From db61bb0c56f38da5b22de00832870ffc8dc6bd76 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Fri, 25 Mar 2022 12:54:57 -0700 Subject: [PATCH] Changes paths to data since it is in an open PR --- .../windows_indirect_command_execution_via_forfiles.test.yml | 2 +- .../windows_indirect_command_execution_via_pcalua.test.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml b/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml index c5cd2548ea..0cb28311cf 100644 --- a/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml +++ b/tests/endpoint/windows_indirect_command_execution_via_forfiles.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/T1202/atomic_red_team/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/InDirectToVideoData/master/datasets/T1202/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml b/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml index 1465a8a32a..d8a12ad6bd 100644 --- a/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml +++ b/tests/endpoint/windows_indirect_command_execution_via_pcalua.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/T1202/atomic_red_team/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/InDirectToVideoData/datasets/T1202/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file