Added detection testing service results inWmic Group Discovery

detections/endpoint/wmic_group_discovery.yml

@@ -6,26 +6,33 @@ author: Michael Haag, Splunk
 type: Hunting
 datamodel:
 - Endpoint
-description: 'The follow hunting analytic identifies the use of `wmic.exe` enumerating local groups on the endpoint. \
+description: 'The follow hunting analytic identifies the use of `wmic.exe` enumerating
+  local groups on the endpoint. \
+
+  Typically, by itself, is not malicious but may raise suspicion based on time of
+  day, endpoint and username. \
 
-  Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint and username. \
-  
   During triage, review parallel processes and identify any further suspicious behavior.'
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where Processes.process_name=wmic.exe
-  (Processes.process="*group get name*") by Processes.dest
-  Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.original_file_name
-  Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `wmic_group_discovery_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+  (Processes.process="*group get name*") by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.original_file_name Processes.process_id
+  Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
+  `security_content_ctime(lastTime)` | `wmic_group_discovery_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
 known_false_positives: False positives may be present. Tune as needed.
 references:
-  - https://attack.mitre.org/techniques/T1069/001/
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md
+- https://attack.mitre.org/techniques/T1069/001/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md
 tags:
   analytic_story:
   - Active Directory Discovery
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-sysmon.log
   kill_chain_phases:
   - Reconnaissance
   mitre_attack_id:
@@ -38,11 +45,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
@@ -64,4 +71,5 @@ tags:
   - name: user
     type: User
     role:
-    - Victim
+    - Victim
+  automated_detection_testing: passed