Added detection testing service results inGet DomainPolicy with Powershell Script Block

detections/endpoint/get_domainpolicy_with_powershell_script_block.yml

@@ -6,16 +6,16 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This search is to detect a possible execution of powerview pentesting tool for domain controller recon. 
-  This search look for function Get-DomainPolicy to parse the domain policy of the targeted host. 
-  This TTP may be a good pivot to look for credential dumping technique or lateral movement.
-search: '`powershell` EventCode=4104 Message ="*Get-DomainPolicy*" 
-  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User 
-  | `security_content_ctime(firstTime)`
+description: This search is to detect a possible execution of powerview pentesting
+  tool for domain controller recon. This search look for function Get-DomainPolicy
+  to parse the domain policy of the targeted host. This TTP may be a good pivot to
+  look for credential dumping technique or lateral movement.
+search: '`powershell` EventCode=4104 Message ="*Get-DomainPolicy*" | stats count min(_time)
+  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `get_domainpolicy_with_powershell_script_block_filter`'
-how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. 
-  Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, 
-  or PowerShell Script Block Logging.
+how_to_implement: The following Hunting analytic requires PowerShell operational logs
+  to be imported. Modify the powershell macro as needed to match the sourcetype or
+  add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
 known_false_positives: unknown
 references:
 - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet
@@ -35,13 +35,12 @@ tags:
   required_fields:
   - _time
   - EventCode
-  - Message 
-  - ComputerName 
+  - Message
+  - ComputerName
   - User
   security_domain: endpoint
   impact: 50
   confidence: 60
-  # (impact * confidence)/100
   risk_score: 30
   context:
   - source:endpoint
@@ -55,4 +54,5 @@ tags:
   - name: User
     type: User
     role:
-    - Victim
+    - Victim
+  automated_detection_testing: passed