Added detection testing service results inDomain Account Discovery With Net App

detections/endpoint/domain_account_discovery_with_net_app.yml

@@ -6,19 +6,21 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect a process command line for AD discovery. This techique is using the windows built in net.exe application 
-  to query AD users in the targetted machine. This techique was seen in several malware as part of there recon and can be a good pivot of analysis.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") AND Processes.process = "* user*" AND Processes.process = "*/do*" 
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  Processes.parent_process_name | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
+description: This search is to detect a process command line for AD discovery. This
+  techique is using the windows built in net.exe application to query AD users in
+  the targetted machine. This techique was seen in several malware as part of there
+  recon and can be a good pivot of analysis.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe"
+  OR Processes.process_name="net1.exe") AND Processes.process = "* user*" AND Processes.process
+  = "*/do*" by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `domain_account_discovery_with_net_app_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
+  Sysmon TA.
 known_false_positives: network operator can execute this command
 references:
 - https://docs.microsoft.com/en-us/defender-for-identity/playbook-domain-dominance
@@ -37,18 +39,17 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.dest 
-  - Processes.user 
-  - Processes.parent_process 
-  - Processes.process_name 
-  - Processes.process 
-  - Processes.process_id 
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
   - Processes.parent_process_id
   - Processes.parent_process_name
   security_domain: endpoint
   impact: 50
-  confidence: 50 
-  # (impact * confidence)/100
+  confidence: 50
   risk_score: 25
   context:
   - Source:Endpoint
@@ -66,4 +67,5 @@ tags:
   - name: parent_process_name
     type: Parent Process
     role:
-    - Parent Process
+    - Parent Process
+  automated_detection_testing: passed