Better checks for file deletion over SMB2

diff --git a/tests/smb2-07/test.yaml b/tests/smb2-07/test.yaml
index 5e55971506647ea0f99360533b1ca53cb315a910..849c9dcee643bacfe8f6546ed1ddb7831c6b22dd 100644 (file)
--- a/tests/smb2-07/test.yaml
+++ b/tests/smb2-07/test.yaml
@@ -11,9 +11,22 @@ args:
 
 checks:
   - filter:
+      version: 6
       count: 58
       match:
         event_type: smb
+  - filter:
+      min-version: 7
+      count: 59
+      match:
+        event_type: smb
+  - filter:
+      min-version: 7
+      count: 1
+      match:
+        event_type: smb
+        smb.access: "delete on close"
+        smb.filename: "PSEXESVC.exe"
   - filter:
       count: 1
       match: