From c214e8dc533a654b82ad56942d422d3693f59faf Mon Sep 17 00:00:00 2001
From: tcontreras <tcontreras@splunk.com>
Date: Wed, 31 Mar 2021 14:42:47 +0200
Subject: [PATCH 01/13] def_evasion_detections

---
 detections/endpoint/disable_registry_tool.yml | 44 +++++++++++++++++
 .../endpoint/disable_show_hidden_files.yml    | 47 +++++++++++++++++++
 .../disable_windows_behavior_monitoring.yml   | 45 ++++++++++++++++++
 ...disable_windows_smartscreen_protection.yml | 44 +++++++++++++++++
 .../endpoint/disabling_cmd_application.yml    | 44 +++++++++++++++++
 .../endpoint/disabling_controlpanel.yml       | 43 +++++++++++++++++
 .../disabling_firewall_with_netsh.yml         | 46 ++++++++++++++++++
 ...isabling_folderoptions_windows_feature.yml | 44 +++++++++++++++++
 .../endpoint/disabling_norun_windows_app.yml  | 45 ++++++++++++++++++
 .../disabling_systemrestore_in_registry.yml   | 44 +++++++++++++++++
 .../endpoint/disabling_task_manager.yml       | 44 +++++++++++++++++
 tests/endpoint/disable_registry_tool.test.yml | 22 +++++++++
 .../disable_show_hidden_files.test.yml        | 22 +++++++++
 ...sable_windows_behavior_monitoring.test.yml | 22 +++++++++
 ...le_windows_smartscreen_protection.test.yml | 22 +++++++++
 .../disabling_cmd_application.test.yml        | 22 +++++++++
 .../endpoint/disabling_controlpanel.test.yml  | 22 +++++++++
 .../disabling_firewall_with_netsh.test.yml    | 22 +++++++++
 ...ing_folderoptions_windows_feature.test.yml | 22 +++++++++
 .../disabling_norun_windows_app.test.yml      | 22 +++++++++
 ...sabling_systemrestore_in_registry.test.yml | 22 +++++++++
 .../endpoint/disabling_task_manager.test.yml  | 22 +++++++++
 22 files changed, 732 insertions(+)
 create mode 100644 detections/endpoint/disable_registry_tool.yml
 create mode 100644 detections/endpoint/disable_show_hidden_files.yml
 create mode 100644 detections/endpoint/disable_windows_behavior_monitoring.yml
 create mode 100644 detections/endpoint/disable_windows_smartscreen_protection.yml
 create mode 100644 detections/endpoint/disabling_cmd_application.yml
 create mode 100644 detections/endpoint/disabling_controlpanel.yml
 create mode 100644 detections/endpoint/disabling_firewall_with_netsh.yml
 create mode 100644 detections/endpoint/disabling_folderoptions_windows_feature.yml
 create mode 100644 detections/endpoint/disabling_norun_windows_app.yml
 create mode 100644 detections/endpoint/disabling_systemrestore_in_registry.yml
 create mode 100644 detections/endpoint/disabling_task_manager.yml
 create mode 100644 tests/endpoint/disable_registry_tool.test.yml
 create mode 100644 tests/endpoint/disable_show_hidden_files.test.yml
 create mode 100644 tests/endpoint/disable_windows_behavior_monitoring.test.yml
 create mode 100644 tests/endpoint/disable_windows_smartscreen_protection.test.yml
 create mode 100644 tests/endpoint/disabling_cmd_application.test.yml
 create mode 100644 tests/endpoint/disabling_controlpanel.test.yml
 create mode 100644 tests/endpoint/disabling_firewall_with_netsh.test.yml
 create mode 100644 tests/endpoint/disabling_folderoptions_windows_feature.test.yml
 create mode 100644 tests/endpoint/disabling_norun_windows_app.test.yml
 create mode 100644 tests/endpoint/disabling_systemrestore_in_registry.test.yml
 create mode 100644 tests/endpoint/disabling_task_manager.test.yml

diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml
new file mode 100644
index 0000000000..f9df9e40e9
--- /dev/null
+++ b/detections/endpoint/disable_registry_tool.yml
@@ -0,0 +1,44 @@
+name: Disable Registry Tool
+id: cd2cf33c-9201-11eb-a10a-acde48001122
+version: 1
+date: '2021-03-31'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to identifies modification of registry to disable the regedit or registry tools of windows operating system.
+  Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal 
+  of their registry entry such as persistence, file less components and defense evasion.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
+  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" 
+  Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)` 
+  | `disable_registry_tool_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config
+  files ex. sysmon config to be monitored.
+known_false_positives: admin may disable this application for non technical user.
+references:
+- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
+tags:
+  analytic_story:
+  -  Windows Defense Evasion Tactics
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml
new file mode 100644
index 0000000000..f49cbc69db
--- /dev/null
+++ b/detections/endpoint/disable_show_hidden_files.yml
@@ -0,0 +1,47 @@
+name: Disable Show Hidden Files
+id: 6f3ccfa2-91fe-11eb-8f9b-acde48001122
+version: 1
+date: '2021-03-31'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following search is to idetifies a modification in registry to prevent the user seeing all the files with hidden attributes.
+  This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
+  where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" 
+  OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" 
+  Registry.registry_value_name = "DWORD (0x00000001)") 
+  OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" Registry.registry_value_name = "DWORD (0x00000000)") 
+  by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)` 
+  | `disable_show_hidden_files_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config
+  files ex. sysmon config to be monitored.
+known_false_positives: unknown
+references:
+- https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis.aspx
+tags:
+  analytic_story:
+  -  Windows Defense Evasion Tactics
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1564.001
+  - T1562.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_nam
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml
new file mode 100644
index 0000000000..d643a1b4a5
--- /dev/null
+++ b/detections/endpoint/disable_windows_behavior_monitoring.yml
@@ -0,0 +1,45 @@
+name: Disable Windows Behavior Monitoring
+id: 79439cae-9200-11eb-a4d3-acde48001122
+version: 1
+date: '2021-03-31'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring.
+  This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
+  where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" 
+  OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" 
+  OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" 
+  Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)`
+  | `disable_windows_behavior_monitoring_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config
+  files ex. sysmon config to be monitored.
+known_false_positives: admin or user may choose to disable this windows features.
+references:
+- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
+tags:
+  analytic_story:
+  -  Windows Defense Evasion Tactics
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml
new file mode 100644
index 0000000000..3e85bdad5a
--- /dev/null
+++ b/detections/endpoint/disable_windows_smartscreen_protection.yml
@@ -0,0 +1,44 @@
+name: Disable Windows SmartScreen Protection
+id: 664f0fd0-91ff-11eb-a56f-acde48001122
+version: 1
+date: '2021-03-31'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following search identifies a modification of registry to disable the smartscreen protection of windows machine.
+  This is windows feature provide an early warning system against website that might engage in phishing attack or malware distribution.
+  This modification are seen in RAT malware to cover their tracks upon downloading other of its component or other payload.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
+  where Registry.registry_path= "*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled"  Registry.registry_value_name = "Off" 
+  by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)` 
+  | `disable_windows_smartscreen_protection_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config
+  files ex. sysmon config to be monitored.
+known_false_positives: admin or user may choose to disable this windows features.
+references:
+- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
+tags:
+  analytic_story:
+  -  Windows Defense Evasion Tactics
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_nam
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml
new file mode 100644
index 0000000000..65955f97ae
--- /dev/null
+++ b/detections/endpoint/disabling_cmd_application.yml
@@ -0,0 +1,44 @@
+name: Disabling CMD Application
+id: ff86077c-9212-11eb-a1e6-acde48001122
+version: 1
+date: '2021-03-31'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: this search is to identify modification in registry to disable cmd prompt application.
+  This technique is commonly seen in RAT, Trojan or WORM to prevent triaging or deleting there samples through cmd application
+  which is one of the tool of analyst to traverse on directory and files.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
+  where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" Registry.registry_value_name = "DWORD (0x00000001)" 
+  by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)` 
+  | `disabling_cmd_application_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config
+  files ex. sysmon config to be monitored.
+known_false_positives: admin may disable this application for non technical user.
+references:
+- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
+tags:
+  analytic_story:
+  -  Windows Defense Evasion Tactics
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml
new file mode 100644
index 0000000000..2c6709eea6
--- /dev/null
+++ b/detections/endpoint/disabling_controlpanel.yml
@@ -0,0 +1,43 @@
+name: Disabling ControlPanel
+id: 6ae0148e-9215-11eb-a94a-acde48001122
+version: 1
+date: '2021-03-31'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: this search is to identify registry modification to disable control panel window. 
+  This technique is commonly seen in malware to prevent their artifacts , persistence removed on the infected machine.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
+  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" 
+  Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `disabling_controlpanel_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config
+  files ex. sysmon config to be monitored.
+known_false_positives: admin may disable this application for non technical user.
+references:
+- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
+tags:
+  analytic_story:
+  -  Windows Defense Evasion Tactics
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/disabling_firewall_with_netsh.yml b/detections/endpoint/disabling_firewall_with_netsh.yml
new file mode 100644
index 0000000000..36ef1d5139
--- /dev/null
+++ b/detections/endpoint/disabling_firewall_with_netsh.yml
@@ -0,0 +1,46 @@
+name: Disabling Firewall with Netsh
+id: 6860a62c-9203-11eb-9e05-acde48001122
+version: 1
+date: '2021-03-31'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to identifies suspicious firewall disabling using netsh application.
+  this technique is commonly seen in malware that tries to communicate or download its component or other payload to its C2 server.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where Processes.process_name=netsh.exe Processes.process= "*firewall*" (Processes.process= "*off*" OR  Processes.process= "*disable*") 
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `disabling_firewall_with_netsh_filter`'
+how_to_implement: You must be ingesting data that records the filesystem activity
+  from your hosts to populate the Endpoint file-system data model node. If you are
+  using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
+  you want to collect data.
+known_false_positives: admin may disable firewall during testing or fixing network problem.
+references:
+- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.htm
+tags:
+  analytic_story:
+  - Windows Defense Evasion Tactics
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.dest 
+  - Processes.user 
+  - Processes.parent_process 
+  - Processes.process_name 
+  - Processes.process_id 
+  - Processes.parent_process_id 
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml
new file mode 100644
index 0000000000..17b3da5ab2
--- /dev/null
+++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml
@@ -0,0 +1,44 @@
+name: Disabling FolderOptions Windows Feature
+id: 83776de4-921a-11eb-868a-acde48001122
+version: 1
+date: '2021-03-31'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to identify registry modification to disable folder options feature of windows to show hidden files, file extension and etc. 
+  This technique used by malware in combination if disabling show hidden files feature to hide their files and also to hide the file extension to lure the user
+  base on file icons or fake file extensions.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
+  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" 
+  Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `disabling_folderoptions_windows_feature_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config
+  files ex. sysmon config to be monitored.
+known_false_positives: admin may disable this application for non technical user.
+references:
+- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
+tags:
+  analytic_story:
+  -  Windows Defense Evasion Tactics
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml
new file mode 100644
index 0000000000..50affd0447
--- /dev/null
+++ b/detections/endpoint/disabling_norun_windows_app.yml
@@ -0,0 +1,45 @@
+name: Disabling NoRun Windows App
+id: de81bc46-9213-11eb-adc9-acde48001122
+version: 1
+date: '2021-03-31'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to identify modification of registry to disable run application in window start menu.
+  this application is known to be a helpful shortcut to windows OS user to run known application and also to execute some reg or batch script. 
+  This technique is used malware to make cleaning of its infection more harder by preventing known application run easily through run shortcut.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
+  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" 
+  Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `disabling_norun_windows_app_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config
+  files ex. sysmon config to be monitored.
+known_false_positives: admin may disable this application for non technical user.
+references:
+- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
+- https://blog.malwarebytes.com/detections/pum-optional-norun/
+tags:
+  analytic_story:
+  -  Windows Defense Evasion Tactics
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml
new file mode 100644
index 0000000000..eb6f008bf3
--- /dev/null
+++ b/detections/endpoint/disabling_systemrestore_in_registry.yml
@@ -0,0 +1,44 @@
+name: Disabling SystemRestore In Registry
+id: f4f837e2-91fb-11eb-8bf6-acde48001122
+version: 1
+date: '2021-03-31'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: The following search identifies the modification of registry related in disabling the system restore of a machine. 
+  This event or behavior are seen in some RAT malware to make the restore of the infected machine  difficult and keep their infection on the box.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
+  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR" 
+  OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig" 
+  Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)`
+  | `disabling_systemrestore_in_registry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config
+  files ex. sysmon config to be monitored.
+known_false_positives: in some cases admin can disable systemrestore on a machine.
+references:
+- https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
+tags:
+  analytic_story:
+  -  Windows Defense Evasion Tactics
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  security_domain: endpoint
\ No newline at end of file
diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml
new file mode 100644
index 0000000000..ccae7213a1
--- /dev/null
+++ b/detections/endpoint/disabling_task_manager.yml
@@ -0,0 +1,44 @@
+name: Disabling Task Manager
+id: dac279bc-9202-11eb-b7fb-acde48001122
+version: 1
+date: '2021-03-31'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to identifies modification of registry to disable the task manager of windows operating system.
+  this event or technique are commonly seen in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate their process.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
+  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" 
+  Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
+  | `drop_dm_object_name(Registry)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `disabling_task_manager_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config
+  files ex. sysmon config to be monitored.
+known_false_positives: admin may disable this application for non technical user.
+references:
+- https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
+- https://blog.talosintelligence.com/2020/05/threat-roundup-0424-0501.html
+tags:
+  analytic_story:
+  -  Windows Defense Evasion Tactics
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1562.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_key_name
+  - Registry.registry_path
+  - Registry.user
+  - Registry.dest
+  - Registry.registry_value_name
+  security_domain: endpoint
\ No newline at end of file
diff --git a/tests/endpoint/disable_registry_tool.test.yml b/tests/endpoint/disable_registry_tool.test.yml
new file mode 100644
index 0000000000..a433192706
--- /dev/null
+++ b/tests/endpoint/disable_registry_tool.test.yml
@@ -0,0 +1,22 @@
+name: Disable Registry Tool Unit Test
+tests:
+- name: Disable Registry Tool
+  file: detections/endpoint/disable_registry_tool.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog
+    update_timestamp: True
+  - file_name: windows-system.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
+    source: WinEventLog:System
+    sourcetype: WinEventLog
+    update_timestamp: True
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/disable_show_hidden_files.test.yml b/tests/endpoint/disable_show_hidden_files.test.yml
new file mode 100644
index 0000000000..a7c7c2510c
--- /dev/null
+++ b/tests/endpoint/disable_show_hidden_files.test.yml
@@ -0,0 +1,22 @@
+name: Disable Show Hidden Files Unit Test
+tests:
+- name: Disable Show Hidden Files
+  file: detections/endpoint/disable_show_hidden_files.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog
+    update_timestamp: True
+  - file_name: windows-system.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
+    source: WinEventLog:System
+    sourcetype: WinEventLog
+    update_timestamp: True
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/disable_windows_behavior_monitoring.test.yml b/tests/endpoint/disable_windows_behavior_monitoring.test.yml
new file mode 100644
index 0000000000..f64902e257
--- /dev/null
+++ b/tests/endpoint/disable_windows_behavior_monitoring.test.yml
@@ -0,0 +1,22 @@
+name: Disable Windows Behavior Monitoring Unit Test
+tests:
+- name: Disable Windows Behavior Monitoring
+  file: detections/endpoint/disable_windows_behavior_monitoring.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog
+    update_timestamp: True
+  - file_name: windows-system.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
+    source: WinEventLog:System
+    sourcetype: WinEventLog
+    update_timestamp: True
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/disable_windows_smartscreen_protection.test.yml b/tests/endpoint/disable_windows_smartscreen_protection.test.yml
new file mode 100644
index 0000000000..32cdaae011
--- /dev/null
+++ b/tests/endpoint/disable_windows_smartscreen_protection.test.yml
@@ -0,0 +1,22 @@
+name: Disable Windows SmartScreen Protection Unit Test
+tests:
+- name: Disable Windows SmartScreen Protection
+  file: detections/endpoint/disable_windows_smartscreen_protection.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog
+    update_timestamp: True
+  - file_name: windows-system.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
+    source: WinEventLog:System
+    sourcetype: WinEventLog
+    update_timestamp: True
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/disabling_cmd_application.test.yml b/tests/endpoint/disabling_cmd_application.test.yml
new file mode 100644
index 0000000000..8ea1ce3c49
--- /dev/null
+++ b/tests/endpoint/disabling_cmd_application.test.yml
@@ -0,0 +1,22 @@
+name: Disabling CMD Application Unit Test
+tests:
+- name: Disabling CMD Application
+  file: detections/endpoint/disabling_cmd_application.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog
+    update_timestamp: True
+  - file_name: windows-system.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
+    source: WinEventLog:System
+    sourcetype: WinEventLog
+    update_timestamp: True
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/disabling_controlpanel.test.yml b/tests/endpoint/disabling_controlpanel.test.yml
new file mode 100644
index 0000000000..a86eeb0064
--- /dev/null
+++ b/tests/endpoint/disabling_controlpanel.test.yml
@@ -0,0 +1,22 @@
+name: Disabling ControlPanel Unit Test
+tests:
+- name: Disabling ControlPanel
+  file: detections/endpoint/disabling_controlpanel.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog
+    update_timestamp: True
+  - file_name: windows-system.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
+    source: WinEventLog:System
+    sourcetype: WinEventLog
+    update_timestamp: True
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/disabling_firewall_with_netsh.test.yml b/tests/endpoint/disabling_firewall_with_netsh.test.yml
new file mode 100644
index 0000000000..aec890f704
--- /dev/null
+++ b/tests/endpoint/disabling_firewall_with_netsh.test.yml
@@ -0,0 +1,22 @@
+name: Disabling Firewall with Netsh Unit Test
+tests:
+- name: Disabling Firewall with Netsh
+  file: detections/endpoint/disabling_firewall_with_netsh.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog
+    update_timestamp: True
+  - file_name: windows-system.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
+    source: WinEventLog:System
+    sourcetype: WinEventLog
+    update_timestamp: True
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/disabling_folderoptions_windows_feature.test.yml b/tests/endpoint/disabling_folderoptions_windows_feature.test.yml
new file mode 100644
index 0000000000..aba6e6225d
--- /dev/null
+++ b/tests/endpoint/disabling_folderoptions_windows_feature.test.yml
@@ -0,0 +1,22 @@
+name: Disabling FolderOptions Windows Feature Unit Test
+tests:
+- name: Disabling FolderOptions Windows Feature
+  file: detections/endpoint/disabling_folderoptions_windows_feature.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog
+    update_timestamp: True
+  - file_name: windows-system.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
+    source: WinEventLog:System
+    sourcetype: WinEventLog
+    update_timestamp: True
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlogE
\ No newline at end of file
diff --git a/tests/endpoint/disabling_norun_windows_app.test.yml b/tests/endpoint/disabling_norun_windows_app.test.yml
new file mode 100644
index 0000000000..f3b5ac705d
--- /dev/null
+++ b/tests/endpoint/disabling_norun_windows_app.test.yml
@@ -0,0 +1,22 @@
+name: Disabling NoRun Windows App Unit Test
+tests:
+- name: Disabling NoRun Windows App
+  file: detections/endpoint/disabling_norun_windows_app.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog
+    update_timestamp: True
+  - file_name: windows-system.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
+    source: WinEventLog:System
+    sourcetype: WinEventLog
+    update_timestamp: True
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/disabling_systemrestore_in_registry.test.yml b/tests/endpoint/disabling_systemrestore_in_registry.test.yml
new file mode 100644
index 0000000000..7d5d2d4a03
--- /dev/null
+++ b/tests/endpoint/disabling_systemrestore_in_registry.test.yml
@@ -0,0 +1,22 @@
+name: Disabling SystemRestore In Registry Unit Test
+tests:
+- name: Disabling SystemRestore In Registry
+  file: detections/endpoint/disabling_systemrestore_in_registry.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog
+    update_timestamp: True
+  - file_name: windows-system.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
+    source: WinEventLog:System
+    sourcetype: WinEventLog
+    update_timestamp: True
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file
diff --git a/tests/endpoint/disabling_task_manager.test.yml b/tests/endpoint/disabling_task_manager.test.yml
new file mode 100644
index 0000000000..bd8ede11ad
--- /dev/null
+++ b/tests/endpoint/disabling_task_manager.test.yml
@@ -0,0 +1,22 @@
+name: Disabling Task Manager Unit Test
+tests:
+- name: Disabling Task Manager
+  file: detections/endpoint/disabling_task_manager.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-security.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
+    source: WinEventLog:Security
+    sourcetype: WinEventLog
+    update_timestamp: True
+  - file_name: windows-system.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
+    source: WinEventLog:System
+    sourcetype: WinEventLog
+    update_timestamp: True
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
\ No newline at end of file

