Added detection testing service results inLinux Service Started Or Enabled

detections/endpoint/linux_service_started_or_enabled.yml

@@ -7,32 +7,35 @@ type: Anomaly
 datamodel:
 - Endpoint
 description: This analytic looks for created or enable services in linux platform.
-  This technique can be executed or performed using systemctl or service tool application. 
-  Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. 
-  When Windows boots up, it starts programs or applications called services that perform background system functions. Administrator may also create 
-  a legitimated service for a specific tool or normal application as part of task or automation, in this scenario it is suggested to look for the service path 
-  of the actual script or executable that register as service and who created the service for further verification.
+  This technique can be executed or performed using systemctl or service tool application.
+  Adversaries may create or modify Windows services to repeatedly execute malicious
+  payloads as part of persistence. When Windows boots up, it starts programs or applications
+  called services that perform background system functions. Administrator may also
+  create a legitimated service for a specific tool or normal application as part of
+  task or automation, in this scenario it is suggested to look for the service path
+  of the actual script or executable that register as service and who created the
+  service for further verification.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name IN ("systemctl", "service") OR Processes.process IN ("*systemctl *", "*service *")) 
-  Processes.process IN ("* start *", "* enable *") 
-  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `linux_service_started_or_enabled_filter`'
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process_name IN ("systemctl",
+  "service") OR Processes.process IN ("*systemctl *", "*service *")) Processes.process
+  IN ("* start *", "* enable *") by Processes.dest Processes.user Processes.parent_process_name
+  Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `linux_service_started_or_enabled_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
-known_false_positives: Administrator or network operator can use this commandline for automation purposes. filter is needed 
+  Sysmon TA.
+known_false_positives: Administrator or network operator can use this commandline
+  for automation purposes. filter is needed
 references:
--  https://attack.mitre.org/techniques/T1543/003/
+- https://attack.mitre.org/techniques/T1543/003/
 tags:
   analytic_story:
   - Linux Privilege Escalation
   - Linux Persistence Techniques
   dataset:
-  -  https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/service_systemd/sysmon_linux.log
   kill_chain_phases:
   - Privilege Escalation
   mitre_attack_id:
@@ -44,18 +47,17 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.dest 
-  - Processes.user 
-  - Processes.parent_process_name 
-  - Processes.process_name 
-  - Processes.process 
-  - Processes.process_id 
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
   impact: 60
-  confidence: 70 
-  # (impact * confidence)/100
-  risk_score: 42 
+  confidence: 70
+  risk_score: 42
   context:
   - source:endpoint
   - stage:Privilege Escalation Persistence
@@ -70,4 +72,5 @@ tags:
   cis20:
   - CIS 3
   - CIS 5
-  - CIS 16
+  - CIS 16
+  automated_detection_testing: passed