null +++ b/tests/endpoint/secretdumps_offline_ntds_dumping_tool.test.yml @@ -0,0 +1,12 @@ +name: SecretDumps Offline NTDS Dumping Tool Unit Test +tests: +- name: SecretDumps Offline NTDS Dumping Tool + file: endpoint/secretdumps_offline_ntds_dumping_tool.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file