Added detection testing service results inWMIC XSL Execution via URL

detections/endpoint/wmic_xsl_execution_via_url.yml

@@ -6,24 +6,36 @@ author: Michael Haag, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: 'The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible Stylesheet Language) script. This originally was identified by Casey Smith, dubbed Squiblytwo, as an application control bypass. Many adversaries will utilize this technique to invoke JScript or VBScript within an XSL file. This technique can also execute local/remote scripts and, similar to its Regsvr32 "Squiblydoo" counterpart, leverages a trusted, built-in Windows tool. Adversaries may abuse any alias in Windows Management Instrumentation provided they utilize the /FORMAT switch.
-  Upon identifying a suspicious execution, review for confirmed network connnection and script download.'
+description: The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible
+  Stylesheet Language) script. This originally was identified by Casey Smith, dubbed
+  Squiblytwo, as an application control bypass. Many adversaries will utilize this
+  technique to invoke JScript or VBScript within an XSL file. This technique can also
+  execute local/remote scripts and, similar to its Regsvr32 "Squiblydoo" counterpart,
+  leverages a trusted, built-in Windows tool. Adversaries may abuse any alias in Windows
+  Management Instrumentation provided they utilize the /FORMAT switch. Upon identifying
+  a suspicious execution, review for confirmed network connnection and script download.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where `process_wmic` Processes.process IN ("*http://*", "*https://*")
-  Processes.process="*/format:*" by Processes.parent_process_name Processes.original_file_name
-  Processes.parent_process Processes.process_name Processes.process_id Processes.process
-  Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `wmic_xsl_execution_via_url_filter`'
-how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
-known_false_positives: False positives are limited as legitimate applications typically do not download files or xsl using WMIC. Filter as needed.
+  as lastTime from datamodel=Endpoint.Processes where `process_wmic` Processes.process
+  IN ("*http://*", "*https://*") Processes.process="*/format:*" by Processes.parent_process_name
+  Processes.original_file_name Processes.parent_process Processes.process_name Processes.process_id
+  Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wmic_xsl_execution_via_url_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+known_false_positives: False positives are limited as legitimate applications typically
+  do not download files or xsl using WMIC. Filter as needed.
 references:
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md  
-  - https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-4---wmic-bypass-using-remote-xsl-file
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md
+- https://web.archive.org/web/20190814201250/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1220/T1220.md#atomic-test-4---wmic-bypass-using-remote-xsl-file
 tags:
   analytic_story:
   - Suspicious WMI Use
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1220/atomic_red_team/windows-sysmon.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -36,11 +48,11 @@ tags:
   - _time
   - Processes.dest
   - Processes.user
-  - Processes.parent_process_name #parent process name
-  - Processes.parent_process #parent cmdline
+  - Processes.parent_process_name
+  - Processes.parent_process
   - Processes.original_file_name
-  - Processes.process_name #process name
-  - Processes.process #process cmdline
+  - Processes.process_name
+  - Processes.process
   - Processes.process_id
   - Processes.parent_process_path
   - Processes.process_path
@@ -48,12 +60,12 @@ tags:
   security_domain: endpoint
   impact: 80
   confidence: 100
-  # (impact * confidence)/100
   risk_score: 80
   context:
   - Source:Endpoint
   - Stage:Defense Evasion
-  message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ utilizing wmic to download a remote XSL script.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest$ by user $user$ utilizing wmic to download a remote XSL script.
   observable:
   - name: user
     type: User
@@ -70,4 +82,5 @@ tags:
   - name: process_name
     type: Process
     role:
-    - Child Process
+    - Child Process
+  automated_detection_testing: passed