Added detection testing service results inDetect SharpHound Command-Line Arguments

detections/endpoint/detect_sharphound_command_line_arguments.yml

@@ -6,28 +6,33 @@ author: Michael Haag, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: The following analytic identifies common command-line arguments used by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives.
+description: The following analytic identifies common command-line arguments used
+  by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS,
+  function names may be modified, but these changes are dependent upon the operator.
+  In most instances the defaults are used. This analytic works to identify the common
+  command-line attributes used. It does not cover the entirety of every argument in
+  order to avoid false positives.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*-collectionMethod*","*invoke-bloodhound*") by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `detect_sharphound_command_line_arguments_filter`'
+  as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*-collectionMethod*","*invoke-bloodhound*")
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_sharphound_command_line_arguments_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: False positives should be limited as the arguments used are specific to SharpHound. Filter as needed or add more command-line arguments as needed.
+known_false_positives: False positives should be limited as the arguments used are
+  specific to SharpHound. Filter as needed or add more command-line arguments as needed.
 references:
-  - https://attack.mitre.org/software/S0521/
-  - https://thedfirreport.com/?s=bloodhound
-  - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
-  - https://github.com/BloodHoundAD/SharpHound3
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk
+- https://attack.mitre.org/software/S0521/
+- https://thedfirreport.com/?s=bloodhound
+- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
+- https://github.com/BloodHoundAD/SharpHound3
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk
 tags:
   analytic_story:
   - Discovery Techniques
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
   kill_chain_phases:
   - Reconnaissance
   mitre_attack_id:
@@ -49,4 +54,5 @@ tags:
   - Processes.process
   - Processes.process_id
   - Processes.parent_process_id
-  security_domain: endpoint
+  security_domain: endpoint
+  automated_detection_testing: passed