From d13a1896efcbf39273c46c6576ba8e4bbbc736de Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Fri, 19 Mar 2021 09:37:18 +0100 Subject: [PATCH] detection testing SSA --- ...pplying_stolen_credentials_via_mimikatz_modules.test.yml | 3 +++ ...ying_stolen_credentials_via_powersploit_modules.test.yml | 6 ++++-- ...ess_credential_strength_via_dsinternals_modules.test.yml | 6 ++++-- ...mpted_credential_dump_from_registry_via_reg_exe.test.yml | 1 + ...ntial_extraction_dsinternals_conversion_modules.test.yml | 6 ++++-- ...ssa___credential_extraction_dsinternals_modules.test.yml | 5 ++++- 6 files changed, 20 insertions(+), 7 deletions(-) diff --git a/tests/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.test.yml b/tests/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.test.yml index 86b99e4f54..d74531149e 100644 --- a/tests/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.test.yml +++ b/tests/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.test.yml @@ -7,4 +7,7 @@ tests: attack_data: - file_name: logAllMimikatzModules.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log + source: WinEventLog:Security + sourcetype: xmlwineventlog + update_timestamp: True diff --git a/tests/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.test.yml b/tests/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.test.yml index 0320b2baae..95e039ff68 100644 --- a/tests/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.test.yml +++ b/tests/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.test.yml @@ -6,5 +6,7 @@ tests: description: Test applying stolen credentials detections attack_data: - file_name: logAllPowerSploitModulesWithOldNames.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllPowerSploitModulesWithOldNames.log - + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllPowerSploitModulesWithOldNames.log + source: WinEventLog:Security + sourcetype: xmlwineventlog + update_timestamp: True diff --git a/tests/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.test.yml b/tests/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.test.yml index e3557ec3f8..3ff7a8521c 100644 --- a/tests/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.test.yml +++ b/tests/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.test.yml @@ -6,5 +6,7 @@ tests: description: Test assessment of credential strength detections attack_data: - file_name: logAllDSInternalsModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log - + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log + source: WinEventLog:Security + sourcetype: xmlwineventlog + update_timestamp: True diff --git a/tests/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.test.yml b/tests/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.test.yml index 68102f0fc1..d4a8c0ee83 100644 --- a/tests/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.test.yml +++ b/tests/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.test.yml @@ -10,3 +10,4 @@ tests: source: WinEventLog:Security sourcetype: xmlwineventlog update_timestamp: True + diff --git a/tests/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.test.yml b/tests/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.test.yml index 50545476f6..d9aa477450 100644 --- a/tests/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.test.yml +++ b/tests/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.test.yml @@ -6,5 +6,7 @@ tests: description: Test credential extraction detections attack_data: - file_name: logAllDSInternalsModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log - + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log + source: WinEventLog:Security + sourcetype: xmlwineventlog + update_timestamp: True diff --git a/tests/endpoint/ssa___credential_extraction_dsinternals_modules.test.yml b/tests/endpoint/ssa___credential_extraction_dsinternals_modules.test.yml index 719452df65..94c95be73d 100644 --- a/tests/endpoint/ssa___credential_extraction_dsinternals_modules.test.yml +++ b/tests/endpoint/ssa___credential_extraction_dsinternals_modules.test.yml @@ -6,5 +6,8 @@ tests: description: Test credential extraction detections attack_data: - file_name: logAllDSInternalsModules.log - data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/logAllDSInternalsModules.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log + source: WinEventLog:Security + sourcetype: xmlwineventlog + update_timestamp: True