From 88a3daef8b7dad79364aa4a2816efceeb67f13e4 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-19-83>
Date: Thu, 3 Jun 2021 15:25:32 +0000
Subject: [PATCH] Added detection testing service results inDetect SharpHound
 Command-Line Arguments

---
 ...tect_sharphound_command_line_arguments.yml | 36 +++++++++++--------
 1 file changed, 21 insertions(+), 15 deletions(-)

diff --git a/detections/endpoint/detect_sharphound_command_line_arguments.yml b/detections/endpoint/detect_sharphound_command_line_arguments.yml
index 3c5cf2cdf6..a8af92e86d 100644
--- a/detections/endpoint/detect_sharphound_command_line_arguments.yml
+++ b/detections/endpoint/detect_sharphound_command_line_arguments.yml
@@ -6,28 +6,33 @@ author: Michael Haag, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: The following analytic identifies common command-line arguments used by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances the defaults are used. This analytic works to identify the common command-line attributes used. It does not cover the entirety of every argument in order to avoid false positives.
+description: The following analytic identifies common command-line arguments used
+  by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS,
+  function names may be modified, but these changes are dependent upon the operator.
+  In most instances the defaults are used. This analytic works to identify the common
+  command-line attributes used. It does not cover the entirety of every argument in
+  order to avoid false positives.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*-collectionMethod*","*invoke-bloodhound*") by Processes.dest Processes.user Processes.parent_process Processes.process_name
-  Processes.process Processes.process_id Processes.parent_process_id
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` 
-  | `detect_sharphound_command_line_arguments_filter`'
+  as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*-collectionMethod*","*invoke-bloodhound*")
+  by Processes.dest Processes.user Processes.parent_process Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_sharphound_command_line_arguments_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
-known_false_positives: False positives should be limited as the arguments used are specific to SharpHound. Filter as needed or add more command-line arguments as needed.
+known_false_positives: False positives should be limited as the arguments used are
+  specific to SharpHound. Filter as needed or add more command-line arguments as needed.
 references:
-  - https://attack.mitre.org/software/S0521/
-  - https://thedfirreport.com/?s=bloodhound
-  - https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
-  - https://github.com/BloodHoundAD/SharpHound3
-  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk
+- https://attack.mitre.org/software/S0521/
+- https://thedfirreport.com/?s=bloodhound
+- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors
+- https://github.com/BloodHoundAD/SharpHound3
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk
 tags:
   analytic_story:
   - Discovery Techniques
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log
   kill_chain_phases:
   - Reconnaissance
   mitre_attack_id:
@@ -49,4 +54,5 @@ tags:
   - Processes.process
   - Processes.process_id
   - Processes.parent_process_id
-  security_domain: endpoint
\ No newline at end of file
+  security_domain: endpoint
+  automated_detection_testing: passed