name: FSUtil Zeroing File - SSA Unit Test
tests:
  - name: FSUtil Zeroing File
    file: endpoint/ssa___fsutil_zeroing_file.yml
    pass_condition: '@count_gt(0)'
    description: Test detection of FSUtil Zeroing File
    attack_data:
    - file_name: windows-sysmon.log
      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon.log
      source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational