Added detection testing service results inBITS Job Persistence

detections/endpoint/bits_job_persistence.yml

@@ -6,19 +6,23 @@ author: Michael Haag, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: The following query identifies Microsoft Background Intelligent Transfer Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint. The query identifies the parameters used to create, resume or add a file to a BITS job
+description: The following query identifies Microsoft Background Intelligent Transfer
+  Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint.
+  The query identifies the parameters used to create, resume or add a file to a BITS
+  job
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=bitsadmin.exe Processes.process IN 
-  (*create*, *addfile*, *setnotifyflags*, *setnotifycmdline*, *setminretrydelay*, *setcustomheaders*, *resume* ) by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `bits_job_persistence_filter`'
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=bitsadmin.exe
+  Processes.process IN (*create*, *addfile*, *setnotifyflags*, *setnotifycmdline*,
+  *setminretrydelay*, *setcustomheaders*, *resume* ) by Processes.dest Processes.user
+  Processes.parent_process Processes.process_name Processes.process Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `bits_job_persistence_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: Limited false positives will be present. Typically, applications will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments (legitimate applications) or parent process.
+known_false_positives: Limited false positives will be present. Typically, applications
+  will use `BitsAdmin.exe`. Any filtering should be done based on command-line arguments
+  (legitimate applications) or parent process.
 references:
 - https://attack.mitre.org/techniques/T1197/
 - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/bitsadmin
@@ -27,7 +31,8 @@ references:
 tags:
   analytic_story:
   - BITS Jobs
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -43,4 +48,5 @@ tags:
   - Processes.process_name
   - Processes.user
   - Processes.dest
-  security_domain: endpoint
+  security_domain: endpoint
+  automated_detection_testing: passed