From 3cf5054c6455f6b113b18ba25bfb765f8ee82cf1 Mon Sep 17 00:00:00 2001 From: Jose Enrique Hernandez Date: Wed, 30 Mar 2022 15:00:15 -0400 Subject: [PATCH] changing detection to use windows security logs --- tests/endpoint/ssa___fsutil_zeroing_file.test.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tests/endpoint/ssa___fsutil_zeroing_file.test.yml b/tests/endpoint/ssa___fsutil_zeroing_file.test.yml index 3f6202f8a0..f1ec271d45 100644 --- a/tests/endpoint/ssa___fsutil_zeroing_file.test.yml +++ b/tests/endpoint/ssa___fsutil_zeroing_file.test.yml @@ -5,6 +5,6 @@ tests: pass_condition: '@count_gt(0)' description: Test detection of FSUtil Zeroing File attack_data: - - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-security.log + source: WinEventLog:Security