Delete ssa___delete_a_net_user.test.yml

This commit is contained in:
tccontre
2021-06-30 16:18:58 +02:00
committed by GitHub
parent af63b893ea
commit e1a7371e75
@@ -1,10 +0,0 @@
name: Delete A Net User Unit Test
tests:
- name: Delete A Net User
file: endpoint/ssa___delete_a_net_user.yml
pass_condition: '@count_gt(0)'
description: Test for usage of net.exe or net1.exe to delete net user
attack_data:
- file_name: net_user_del.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log
source: WinEventLog:Security