Skip to content

Commit 9ac0874

Browse files
swachchhanda000swachchhanda000
committed
chore: regression test
1 parent 47f6a09 commit 9ac0874

16 files changed

Lines changed: 289 additions & 0 deletions

File tree

‎regression_data/rules/windows/builtin/security/win_security_explicit_credential_local_logon/e3c6d245-7b8f-4e2a-c17f-a9d0e5b38f62.evtx‎

68 KB
Binary file not shown.

‎regression_data/rules/windows/builtin/security/win_security_explicit_credential_local_logon/e3c6d245-7b8f-4e2a-c17f-a9d0e5b38f62.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"Event": {
3+
"#attributes": {
4+
"xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
5+
},
6+
"System": {
7+
"Provider": {
8+
"#attributes": {
9+
"Name": "Microsoft-Windows-Security-Auditing",
10+
"Guid": "54849625-5478-4994-A5BA-3E3B0328C30D"
11+
}
12+
},
13+
"EventID": 4648,
14+
"Version": 0,
15+
"Level": 0,
16+
"Task": 12544,
17+
"Opcode": 0,
18+
"Keywords": "0x8020000000000000",
19+
"TimeCreated": {
20+
"#attributes": {
21+
"SystemTime": "2026-07-17T14:18:34.072213Z"
22+
}
23+
},
24+
"EventRecordID": 34382,
25+
"Correlation": {
26+
"#attributes": {
27+
"ActivityID": "C96B491C-1545-0001-6049-6BC94515DD01"
28+
}
29+
},
30+
"Execution": {
31+
"#attributes": {
32+
"ProcessID": 876,
33+
"ThreadID": 928
34+
}
35+
},
36+
"Channel": "Security",
37+
"Computer": "swachchhanda",
38+
"Security": null
39+
},
40+
"EventData": {
41+
"SubjectUserSid": "S-1-5-21-2555720767-1205513275-3893774561-1001",
42+
"SubjectUserName": "xodih",
43+
"SubjectDomainName": "SWACHCHHANDA",
44+
"SubjectLogonId": "0x85527",
45+
"LogonGuid": "00000000-0000-0000-0000-000000000000",
46+
"TargetUserName": "testuser",
47+
"TargetDomainName": "swachchhanda",
48+
"TargetLogonGuid": "00000000-0000-0000-0000-000000000000",
49+
"TargetServerName": "localhost",
50+
"TargetInfo": "localhost",
51+
"ProcessId": "0x378",
52+
"ProcessName": "C:\\Users\\xodih\\OneDrive\\Desktop\\LegacyHive.exe",
53+
"IpAddress": "-",
54+
"IpPort": "-"
55+
}
56+
}
57+
}

‎regression_data/rules/windows/builtin/security/win_security_explicit_credential_local_logon/info.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
id: 656bc011-29f1-4319-91f6-beeb530324e3
2+
description: N/A
3+
date: 2026-07-23
4+
author: Swachchhanda Shrawan Poudel (Nextron Systems)
5+
rule_metadata:
6+
- id: e3c6d245-7b8f-4e2a-c17f-a9d0e5b38f62
7+
title: Potentially Suspicious Explicit Credential Local Logon
8+
regression_tests_info:
9+
- name: Positive Detection Test
10+
type: evtx
11+
provider: Microsoft-Windows-Sysmon
12+
match_count: 1
13+
path: regression_data/rules/windows/builtin/security/win_security_explicit_credential_local_logon/e3c6d245-7b8f-4e2a-c17f-a9d0e5b38f62.evtx

‎regression_data/rules/windows/file/file_event/file_event_win_susp_registry_hive_file_creation/a7f3c891-2e4d-4b6a-9f8c-d5e2a1b04c73.evtx‎

68 KB
Binary file not shown.

‎regression_data/rules/windows/file/file_event/file_event_win_susp_registry_hive_file_creation/a7f3c891-2e4d-4b6a-9f8c-d5e2a1b04c73.json‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
{
2+
"Event": {
3+
"#attributes": {
4+
"xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
5+
},
6+
"System": {
7+
"Provider": {
8+
"#attributes": {
9+
"Name": "Microsoft-Windows-Sysmon",
10+
"Guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9"
11+
}
12+
},
13+
"EventID": 11,
14+
"Version": 2,
15+
"Level": 4,
16+
"Task": 11,
17+
"Opcode": 0,
18+
"Keywords": "0x8000000000000000",
19+
"TimeCreated": {
20+
"#attributes": {
21+
"SystemTime": "2026-07-23T03:55:35.646900Z"
22+
}
23+
},
24+
"EventRecordID": 79934,
25+
"Correlation": null,
26+
"Execution": {
27+
"#attributes": {
28+
"ProcessID": 3772,
29+
"ThreadID": 4276
30+
}
31+
},
32+
"Channel": "Microsoft-Windows-Sysmon/Operational",
33+
"Computer": "swachchhanda",
34+
"Security": {
35+
"#attributes": {
36+
"UserID": "S-1-5-18"
37+
}
38+
}
39+
},
40+
"EventData": {
41+
"RuleName": "-",
42+
"UtcTime": "2026-07-23 03:55:35.646",
43+
"ProcessGuid": "0197231E-90B7-6A61-E004-000000001300",
44+
"ProcessId": 8100,
45+
"Image": "C:\\Users\\xodih\\OneDrive\\Desktop\\LegacyHive.exe",
46+
"TargetFilename": "C:\\68f299a9-38d5-4afa-80fd-15507a774ba0\\ntuser.dat",
47+
"CreationUtcTime": "2026-07-23 03:55:35.646",
48+
"User": "swachchhanda\\xodih"
49+
}
50+
}
51+
}

