Added detection testing service results inWermgr Process Spawned CMD Or Powershell Process

detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml

@@ -6,19 +6,21 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: This search is designed to detect suspicious cmd and powershell process spawned by wermgr.exe process.
-  This suspicious behavior are commonly seen in code injection technique technique like trickbot to execute a shellcode, dll modules to run malicious behavior.
-search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
-  where Processes.parent_process_name = "wermgr.exe" Processes.process_name = "cmd.exe" OR Processes.process_name = "powershell.exe" 
-  by Processes.parent_process_name Processes.parent_process_id  Processes.process_name Processes.process Processes.process_id Processes.process_guid Processes.dest Processes.user 
-  | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`
+description: This search is designed to detect suspicious cmd and powershell process
+  spawned by wermgr.exe process. This suspicious behavior are commonly seen in code
+  injection technique technique like trickbot to execute a shellcode, dll modules
+  to run malicious behavior.
+search: '| tstats `security_content_summariesonly` values(Processes.process) as cmdline
+  min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where Processes.parent_process_name = "wermgr.exe" Processes.process_name = "cmd.exe"
+  OR Processes.process_name = "powershell.exe" by Processes.parent_process_name Processes.parent_process_id  Processes.process_name
+  Processes.process Processes.process_id Processes.process_guid Processes.dest Processes.user
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `wermgr_process_spawned_cmd_or_powershell_process_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
+  Sysmon TA.
 known_false_positives: unknown
 references:
 - https://labs.vipre.com/trickbot-and-its-modules/
@@ -43,5 +45,8 @@ tags:
   - Processes.process_id
   - Processes.process_guid
   - Processes.dest
-  - Processes.user 
-  security_domain: endpoint
+  - Processes.user
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log