From fa58ca006b4caf19961036dd603d7c978cd7d54d Mon Sep 17 00:00:00 2001
From: tcontreras <tcontreras@splunk.com>
Date: Wed, 31 Mar 2021 15:00:36 +0200
Subject: [PATCH 02/13] def_evasion_detections

---
 tests/endpoint/disable_registry_tool.test.yml                   | 2 +-
 tests/endpoint/disable_show_hidden_files.test.yml               | 2 +-
 tests/endpoint/disable_windows_behavior_monitoring.test.yml     | 2 +-
 tests/endpoint/disable_windows_smartscreen_protection.test.yml  | 2 +-
 tests/endpoint/disabling_cmd_application.test.yml               | 2 +-
 tests/endpoint/disabling_controlpanel.test.yml                  | 2 +-
 tests/endpoint/disabling_firewall_with_netsh.test.yml           | 2 +-
 tests/endpoint/disabling_folderoptions_windows_feature.test.yml | 2 +-
 tests/endpoint/disabling_norun_windows_app.test.yml             | 2 +-
 tests/endpoint/disabling_systemrestore_in_registry.test.yml     | 2 +-
 tests/endpoint/disabling_task_manager.test.yml                  | 2 +-
 11 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/tests/endpoint/disable_registry_tool.test.yml b/tests/endpoint/disable_registry_tool.test.yml
index a433192706..f2f6fd210c 100644
--- a/tests/endpoint/disable_registry_tool.test.yml
+++ b/tests/endpoint/disable_registry_tool.test.yml
@@ -1,7 +1,7 @@
 name: Disable Registry Tool Unit Test
 tests:
 - name: Disable Registry Tool
-  file: detections/endpoint/disable_registry_tool.yml
+  file: endpoint/disable_registry_tool.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
diff --git a/tests/endpoint/disable_show_hidden_files.test.yml b/tests/endpoint/disable_show_hidden_files.test.yml
index a7c7c2510c..98db777275 100644
--- a/tests/endpoint/disable_show_hidden_files.test.yml
+++ b/tests/endpoint/disable_show_hidden_files.test.yml
@@ -1,7 +1,7 @@
 name: Disable Show Hidden Files Unit Test
 tests:
 - name: Disable Show Hidden Files
-  file: detections/endpoint/disable_show_hidden_files.yml
+  file: endpoint/disable_show_hidden_files.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
diff --git a/tests/endpoint/disable_windows_behavior_monitoring.test.yml b/tests/endpoint/disable_windows_behavior_monitoring.test.yml
index f64902e257..01c556ef9c 100644
--- a/tests/endpoint/disable_windows_behavior_monitoring.test.yml
+++ b/tests/endpoint/disable_windows_behavior_monitoring.test.yml
@@ -1,7 +1,7 @@
 name: Disable Windows Behavior Monitoring Unit Test
 tests:
 - name: Disable Windows Behavior Monitoring
-  file: detections/endpoint/disable_windows_behavior_monitoring.yml
+  file: endpoint/disable_windows_behavior_monitoring.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
diff --git a/tests/endpoint/disable_windows_smartscreen_protection.test.yml b/tests/endpoint/disable_windows_smartscreen_protection.test.yml
index 32cdaae011..b1174e469c 100644
--- a/tests/endpoint/disable_windows_smartscreen_protection.test.yml
+++ b/tests/endpoint/disable_windows_smartscreen_protection.test.yml
@@ -1,7 +1,7 @@
 name: Disable Windows SmartScreen Protection Unit Test
 tests:
 - name: Disable Windows SmartScreen Protection
-  file: detections/endpoint/disable_windows_smartscreen_protection.yml
+  file: endpoint/disable_windows_smartscreen_protection.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
diff --git a/tests/endpoint/disabling_cmd_application.test.yml b/tests/endpoint/disabling_cmd_application.test.yml
index 8ea1ce3c49..42cb6a6770 100644
--- a/tests/endpoint/disabling_cmd_application.test.yml
+++ b/tests/endpoint/disabling_cmd_application.test.yml
@@ -1,7 +1,7 @@
 name: Disabling CMD Application Unit Test
 tests:
 - name: Disabling CMD Application
-  file: detections/endpoint/disabling_cmd_application.yml
+  file: endpoint/disabling_cmd_application.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
diff --git a/tests/endpoint/disabling_controlpanel.test.yml b/tests/endpoint/disabling_controlpanel.test.yml
index a86eeb0064..b0f8a184d4 100644
--- a/tests/endpoint/disabling_controlpanel.test.yml
+++ b/tests/endpoint/disabling_controlpanel.test.yml
@@ -1,7 +1,7 @@
 name: Disabling ControlPanel Unit Test
 tests:
 - name: Disabling ControlPanel
-  file: detections/endpoint/disabling_controlpanel.yml
+  file: endpoint/disabling_controlpanel.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
diff --git a/tests/endpoint/disabling_firewall_with_netsh.test.yml b/tests/endpoint/disabling_firewall_with_netsh.test.yml
index aec890f704..cfad109c1e 100644
--- a/tests/endpoint/disabling_firewall_with_netsh.test.yml
+++ b/tests/endpoint/disabling_firewall_with_netsh.test.yml
@@ -1,7 +1,7 @@
 name: Disabling Firewall with Netsh Unit Test
 tests:
 - name: Disabling Firewall with Netsh
-  file: detections/endpoint/disabling_firewall_with_netsh.yml
+  file: endpoint/disabling_firewall_with_netsh.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
diff --git a/tests/endpoint/disabling_folderoptions_windows_feature.test.yml b/tests/endpoint/disabling_folderoptions_windows_feature.test.yml
index aba6e6225d..213be9e4cf 100644
--- a/tests/endpoint/disabling_folderoptions_windows_feature.test.yml
+++ b/tests/endpoint/disabling_folderoptions_windows_feature.test.yml
@@ -1,7 +1,7 @@
 name: Disabling FolderOptions Windows Feature Unit Test
 tests:
 - name: Disabling FolderOptions Windows Feature
-  file: detections/endpoint/disabling_folderoptions_windows_feature.yml
+  file: endpoint/disabling_folderoptions_windows_feature.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
diff --git a/tests/endpoint/disabling_norun_windows_app.test.yml b/tests/endpoint/disabling_norun_windows_app.test.yml
index f3b5ac705d..93cb1186b8 100644
--- a/tests/endpoint/disabling_norun_windows_app.test.yml
+++ b/tests/endpoint/disabling_norun_windows_app.test.yml
@@ -1,7 +1,7 @@
 name: Disabling NoRun Windows App Unit Test
 tests:
 - name: Disabling NoRun Windows App
-  file: detections/endpoint/disabling_norun_windows_app.yml
+  file: endpoint/disabling_norun_windows_app.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
diff --git a/tests/endpoint/disabling_systemrestore_in_registry.test.yml b/tests/endpoint/disabling_systemrestore_in_registry.test.yml
index 7d5d2d4a03..61d8cfbf10 100644
--- a/tests/endpoint/disabling_systemrestore_in_registry.test.yml
+++ b/tests/endpoint/disabling_systemrestore_in_registry.test.yml
@@ -1,7 +1,7 @@
 name: Disabling SystemRestore In Registry Unit Test
 tests:
 - name: Disabling SystemRestore In Registry
-  file: detections/endpoint/disabling_systemrestore_in_registry.yml
+  file: endpoint/disabling_systemrestore_in_registry.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'
diff --git a/tests/endpoint/disabling_task_manager.test.yml b/tests/endpoint/disabling_task_manager.test.yml
index bd8ede11ad..b169662e6b 100644
--- a/tests/endpoint/disabling_task_manager.test.yml
+++ b/tests/endpoint/disabling_task_manager.test.yml
@@ -1,7 +1,7 @@
 name: Disabling Task Manager Unit Test
 tests:
 - name: Disabling Task Manager
-  file: detections/endpoint/disabling_task_manager.yml
+  file: endpoint/disabling_task_manager.yml
   pass_condition: '| stats count | where count > 0'
   earliest_time: '-24h'
   latest_time: 'now'

