admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #575 from splunk/TR037-process-execution-via-wmi

Browse Source 
[TR-037] test for process execution via WMI (
This commit is contained in:
P4T12ICK
2020-07-29 10:12:23 +02:00
committed by GitHub
parent ee69edcd44 fc0a62a347
commit f09d5222ef
2 changed files with 26 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.circleci/config.yml
+19 -1
View File
@@ -4,7 +4,7 @@
#
#############
# Automatically generated by ci-generator.py in splunk/security-content
# On Date: 2020-07-28T13:43:38 UTC
# On Date: 2020-07-29T08:05:36 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -178,6 +178,24 @@ jobs:
terraform init
cd ..
python attack_range.py --mode terraform --action test --test_file ../security-content/tests/T1574_009.yml
- run:
name: detection tests > T1047.yml
command: |
cd attack_range
source venv/bin/activate
# change attack_range default ssh keys
sed -i "s/key_name = .*$/key_name = attack-range-ci-job-security-content/g" attack_range.conf
sed -i "s/automated_testing = .*$/automated_testing = 1/g" attack_range.conf
sed -i "s/github_token =.*$/github_token = ${GITHUB_TOKEN}/g" attack_range.conf
sed -i "s/region = us-west-2/region = us-east-2/g" attack_range.conf
sed -i "s/private_key_path =.*$/private_key_path = ~\/.ssh\/id_rsa_3968782b01d635eb784228581d9cbe90/g" attack_range.conf
sed -i "s/windows_domain_controller = .*$/windows_domain_controller = 1/g" attack_range.conf
sed -i "s/capture_attack_data = .*$/capture_attack_data = 1/g" attack_range.conf
sed -i "s/art_branch = .*$/art_branch = local-master/g" attack_range.conf
cd terraform/
terraform init
cd ..
python attack_range.py --mode terraform --action test --test_file ../security-content/tests/T1047.yml
- run:
name: detection tests > T1021_001.yml
command: |
tests/T1047.yml
+7
View File
@@ -0,0 +1,7 @@
name: Process Execution via WMI
detections:
- name: Process execution via wmi
pass_condition: '| stats count | where count = 1'
description: Test the WMI local process execution attack behavior
target: attack-range-windows-domain-controller
simulation_technique: 'T1047'