Added detection testing service results inRemote Process Instantiation via WMI and PowerShell Script Block

detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml

@@ -7,19 +7,19 @@ type: TTP
 datamodel:
 - Endpoint
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
-  to identify the execution of the `Invoke-WmiMethod` commandlet with arguments utilized to start a process on a remote endpoint 
-  by abusing WMI. Red Teams and adversaries alike may abuse WMI and this commandlet for lateral movement and remote
-  code execution.
+  to identify the execution of the `Invoke-WmiMethod` commandlet with arguments utilized
+  to start a process on a remote endpoint by abusing WMI. Red Teams and adversaries
+  alike may abuse WMI and this commandlet for lateral movement and remote code execution.
 search: '`powershell` EventCode=4104 (Message="*Invoke-WmiMethod*" AND Message="*-CN*"
-  AND Message="*-Class Win32_Process*" AND Message="*-Name create*")
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
-  ComputerName User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_wmi_and_powershell_script_block_filter`'
+  AND Message="*-Class Win32_Process*" AND Message="*-Name create*") | stats count
+  min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName
+  User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_wmi_and_powershell_script_block_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
-  PowerShell Script Block Logging on some or all endpoints. Additional setup instructions can be found
-  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
-known_false_positives: Administrators may leverage WWMI and powershell.exe to start a process
-  on remote systems, but this activity is usually limited to a small set of hosts
-  or users.
+  PowerShell Script Block Logging on some or all endpoints. Additional setup instructions
+  can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: Administrators may leverage WWMI and powershell.exe to start
+  a process on remote systems, but this activity is usually limited to a small set
+  of hosts or users.
 references:
 - https://attack.mitre.org/techniques/T1047/
 - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1
@@ -49,9 +49,11 @@ tags:
   context:
   - Source:Endpoint
   - Stage:Lateral Movement
-  message: A process was started on a remote endpoint from $ComputerName by abusing WMI using PowerShell.exe
+  message: A process was started on a remote endpoint from $ComputerName by abusing
+    WMI using PowerShell.exe
   observable:
   - name: ComputerName
     type: Endpoint
     role:
-    - Victim
+    - Victim
+  automated_detection_testing: passed