name: Credential Extraction indicative of use of PowerSploit modules - SSA Unit test
tests:
  - name: Credential Extraction indicative of use of PowerSploit modules
    file: endpoint/ssa___credential_extraction_powersploit_modules.yml
    pass_condition: '@count_gt(0)'
    description: Test credential extraction detections
    attack_data:
      - file_name: logAllPowerSploitModulesWithOldNames.log
        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
        source: WinEventLog:Security