new detection testing file

detections/endpoint/batch_file_write_to_system32.yml

@@ -27,6 +27,8 @@ known_false_positives: It is possible for this search to generate a notable even
 tags:
   analytics_story:
   - SamSam Ransomware
+  mitre_attack_id:
+  - T1204.002
   kill_chain_phases:
   - Delivery
   cis20:

tests/endpoint/batch_file_write_to_system32.test.yml

@@ -0,0 +1,10 @@
+name: Batch File Write to System32 Unit Test
+detections:
+- name: Batch File Write to System32
+  file: endpoint/batch_file_write_to_system32.yml
+  pass_condition: '| stats count | where count > 0'
+attack_data:
+- file_name: windows-sysmon.log
+  data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1204.002_custom_b0162b8c-686d-4d97-83fe-7e80ac679cf4/windows-sysmon.log
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+  sourcetype: xmlwineventlog