‎regression_data/rules/windows/file/file_event/file_event_win_susp_registry_hive_file_creation/info.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
id: b87ac5c6-d231-477c-88da-9b02d909313f
2+
description: N/A
3+
date: 2026-07-23
4+
author: Swachchhanda Shrawan Poudel (Nextron Systems)
5+
rule_metadata:
6+
- id: a7f3c891-2e4d-4b6a-9f8c-d5e2a1b04c73
7+
title: Registry Hive File Staged Outside Standard User Profile Path
8+
regression_tests_info:
9+
- name: Positive Detection Test
10+
type: evtx
11+
provider: Microsoft-Windows-Sysmon
12+
match_count: 1
13+
path: regression_data/rules/windows/file/file_event/file_event_win_susp_registry_hive_file_creation/a7f3c891-2e4d-4b6a-9f8c-d5e2a1b04c73.evtx

‎regression_data/rules/windows/image_load/image_load_susp_offreg_dll_load/c9e5f013-4a6f-4d8c-9b0e-f7a4c3d26e95.evtx‎

68 KB
Binary file not shown.

‎regression_data/rules/windows/image_load/image_load_susp_offreg_dll_load/c9e5f013-4a6f-4d8c-9b0e-f7a4c3d26e95.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"Event": {
3+
"#attributes": {
4+
"xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
5+
},
6+
"System": {
7+
"Provider": {
8+
"#attributes": {
9+
"Name": "Microsoft-Windows-Sysmon",
10+
"Guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9"
11+
}
12+
},
13+
"EventID": 7,
14+
"Version": 3,
15+
"Level": 4,
16+
"Task": 7,
17+
"Opcode": 0,
18+
"Keywords": "0x8000000000000000",
19+
"TimeCreated": {
20+
"#attributes": {
21+
"SystemTime": "2026-07-23T03:55:35.591134Z"
22+
}
23+
},
24+
"EventRecordID": 79914,
25+
"Correlation": null,
26+
"Execution": {
27+
"#attributes": {
28+
"ProcessID": 3772,
29+
"ThreadID": 4276
30+
}
31+
},
32+
"Channel": "Microsoft-Windows-Sysmon/Operational",
33+
"Computer": "swachchhanda",
34+
"Security": {
35+
"#attributes": {
36+
"UserID": "S-1-5-18"
37+
}
38+
}
39+
},
40+
"EventData": {
41+
"RuleName": "-",
42+
"UtcTime": "2026-07-23 03:55:35.587",
43+
"ProcessGuid": "0197231E-90B7-6A61-E004-000000001300",
44+
"ProcessId": 8100,
45+
"Image": "C:\\Users\\xodih\\OneDrive\\Desktop\\LegacyHive.exe",
46+
"ImageLoaded": "C:\\Windows\\System32\\offreg.dll",
47+
"FileVersion": "10.0.26100.8737 (WinBuild.160101.0800)",
48+
"Description": "Offline registry DLL",
49+
"Product": "Microsoft® Windows® Operating System",
50+
"Company": "Microsoft Corporation",
51+
"OriginalFileName": "offreg.dll",
52+
"Hashes": "MD5=EB937FC238D60A91C02AE1038E8290FB,SHA256=E2641BD2B6600C21771C48443AE5339A8103729C434B78F5F7BA4B41040CE79A,IMPHASH=48472463F8365BD71B4D983D04D5966C",
53+
"Signed": "true",
54+
"Signature": "Microsoft Windows",
55+
"SignatureStatus": "Valid",
56+
"User": "swachchhanda\\xodih"
57+
}
58+
}
59+
}

‎regression_data/rules/windows/image_load/image_load_susp_offreg_dll_load/info.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
id: 1dfafeb7-1002-4ecc-9319-95a72d4d6d1a
2+
description: N/A
3+
date: 2026-07-23
4+
author: Swachchhanda Shrawan Poudel (Nextron Systems)
5+
rule_metadata:
6+
- id: c9e5f013-4a6f-4d8c-9b0e-f7a4c3d26e95
7+
title: Potentially Suspicious Image Load of Offreg.dll
8+
regression_tests_info:
9+
- name: Positive Detection Test
10+
type: evtx
11+
provider: Microsoft-Windows-Sysmon
12+
match_count: 1
13+
path: regression_data/rules/windows/image_load/image_load_susp_offreg_dll_load/c9e5f013-4a6f-4d8c-9b0e-f7a4c3d26e95.evtx

‎regression_data/rules/windows/process_creation/proc_creation_win_susp_cross_user_process_spawn/d2b7a134-9c3e-4f8a-b56d-e0c1f8a29b47.evtx‎

68 KB
Binary file not shown.

0 commit comments

Comments
 (0)