Skip to content

Commit 31caa64

Browse files
sbaker-gresbaker-gre
authored
T1621 PingID: add UPN and multiple-reset regression fixture (#1230)
Add five synthetic PingID device-pairing events and six Windows 4723/4724 password events for PingID New MFA Method After Credential Reset. Cover UPN-to-bare username matching, multiple resets and nearest-reset selection, exclusion outside the one-hour window, and simultaneous pairings from distinct source IPs. Register both files in the manifest.
1 parent 1a6ba6c commit 31caa64

3 files changed

Lines changed: 14 additions & 0 deletions

File tree

‎datasets/attack_techniques/T1621/pingid/pingid.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,3 +15,11 @@ datasets:
1515
path: /datasets/attack_techniques/T1621/pingid/windows_pw_reset.log
1616
sourcetype: XmlWinEventLog
1717
source: XmlWinEventLog:Security
18+
- name: pingid_upn_multi_reset
19+
path: /datasets/attack_techniques/T1621/pingid/pingid_upn_multi_reset.log
20+
sourcetype: _json
21+
source: PINGID
22+
- name: windows_pw_reset_upn_multi_reset
23+
path: /datasets/attack_techniques/T1621/pingid/windows_pw_reset_upn_multi_reset.log
24+
sourcetype: XmlWinEventLog
25+
source: XmlWinEventLog:Security

‎datasets/attack_techniques/T1621/pingid/pingid_upn_multi_reset.log‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
version https://git-lfs.github.com/spec/v1
2+
oid sha256:88c40b8ac88a337232ef97a5abb41c9a02eaf00eab0222d5035e1992b1f71030
3+
size 1605

‎datasets/attack_techniques/T1621/pingid/windows_pw_reset_upn_multi_reset.log‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
version https://git-lfs.github.com/spec/v1
2+
oid sha256:955603e9fd6db90ebea96592c2c3a2cf75039227b1120033d3a4d60ecc6df88b
3+
size 5728

0 commit comments

Comments
 (0)