From 1836583f3741d6b626ef9aad2ea1eaedd3ba6efe Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-177-201>
Date: Fri, 9 Oct 2020 10:46:46 +0000
Subject: [PATCH] Added detection testing service results inWindows Event Log
 Cleared

---
 detections/windows_event_log_cleared.yml | 33 ++++++++++++++----------
 1 file changed, 19 insertions(+), 14 deletions(-)

diff --git a/detections/windows_event_log_cleared.yml b/detections/windows_event_log_cleared.yml
index 33e64c69a9..f4ca2522e5 100644
--- a/detections/windows_event_log_cleared.yml
+++ b/detections/windows_event_log_cleared.yml
@@ -1,31 +1,35 @@
-name: Windows Event Log Cleared
-id: ad517544-aff9-4c96-bd99-d6eb43bfbb6a
-version: 4
+author: Rico Valdez, Splunk
 date: '2020-07-06'
 description: This search looks for Windows events that indicate one of the Windows
   event logs has been purged.
 how_to_implement: To successfully implement this search, you need to be ingesting
   Windows event logs from your hosts.
-type: ESCU
-references: []
-author: Rico Valdez, Splunk
-search: (`wineventlog_security` (EventCode=1102 OR EventCode=1100)) OR (`wineventlog_system` EventCode=104)
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode dest
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_event_log_cleared_filter`
+id: ad517544-aff9-4c96-bd99-d6eb43bfbb6a
 known_false_positives: It is possible that these logs may be legitimately cleared
   by Administrators.
+name: Windows Event Log Cleared
+references: []
+search: (`wineventlog_security` (EventCode=1102 OR EventCode=1100)) OR (`wineventlog_system`
+  EventCode=104) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode
+  dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `windows_event_log_cleared_filter`
 tags:
   analytics_story:
   - Windows Log Manipulation
   - Ransomware
-  mitre_attack_id:
-  - T1070.001
-  kill_chain_phases:
-  - Actions on Objectives
+  asset_type: Endpoint
+  automated_detection_testing: passed
   cis20:
   - CIS 3
   - CIS 5
   - CIS 6
+  dataset:
+  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1070.001/windows-security.log
+  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1070.001/windows-system.log
+  kill_chain_phases:
+  - Actions on Objectives
+  mitre_attack_id:
+  - T1070.001
   nist:
   - DE.DP
   - PR.IP
@@ -33,4 +37,5 @@ tags:
   - PR.AT
   - DE.AE
   security_domain: endpoint
-  asset_type: Endpoint
+type: ESCU
+version: 4