From 10b51469c3f7c7582f5338aa01dd8fbb861f3c89 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-241-156>
Date: Wed, 31 Mar 2021 15:47:04 +0000
Subject: [PATCH 03/13] Added detection testing service results inDisable
 Registry Tool

---
 detections/endpoint/disable_registry_tool.yml | 33 +++++++++++--------
 1 file changed, 19 insertions(+), 14 deletions(-)

diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml
index f9df9e40e9..3f31a7ffa2 100644
--- a/detections/endpoint/disable_registry_tool.yml
+++ b/detections/endpoint/disable_registry_tool.yml
@@ -6,26 +6,26 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: This search is to identifies modification of registry to disable the regedit or registry tools of windows operating system.
-  Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal 
-  of their registry entry such as persistence, file less components and defense evasion.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools" 
-  Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)`
-  |`security_content_ctime(lastTime)` 
-  | `disable_registry_tool_filter`'
+description: This search is to identifies modification of registry to disable the
+  regedit or registry tools of windows operating system. Since registry tool is a
+  swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this
+  application to prevent the removal of their registry entry such as persistence,
+  file less components and defense evasion.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools"
+  Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)` | `disable_registry_tool_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config
-  files ex. sysmon config to be monitored.
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: admin may disable this application for non technical user.
 references:
 - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
 tags:
   analytic_story:
-  -  Windows Defense Evasion Tactics
+  - Windows Defense Evasion Tactics
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -41,4 +41,9 @@ tags:
   - Registry.user
   - Registry.dest
   - Registry.registry_value_name
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log

