Ryuktestsfiles

tests/endpoint/ryuk_test_files_detected.test.yml

@@ -0,0 +1,10 @@
+name:  Ryuk Test Files Detected
+detections:
+- name:  Ryuk Test Files Detected
+  file: detections/endpoint/ryuk_test_files_detected.yml
+  pass_condition: '| stats count | where count > 0'
+- attack_data: 
+  file_name: windows-sysmon.log
+  data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1486.all/Ryuk_Test_Files_Detected_57d44d70-28d9-4ed1-acf5-1c80ae2bbce3.json
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+  sourcetype: xmlwineventlog

tests/endpoint/windows_conhost_exe_force_flag.test.yml

@@ -0,0 +1,10 @@
+name:  Windows connhost exe started forcefully
+detections:
+- name:  Windows connhost exe started forcefully
+  file: detections/endpoint/windows_connhost_exe_force_flag.yml
+  pass_condition: '| stats count | where count > 0'
+- attack_data:
+  file_name: windows-sysmon.log
+  data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1059.all/Windows_connhost_exe_started_forcefully_c114aaca-68ee-41c2-ad8c-32bf21db8769.json
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+  sourcetype: xmlwineventlog

tests/endpoint/windows_disableantispyware_reg.test.yml

@@ -0,0 +1,10 @@
+name:  Windows DisableAntiSpyware Registry
+detections:
+- name:  Windows DisableAntiSpyware Registry
+  file: detections/endpoint/windows_disableantispyware_reg.yml
+  pass_condition: '| stats count | where count > 0'
+- attack_data:
+  file_name: windows-sysmon.log
+  data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1562.001/Windows_DisableAntiSpyware_Registry_23150a40-9301-4195-b802-5bb4f43067fb.json
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+  sourcetype: xmlwineventlog

tests/endpoint/windows_security_account_manager_stopped.test.yml

@@ -0,0 +1,10 @@
+name:  Windows Security Account Manager Stopped
+detections:
+- name:  Windows Security Account Manager Stopped
+  file: detections/endpoint/windows_security_account_manager_stopped.yml
+  pass_condition: '| stats count | where count > 0'
+- attack_data:
+  file_name: windows-sysmon.log
+  data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1489.all/windows_security_account_manager_stopped_69c12d59-d951-431e-ab77-ec426b8d65e6.json
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+  sourcetype: xmlwineventlog