Added detection testing service results inLinux Service File Created In Systemd Directory

detections/endpoint/linux_service_file_created_in_systemd_directory.yml

@@ -6,22 +6,26 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic looks for suspicious file creation in systemd timer directory in linux platform. 
-  systemd is a system and service manager for Linux distributions. From the Windows perspective, this process fulfills the duties of wininit.exe and services.exe combined. 
-  At the risk of simplifying the functionality of systemd, it initializes a Linux system and starts relevant services that are defined in service unit files. 
-  Adversaries, malware and red teamers may abuse this this feature by stashing systemd service file to persist on the targetted or compromised host.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-  where Filesystem.file_name = *.service Filesystem.file_path IN ("*/etc/systemd/system*", "*/lib/systemd/system*", "*/usr/lib/systemd/system*", 
-  "*/run/systemd/system*", "*~/.config/systemd/*", "*~/.local/share/systemd/*","*/etc/systemd/user*", "*/lib/systemd/user*", "*/usr/lib/systemd/user*", "*/run/systemd/user*") 
-  by Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid Filesystem.file_path
-  | `drop_dm_object_name(Filesystem)`
-  | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
+description: This analytic looks for suspicious file creation in systemd timer directory
+  in linux platform. systemd is a system and service manager for Linux distributions.
+  From the Windows perspective, this process fulfills the duties of wininit.exe and
+  services.exe combined. At the risk of simplifying the functionality of systemd,
+  it initializes a Linux system and starts relevant services that are defined in service
+  unit files. Adversaries, malware and red teamers may abuse this this feature by
+  stashing systemd service file to persist on the targetted or compromised host.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name = *.service
+  Filesystem.file_path IN ("*/etc/systemd/system*", "*/lib/systemd/system*", "*/usr/lib/systemd/system*",
+  "*/run/systemd/system*", "*~/.config/systemd/*", "*~/.local/share/systemd/*","*/etc/systemd/user*",
+  "*/lib/systemd/user*", "*/usr/lib/systemd/user*", "*/run/systemd/user*") by Filesystem.dest
+  Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid Filesystem.file_path
+  | `drop_dm_object_name(Filesystem)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`
   | `linux_service_file_created_in_systemd_directory_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
-  logs with the file name, file path, and process_guid executions from your
-  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA.
-known_false_positives: administrator or network operator can create file in systemd folders for automation purposes. filter is needed 
+  logs with the file name, file path, and process_guid executions from your endpoints.
+  If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+known_false_positives: administrator or network operator can create file in systemd
+  folders for automation purposes. filter is needed
 references:
 - https://attack.mitre.org/techniques/T1053/006/
 - https://www.intezer.com/blog/research/kaiji-new-chinese-linux-malware-turning-to-golang/
@@ -32,7 +36,7 @@ tags:
   - Linux Privilege Escalation
   - Linux Persistence Techniques
   dataset:
-  -  https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log
   kill_chain_phases:
   - Privilege Escalation
   mitre_attack_id:
@@ -44,15 +48,14 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Filesystem.dest 
-  - Filesystem.file_create_time 
-  - Filesystem.file_name 
-  - Filesystem.process_guid 
+  - Filesystem.dest
+  - Filesystem.file_create_time
+  - Filesystem.file_name
+  - Filesystem.process_guid
   - Filesystem.file_path
   security_domain: endpoint
   impact: 80
-  confidence: 80 
-  # (impact * confidence)/100
+  confidence: 80
   risk_score: 64
   context:
   - source:endpoint
@@ -68,4 +71,5 @@ tags:
   cis20:
   - CIS 3
   - CIS 5
-  - CIS 16
+  - CIS 16
+  automated_detection_testing: passed