From ae45f7a3ae507b6752aae820b54a6ba27fc214ff Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-241-156>
Date: Wed, 31 Mar 2021 16:05:22 +0000
Subject: [PATCH 04/13] Added detection testing service results inDisable Show
 Hidden Files

---
 .../endpoint/disable_show_hidden_files.yml    | 37 +++++++++++--------
 1 file changed, 21 insertions(+), 16 deletions(-)

diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml
index f49cbc69db..036ea045f8 100644
--- a/detections/endpoint/disable_show_hidden_files.yml
+++ b/detections/endpoint/disable_show_hidden_files.yml
@@ -6,28 +6,28 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: The following search is to idetifies a modification in registry to prevent the user seeing all the files with hidden attributes.
-  This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
-  where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden" 
-  OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt" 
-  Registry.registry_value_name = "DWORD (0x00000001)") 
-  OR (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden" Registry.registry_value_name = "DWORD (0x00000000)") 
-  by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)`
-  |`security_content_ctime(lastTime)` 
-  | `disable_show_hidden_files_filter`'
+description: The following search is to idetifies a modification in registry to prevent
+  the user seeing all the files with hidden attributes. This event or techniques are
+  known on some worm and trojan spy malware that will drop hidden files on the infected
+  machine.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden"
+  OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt"
+  Registry.registry_value_name = "DWORD (0x00000001)") OR (Registry.registry_path=
+  "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden"
+  Registry.registry_value_name = "DWORD (0x00000000)") by Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)` | `disable_show_hidden_files_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config
-  files ex. sysmon config to be monitored.
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: unknown
 references:
 - https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis.aspx
 tags:
   analytic_story:
-  -  Windows Defense Evasion Tactics
+  - Windows Defense Evasion Tactics
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -44,4 +44,9 @@ tags:
   - Registry.user
   - Registry.dest
   - Registry.registry_value_nam
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log

From 71139506d750a40edc138dc2d2eaa00b7b06bd73 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-170-113>
Date: Wed, 31 Mar 2021 17:23:30 +0000
Subject: [PATCH 05/13] Added detection testing service results inDisable
 Windows Behavior Monitoring

---
 .../disable_windows_behavior_monitoring.yml   | 36 +++++++++++--------
 1 file changed, 21 insertions(+), 15 deletions(-)

diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml
index d643a1b4a5..7c5ab7d25e 100644
--- a/detections/endpoint/disable_windows_behavior_monitoring.yml
+++ b/detections/endpoint/disable_windows_behavior_monitoring.yml
@@ -6,27 +6,28 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring.
-  This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableBehaviorMonitoring" 
-  OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection" 
-  OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableScanOnRealtimeEnable" 
-  Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)`
-  |`security_content_ctime(lastTime)`
-  | `disable_windows_behavior_monitoring_filter`'
+description: This search is to identifies a modification in registry to disable the
+  windows denfender real time behavior monitoring. This event or technique is commonly
+  seen in RAT, bot, or Trojan to disable AV to evade detections.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows
+  Defender\\Real-Time Protection\\DisableBehaviorMonitoring" OR Registry.registry_path=
+  "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\\DisableOnAccessProtection"
+  OR Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time
+  Protection\\DisableScanOnRealtimeEnable" Registry.registry_value_name = "DWORD (0x00000001)"
+  by Registry.registry_path Registry.registry_key_name Registry.registry_value_name
+  Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)` | `disable_windows_behavior_monitoring_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config
-  files ex. sysmon config to be monitored.
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: admin or user may choose to disable this windows features.
 references:
 - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
 tags:
   analytic_story:
-  -  Windows Defense Evasion Tactics
+  - Windows Defense Evasion Tactics
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -42,4 +43,9 @@ tags:
   - Registry.user
   - Registry.dest
   - Registry.registry_value_name
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log

From d35bf6fdaba25f0498d3d7eed5d1e8a8a01e4f32 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-220-28>
Date: Thu, 1 Apr 2021 07:59:18 +0000
Subject: [PATCH 06/13] Added detection testing service results inDisable
 Windows SmartScreen Protection

---
 ...disable_windows_smartscreen_protection.yml | 33 +++++++++++--------
 1 file changed, 19 insertions(+), 14 deletions(-)

diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml
index 3e85bdad5a..b127627da0 100644
--- a/detections/endpoint/disable_windows_smartscreen_protection.yml
+++ b/detections/endpoint/disable_windows_smartscreen_protection.yml
@@ -6,26 +6,26 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: The following search identifies a modification of registry to disable the smartscreen protection of windows machine.
-  This is windows feature provide an early warning system against website that might engage in phishing attack or malware distribution.
-  This modification are seen in RAT malware to cover their tracks upon downloading other of its component or other payload.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled"  Registry.registry_value_name = "Off" 
-  by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)`
-  |`security_content_ctime(lastTime)` 
-  | `disable_windows_smartscreen_protection_filter`'
+description: The following search identifies a modification of registry to disable
+  the smartscreen protection of windows machine. This is windows feature provide an
+  early warning system against website that might engage in phishing attack or malware
+  distribution. This modification are seen in RAT malware to cover their tracks upon
+  downloading other of its component or other payload.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SmartScreenEnabled"  Registry.registry_value_name
+  = "Off" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name
+  Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)` | `disable_windows_smartscreen_protection_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config
-  files ex. sysmon config to be monitored.
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: admin or user may choose to disable this windows features.
 references:
 - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
 tags:
   analytic_story:
-  -  Windows Defense Evasion Tactics
+  - Windows Defense Evasion Tactics
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -41,4 +41,9 @@ tags:
   - Registry.user
   - Registry.dest
   - Registry.registry_value_nam
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log

