Merge branch 'detection_testing_part_two' of https://github.com/splunk/security-content into detection_testing_part_two

detections/endpoint/schtasks_used_for_forcing_a_reboot.yml

@@ -12,10 +12,10 @@ references: []
 author: Bhavin Patel, Splunk
 search: '| tstats `security_content_summariesonly` values(Processes.process) as process
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.process_name=schtasks.exe Processes.process="*shutdown*" Processes.process="*/create *"
-  by Processes.process_name Processes.parent_process_name
-  Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `schtasks_used_for_forcing_a_reboot_filter`'
+  where Processes.process_name=schtasks.exe Processes.process="*shutdown*" Processes.process="*/create
+  *" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `schtasks_used_for_forcing_a_reboot_filter`'
 known_false_positives: Administrators may create jobs on systems forcing reboots to
   perform updates, maintenance, etc.
 tags:
@@ -32,3 +32,6 @@ tags:
   - PR.IP
   security_domain: endpoint
   asset_type: Endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtask_shutdown/windows-sysmon.log

detections/endpoint/single_letter_process_on_endpoint.yml

@@ -1,7 +1,7 @@
 name: Single Letter Process On Endpoint
 id: a4214f0b-e01c-41bc-8cc4-d2b71e3056b4
-version: 2
-date: '2019-04-01'
+version: 3
+date: '2020-12-08'
 description: This search looks for process names that consist only of a single letter.
 how_to_implement: You must be ingesting data that records process activity from your
   hosts to populate the Endpoint data model in the Processes node. You must also be
@@ -23,6 +23,8 @@ known_false_positives: Single-letter executables are not always malicious. Inves
 tags:
   analytics_story:
   - DHS Report TA18-074A
+  mitre_attack_id:
+  - T1204.002
   kill_chain_phases:
   - Actions on Objectives
   cis20:

tests/endpoint/single_letter_process_on_endpoint.test.yml

@@ -0,0 +1,12 @@
+name: Single Letter Process On Endpoint Unit Test
+tests:
+- name: Single Letter Process On Endpoint
+  file: endpoint/single_letter_process_on_endpoint.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1204.002/single_letter_exe/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog