From ede365c0155438669809a1b1171724d39b2ba6e7 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 9 Nov 2020 08:43:16 +0000 Subject: [PATCH 1/2] Added detection testing service results inCommon Ransomware Extensions --- detections/endpoint/common_ransomware_extensions.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index 1b0029f22a..769cd03188 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -48,3 +48,6 @@ tags: - DE.CM security_domain: endpoint asset_type: Endpoint + automated_detection_testing: passed + dataset: + - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1485_custom_215ee4f9-c027-4ea1-a882-d97b887d233d/windows-sysmon.log From ffb6fb540922276b79e94a2bff9749083c423118 Mon Sep 17 00:00:00 2001 From: root Date: Mon, 9 Nov 2020 08:51:52 +0000 Subject: [PATCH 2/2] Added detection testing service results inCommon Ransomware Notes --- detections/endpoint/common_ransomware_notes.yml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/common_ransomware_notes.yml b/detections/endpoint/common_ransomware_notes.yml index 40f93f5e69..80a66f6fe2 100644 --- a/detections/endpoint/common_ransomware_notes.yml +++ b/detections/endpoint/common_ransomware_notes.yml @@ -15,8 +15,8 @@ author: David Dorsey, Splunk search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Filesystem.user) as user values(Filesystem.dest) as dest values(Filesystem.file_path) as file_path from datamodel=Endpoint.Filesystem by Filesystem.file_name | `drop_dm_object_name(Filesystem)` - | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `ransomware_notes` | - `common_ransomware_notes_filter`' + | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `ransomware_notes` + | `common_ransomware_notes_filter`' known_false_positives: It's possible that a legitimate file could be created with the same name used by ransomware note files. tags: @@ -34,3 +34,6 @@ tags: - DE.CM security_domain: endpoint asset_type: Endpoint + automated_detection_testing: passed + dataset: + - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1485_custom_cc81aa13-3899-4d33-b5c5-8a6e30eca28b/windows-sysmon.log