name: Setting Credentials via PowerSploit modules - SSA Unit test
tests:
  - name: Setting Credentials via PowerSploit modules
    file: endpoint/ssa___setting_credentials_via_powersploit_modules.yml
    pass_condition: '@count_gt(0)'
    description: Test illegal credential setting detections
    attack_data:
      - file_name: logAllPowerSploitModulesWithOldNames.log
        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
        source: WinEventLog:Security