From fd0b90bd2dfb651cecd9917a3f6dc9e9f7c0ea7f Mon Sep 17 00:00:00 2001
From: P4T12ICK <pbareib@splunk.com>
Date: Fri, 9 Oct 2020 11:28:23 +0200
Subject: [PATCH] new test file

---
 tests/T1070.001.yml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/tests/T1070.001.yml b/tests/T1070.001.yml
index 3b0d3f7264..4c77fc74a1 100644
--- a/tests/T1070.001.yml
+++ b/tests/T1070.001.yml
@@ -4,4 +4,9 @@ detections:
     pass_condition: '| stats count | where count = 4'
 description: Test Windows Event Logs cleared (atomic red team is not yet updated)
 target: default-attack-range-windows-domain-controller
-simulation_technique: 'T1551.001'
+simulation_technique: 'T1070.001'
+attack_data:
+  - file_name: windows-security.log
+    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1070.001/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog