From 32a899cb309eb7fb5bfd0b068b283ea2b192fac1 Mon Sep 17 00:00:00 2001
From: josehelps <josehelps@gmail.com>
Date: Tue, 18 Oct 2022 13:14:12 -0400
Subject: [PATCH] removing the testing detection

---
 detections/endpoint/ssa___wmic_exe.yml | 77 --------------------------
 tests/endpoint/ssa___wmic_exe.test.yml | 13 -----
 2 files changed, 90 deletions(-)
 delete mode 100644 detections/endpoint/ssa___wmic_exe.yml
 delete mode 100644 tests/endpoint/ssa___wmic_exe.test.yml

diff --git a/detections/endpoint/ssa___wmic_exe.yml b/detections/endpoint/ssa___wmic_exe.yml
deleted file mode 100644
index 6f5c6c87b9..0000000000
--- a/detections/endpoint/ssa___wmic_exe.yml
+++ /dev/null
@@ -1,77 +0,0 @@
-name: Windows Rename System Utilities Wmic exe LOLBAS in Non Standard Path
-id: 42c9b37c-6928-4e54-8043-2d5265d972dd
-version: 1
-date: '2022-10-13'
-author: Splunk Threat Research Bot, Splunk
-type: Anomaly
-datamodel:
-- Endpoint_Processes
-description: The following analytic identifies Wmic.exe which is a native living off
-  the land binary or script (LOLBAS) within the Windows operating system that may
-  be abused by adversaries by moving it to a new directory. The list of binaries was
-  derived from the https://lolbas-project.github.io site.
-search: ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
-  "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
-  "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
-  null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
-  null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
-  null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)| where
-  process_name IS NOT NULL AND process_name="wmic.exe"| where process_path IS NOT
-  NULL AND match_regex(process_path, /(?i)\\windows\\syswow64\\wbem/)=false | eval
-  start_time=timestamp,end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id",
-  event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();
-how_to_implement: To successfully implement this search, you must be ingesting logs
-  with the process name, command-line arguments, and parent processes from your endpoints.
-  Collect endpoint data such as Sysmon or Windows Events 4688.
-known_false_positives: False positives may be present and filtering may be required.
-  Certain utilities will run from non-standard paths based on the third-party application
-  in use.
-references:
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
-- https://attack.mitre.org/techniques/T1036/003/
-- https://lolbas-project.github.io/
-tags:
-  analytic_story:
-  - Unusual Processes
-  - Living Off The Land
-  cis20:
-  - CIS 8
-  confidence: 70
-  context:
-  - Source:Endpoint
-  - Stage:Defense Evasion
-  dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
-  impact: 20
-  kill_chain_phases:
-  - Actions on Objectives
-  message: A system process $process_name$ with path $process_path$ spawn in non-default
-    folder path on host $dest_device_id$
-  mitre_attack_id:
-  - T1036
-  - T1036.003
-  nist:
-  - PR.PT
-  - DE.CM
-  observable:
-  - name: dest_device_id
-    type: Hostname
-    role:
-    - Victim
-  - name: dest_user_id
-    type: User
-    role:
-    - Victim
-  product:
-  - Splunk Behavioral Analytics
-  required_fields:
-  - dest_device_id
-  - process_name
-  - _time
-  - dest_user_id
-  - process_path
-  risk_score: 14
-  risk_severity: low
-  security_domain: endpoint
-  asset_type: Endpoint
-file_path: ba_detection_template.yml
diff --git a/tests/endpoint/ssa___wmic_exe.test.yml b/tests/endpoint/ssa___wmic_exe.test.yml
deleted file mode 100644
index 7705da820b..0000000000
--- a/tests/endpoint/ssa___wmic_exe.test.yml
+++ /dev/null
@@ -1,13 +0,0 @@
-name: Windows Rename System Utilities Wmic exe LOLBAS in Non Standard Path Unit Test
-tests:
-- name: Windows Rename System Utilities Wmic exe LOLBAS in Non Standard Path
-  file: endpoint/ssa___wmic_exe.yml
-  pass_condition: '@count_eq(1)'
-  description: ' Test Windows Rename System Utilities Wmic exe LOLBAS in Non Standard
-    Path'
-  attack_data:
-  - file_name: dotnet_lolbin-windows-security.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/lolbas_dataset.log
-    source: WinEventLog:Security
-file_path: ba_test_template.yml
-file: endpoint/ssa___wmic_exe.yml