splunk-security_content/tests/endpoint/ssa___attempt_to_delete_services.test.yml

name: Attempt To delete Services Unit Test
tests:
  - name: Attempt To delete Services
    file: endpoint/ssa___attempt_to_delete_services.yml
    pass_condition: '@count_gt(0)'
    description: Test for usage of sc.exe to delete a service
    attack_data:
      - file_name: sc_del.log
        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_del.log
        source: WinEventLog:Security