From 7e29850f481ea8189b69c938cb2cb869c16e288f Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-21-83>
Date: Thu, 1 Apr 2021 08:27:41 +0000
Subject: [PATCH 07/13] Added detection testing service results inDisabling CMD
 Application

---
 .../endpoint/disabling_cmd_application.yml    | 32 +++++++++++--------
 1 file changed, 18 insertions(+), 14 deletions(-)

diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml
index 65955f97ae..60d544c9bb 100644
--- a/detections/endpoint/disabling_cmd_application.yml
+++ b/detections/endpoint/disabling_cmd_application.yml
@@ -6,26 +6,25 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: this search is to identify modification in registry to disable cmd prompt application.
-  This technique is commonly seen in RAT, Trojan or WORM to prevent triaging or deleting there samples through cmd application
-  which is one of the tool of analyst to traverse on directory and files.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD" Registry.registry_value_name = "DWORD (0x00000001)" 
-  by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)`
-  |`security_content_ctime(lastTime)` 
-  | `disabling_cmd_application_filter`'
+description: this search is to identify modification in registry to disable cmd prompt
+  application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging
+  or deleting there samples through cmd application which is one of the tool of analyst
+  to traverse on directory and files.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\\DisableCMD"
+  Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)` | `disabling_cmd_application_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config
-  files ex. sysmon config to be monitored.
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: admin may disable this application for non technical user.
 references:
 - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
 tags:
   analytic_story:
-  -  Windows Defense Evasion Tactics
+  - Windows Defense Evasion Tactics
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -41,4 +40,9 @@ tags:
   - Registry.user
   - Registry.dest
   - Registry.registry_value_name
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log

From e0cdb5bb1c6054883db739fcdf26701f0635f870 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-21-83>
Date: Thu, 1 Apr 2021 08:46:08 +0000
Subject: [PATCH 08/13] Added detection testing service results inDisabling
 ControlPanel

---
 .../endpoint/disabling_controlpanel.yml       | 30 +++++++++++--------
 1 file changed, 17 insertions(+), 13 deletions(-)

diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml
index 2c6709eea6..f4c03a35b8 100644
--- a/detections/endpoint/disabling_controlpanel.yml
+++ b/detections/endpoint/disabling_controlpanel.yml
@@ -6,25 +6,24 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: this search is to identify registry modification to disable control panel window. 
-  This technique is commonly seen in malware to prevent their artifacts , persistence removed on the infected machine.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel" 
-  Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `disabling_controlpanel_filter`'
+description: this search is to identify registry modification to disable control panel
+  window. This technique is commonly seen in malware to prevent their artifacts ,
+  persistence removed on the infected machine.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel"
+  Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `disabling_controlpanel_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config
-  files ex. sysmon config to be monitored.
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: admin may disable this application for non technical user.
 references:
 - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
 tags:
   analytic_story:
-  -  Windows Defense Evasion Tactics
+  - Windows Defense Evasion Tactics
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -40,4 +39,9 @@ tags:
   - Registry.user
   - Registry.dest
   - Registry.registry_value_name
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log

From d294ac965c42c38bb9c293666983515c946b8bd3 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-52-26>
Date: Thu, 1 Apr 2021 09:11:18 +0000
Subject: [PATCH 09/13] Added detection testing service results inDisabling
 Firewall with Netsh

---
 .../disabling_firewall_with_netsh.yml         | 40 +++++++++++--------
 1 file changed, 23 insertions(+), 17 deletions(-)

diff --git a/detections/endpoint/disabling_firewall_with_netsh.yml b/detections/endpoint/disabling_firewall_with_netsh.yml
index 36ef1d5139..03fff72233 100644
--- a/detections/endpoint/disabling_firewall_with_netsh.yml
+++ b/detections/endpoint/disabling_firewall_with_netsh.yml
@@ -6,20 +6,21 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: This search is to identifies suspicious firewall disabling using netsh application.
-  this technique is commonly seen in malware that tries to communicate or download its component or other payload to its C2 server.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
-  where Processes.process_name=netsh.exe Processes.process= "*firewall*" (Processes.process= "*off*" OR  Processes.process= "*disable*") 
-  by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)` 
-  | `disabling_firewall_with_netsh_filter`'
+description: This search is to identifies suspicious firewall disabling using netsh
+  application. this technique is commonly seen in malware that tries to communicate
+  or download its component or other payload to its C2 server.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name=netsh.exe
+  Processes.process= "*firewall*" (Processes.process= "*off*" OR  Processes.process=
+  "*disable*") by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_firewall_with_netsh_filter`'
 how_to_implement: You must be ingesting data that records the filesystem activity
   from your hosts to populate the Endpoint file-system data model node. If you are
   using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
   you want to collect data.
-known_false_positives: admin may disable firewall during testing or fixing network problem.
+known_false_positives: admin may disable firewall during testing or fixing network
+  problem.
 references:
 - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.htm
 tags:
@@ -37,10 +38,15 @@ tags:
   - _time
   - Processes.process_name
   - Processes.process
-  - Processes.dest 
-  - Processes.user 
-  - Processes.parent_process 
-  - Processes.process_name 
-  - Processes.process_id 
-  - Processes.parent_process_id 
-  security_domain: endpoint
\ No newline at end of file
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process
+  - Processes.process_name
+  - Processes.process_id
+  - Processes.parent_process_id
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log

From 031a8a99451160a7f87312dd96193cdcade567fa Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-239-197>
Date: Thu, 1 Apr 2021 10:06:43 +0000
Subject: [PATCH 10/13] Added detection testing service results inDisabling
 FolderOptions Windows Feature

