From 65f19f025eb4839e6b1691d115fdca8a347930a5 Mon Sep 17 00:00:00 2001 From: Steve Baker Date: Tue, 29 Sep 2026 12:37:31 -0500 Subject: [PATCH] T1621 PingID: add UPN and multiple-reset regression fixture Add five synthetic PingID device-pairing events and six Windows 4723/4724 password events for PingID New MFA Method After Credential Reset. Cover UPN-to-bare username matching, multiple resets and nearest-reset selection, exclusion outside the one-hour window, and simultaneous pairings from distinct source IPs. Register both files in the manifest. Use lab identities and reserved documentation IPs. Companion to splunk/security_content#4298. Co-Authored-By: Claude Opus 5.5 --- datasets/attack_techniques/T1621/pingid/pingid.yml | 8 ++++++++ .../T1621/pingid/pingid_upn_multi_reset.log | 3 +++ .../T1621/pingid/windows_pw_reset_upn_multi_reset.log | 3 +++ 3 files changed, 14 insertions(+) create mode 100644 datasets/attack_techniques/T1621/pingid/pingid_upn_multi_reset.log create mode 100644 datasets/attack_techniques/T1621/pingid/windows_pw_reset_upn_multi_reset.log diff --git a/datasets/attack_techniques/T1621/pingid/pingid.yml b/datasets/attack_techniques/T1621/pingid/pingid.yml index b4c902684..4310caffb 100644 --- a/datasets/attack_techniques/T1621/pingid/pingid.yml +++ b/datasets/attack_techniques/T1621/pingid/pingid.yml @@ -15,3 +15,11 @@ datasets: path: /datasets/attack_techniques/T1621/pingid/windows_pw_reset.log sourcetype: XmlWinEventLog source: XmlWinEventLog:Security +- name: pingid_upn_multi_reset + path: /datasets/attack_techniques/T1621/pingid/pingid_upn_multi_reset.log + sourcetype: _json + source: PINGID +- name: windows_pw_reset_upn_multi_reset + path: /datasets/attack_techniques/T1621/pingid/windows_pw_reset_upn_multi_reset.log + sourcetype: XmlWinEventLog + source: XmlWinEventLog:Security diff --git a/datasets/attack_techniques/T1621/pingid/pingid_upn_multi_reset.log b/datasets/attack_techniques/T1621/pingid/pingid_upn_multi_reset.log new file mode 100644 index 000000000..c46da924f --- /dev/null +++ b/datasets/attack_techniques/T1621/pingid/pingid_upn_multi_reset.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:88c40b8ac88a337232ef97a5abb41c9a02eaf00eab0222d5035e1992b1f71030 +size 1605 diff --git a/datasets/attack_techniques/T1621/pingid/windows_pw_reset_upn_multi_reset.log b/datasets/attack_techniques/T1621/pingid/windows_pw_reset_upn_multi_reset.log new file mode 100644 index 000000000..b1a179066 --- /dev/null +++ b/datasets/attack_techniques/T1621/pingid/windows_pw_reset_upn_multi_reset.log @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:955603e9fd6db90ebea96592c2c3a2cf75039227b1120033d3a4d60ecc6df88b +size 5728