From f64fbd6edea9f72d8290409f2b8d4adba5d5d89a Mon Sep 17 00:00:00 2001 From: peter-cg <682716+peter-cg@users.noreply.github.com> Date: Tue, 27 Jul 2021 21:12:21 -0500 Subject: [PATCH] Bump a test to force CI to do something --- .../ssa___rare_parent_process_relationship_lolbas.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/ssa___rare_parent_process_relationship_lolbas.test.yml b/tests/endpoint/ssa___rare_parent_process_relationship_lolbas.test.yml index 057ea4115e..46c1935cb2 100644 --- a/tests/endpoint/ssa___rare_parent_process_relationship_lolbas.test.yml +++ b/tests/endpoint/ssa___rare_parent_process_relationship_lolbas.test.yml @@ -3,7 +3,7 @@ tests: - name: Rare Parent/Child Process Relationship with LOLBAS file: endpoint/ssa___rare_parent_process_relationship_lolbas.yml pass_condition: '@count_gt(0)' - description: Test detection looking for LOLBAS processes spawned by other processes that are rarely seen together + description: Test detection looking for LOLBAS processes spawned by other processes that are only rarely seen together attack_data: - file_name: windows-sec-events.out data: https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sec-events.out