Added detection testing service results inGet ADUserResultantPasswordPolicy with Powershell Script Block

detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml

@@ -6,18 +6,18 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy. 
-  This command can be used by attacker to mapped all password policy in a target host. This command may cause some noise especially 
-  in admin user that can execute this for policy audit. This hunting query is a good pivot to start investigating possible lateral movement or 
-  credential dumping as post attack.
-search: '`powershell` EventCode=4104 Message ="*Get-ADUserResultantPasswordPolicy*" 
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
+description: This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy.
+  This command can be used by attacker to mapped all password policy in a target host.
+  This command may cause some noise especially in admin user that can execute this
+  for policy audit. This hunting query is a good pivot to start investigating possible
+  lateral movement or credential dumping as post attack.
+search: '`powershell` EventCode=4104 Message ="*Get-ADUserResultantPasswordPolicy*"
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
+  ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `get_aduserresultantpasswordpolicy_with_powershell_script_block_filter`'
-how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. 
-  Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, 
-  or PowerShell Script Block Logging.
+how_to_implement: The following Hunting analytic requires PowerShell operational logs
+  to be imported. Modify the powershell macro as needed to match the sourcetype or
+  add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: network operator may use this command
 references:
 - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
@@ -37,18 +37,18 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message 
-  - ComputerName 
+  - Message
+  - ComputerName
   - User
   security_domain: endpoint
   impact: 30
   confidence: 30
-  # (impact * confidence)/100
   risk_score: 9
   context:
   - source:endpoint
   - stage:Reconnaissance
-  message: powershell process having commandline $Message$ to query domain user password policy.
+  message: powershell process having commandline $Message$ to query domain user password
+    policy.
   observable:
   - name: ComputerName
     type: Hostname
@@ -57,4 +57,5 @@ tags:
   - name: User
     type: User
     role:
-    - Victim
+    - Victim
+  automated_detection_testing: passed