---
 ...isabling_folderoptions_windows_feature.yml | 33 +++++++++++--------
 1 file changed, 19 insertions(+), 14 deletions(-)

diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml
index 17b3da5ab2..59adce28fc 100644
--- a/detections/endpoint/disabling_folderoptions_windows_feature.yml
+++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml
@@ -6,26 +6,26 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: This search is to identify registry modification to disable folder options feature of windows to show hidden files, file extension and etc. 
-  This technique used by malware in combination if disabling show hidden files feature to hide their files and also to hide the file extension to lure the user
-  base on file icons or fake file extensions.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions" 
-  Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
-  | `disabling_folderoptions_windows_feature_filter`'
+description: This search is to identify registry modification to disable folder options
+  feature of windows to show hidden files, file extension and etc. This technique
+  used by malware in combination if disabling show hidden files feature to hide their
+  files and also to hide the file extension to lure the user base on file icons or
+  fake file extensions.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoFolderOptions"
+  Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `disabling_folderoptions_windows_feature_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config
-  files ex. sysmon config to be monitored.
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: admin may disable this application for non technical user.
 references:
 - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
 tags:
   analytic_story:
-  -  Windows Defense Evasion Tactics
+  - Windows Defense Evasion Tactics
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -41,4 +41,9 @@ tags:
   - Registry.user
   - Registry.dest
   - Registry.registry_value_name
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log

From 5ef291663669a4140bc61f4594f8cf131c07c663 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-251-29>
Date: Thu, 1 Apr 2021 11:25:29 +0000
Subject: [PATCH 11/13] Added detection testing service results inDisabling
 SystemRestore In Registry

---
 .../disabling_systemrestore_in_registry.yml   | 34 +++++++++++--------
 1 file changed, 20 insertions(+), 14 deletions(-)

diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml
index eb6f008bf3..f0ed94188f 100644
--- a/detections/endpoint/disabling_systemrestore_in_registry.yml
+++ b/detections/endpoint/disabling_systemrestore_in_registry.yml
@@ -6,26 +6,27 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: The following search identifies the modification of registry related in disabling the system restore of a machine. 
-  This event or behavior are seen in some RAT malware to make the restore of the infected machine  difficult and keep their infection on the box.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableSR" 
-  OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\SystemRestore\\DisableConfig" 
-  Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)`
-  |`security_content_ctime(lastTime)`
-  | `disabling_systemrestore_in_registry_filter`'
+description: The following search identifies the modification of registry related
+  in disabling the system restore of a machine. This event or behavior are seen in
+  some RAT malware to make the restore of the infected machine  difficult and keep
+  their infection on the box.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows
+  NT\\CurrentVersion\\SystemRestore\\DisableSR" OR Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows
+  NT\\CurrentVersion\\SystemRestore\\DisableConfig" Registry.registry_value_name =
+  "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name
+  Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)` | `disabling_systemrestore_in_registry_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config
-  files ex. sysmon config to be monitored.
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: in some cases admin can disable systemrestore on a machine.
 references:
 - https://tccontre.blogspot.com/2020/01/remcos-rat-evading-windows-defender-av.html
 tags:
   analytic_story:
-  -  Windows Defense Evasion Tactics
+  - Windows Defense Evasion Tactics
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -41,4 +42,9 @@ tags:
   - Registry.user
   - Registry.dest
   - Registry.registry_value_name
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log

From b0173344e3c1a1938955706b938448d520428206 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-241-215>
Date: Thu, 1 Apr 2021 11:58:27 +0000
Subject: [PATCH 12/13] Added detection testing service results inDisabling
 NoRun Windows App

---
 .../endpoint/disabling_norun_windows_app.yml  | 33 +++++++++++--------
 1 file changed, 19 insertions(+), 14 deletions(-)

diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml
index 50affd0447..e77ffbd10c 100644
--- a/detections/endpoint/disabling_norun_windows_app.yml
+++ b/detections/endpoint/disabling_norun_windows_app.yml
@@ -6,27 +6,27 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: This search is to identify modification of registry to disable run application in window start menu.
-  this application is known to be a helpful shortcut to windows OS user to run known application and also to execute some reg or batch script. 
-  This technique is used malware to make cleaning of its infection more harder by preventing known application run easily through run shortcut.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun" 
-  Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `disabling_norun_windows_app_filter`'
+description: This search is to identify modification of registry to disable run application
+  in window start menu. this application is known to be a helpful shortcut to windows
+  OS user to run known application and also to execute some reg or batch script. This
+  technique is used malware to make cleaning of its infection more harder by preventing
+  known application run easily through run shortcut.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoRun"
+  Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `disabling_norun_windows_app_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config
-  files ex. sysmon config to be monitored.
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: admin may disable this application for non technical user.
 references:
 - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
 - https://blog.malwarebytes.com/detections/pum-optional-norun/
 tags:
   analytic_story:
-  -  Windows Defense Evasion Tactics
+  - Windows Defense Evasion Tactics
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -42,4 +42,9 @@ tags:
   - Registry.user
   - Registry.dest
   - Registry.registry_value_name
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log

From fa1c0e2c627cc8930fdfab6916c3812c205fde43 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-234-186>
Date: Thu, 1 Apr 2021 12:20:50 +0000
Subject: [PATCH 13/13] Added detection testing service results inDisabling
 Task Manager

---
 .../endpoint/disabling_task_manager.yml       | 31 +++++++++++--------
 1 file changed, 18 insertions(+), 13 deletions(-)

diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml
index ccae7213a1..f1ce08549d 100644
--- a/detections/endpoint/disabling_task_manager.yml
+++ b/detections/endpoint/disabling_task_manager.yml
@@ -6,26 +6,26 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: This search is to identifies modification of registry to disable the task manager of windows operating system.
-  this event or technique are commonly seen in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate their process.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry 
-  where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" 
-  Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest 
-  | `drop_dm_object_name(Registry)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `disabling_task_manager_filter`'
+description: This search is to identifies modification of registry to disable the
+  task manager of windows operating system. this event or technique are commonly seen
+  in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate
+  their process.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr"
+  Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name
+  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `disabling_task_manager_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
-  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config
-  files ex. sysmon config to be monitored.
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
 known_false_positives: admin may disable this application for non technical user.
 references:
 - https://any.run/report/ea4ea08407d4ee72e009103a3b77e5a09412b722fdef67315ea63f22011152af/a866d7b1-c236-4f26-a391-5ae32213dfc4#registry
 - https://blog.talosintelligence.com/2020/05/threat-roundup-0424-0501.html
 tags:
   analytic_story:
-  -  Windows Defense Evasion Tactics
+  - Windows Defense Evasion Tactics
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -41,4 +41,9 @@ tags:
   - Registry.user
   - Registry.dest
   - Registry.registry_value_name
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log