Added detection testing service results inLinux At Application Execution

detections/endpoint/linux_at_application_execution.yml

@@ -6,21 +6,23 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: The following analytic identifies a suspicious process creation of At application.
-  This process can be used by malware, adversaries and red teamers to create persistence entry to the targeted or compromised host with their
-  malicious code. This anomaly detection can be a good indicator to investigate the event before and after this process execution, when it was executed and what 
-  schedule task it will execute.
-search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes where  Processes.process_name = at OR Processes.parent_process_name = at
-  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
-  | `linux_at_application_execution_filter`'
+description: The following analytic identifies a suspicious process creation of At
+  application. This process can be used by malware, adversaries and red teamers to
+  create persistence entry to the targeted or compromised host with their malicious
+  code. This anomaly detection can be a good indicator to investigate the event before
+  and after this process execution, when it was executed and what schedule task it
+  will execute.
+search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes
+  where  Processes.process_name = at OR Processes.parent_process_name = at by Processes.dest
+  Processes.user Processes.parent_process_name Processes.process_name Processes.process
+  Processes.process_id Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
+  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_at_application_execution_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
-known_false_positives: Administrator or network operator can use this application for automation purposes. filter is needed 
+  Sysmon TA.
+known_false_positives: Administrator or network operator can use this application
+  for automation purposes. filter is needed
 references:
 - https://attack.mitre.org/techniques/T1053/001/
 - https://www.linkedin.com/pulse/getting-attacker-ip-address-from-malicious-linux-job-craig-rowland/
@@ -29,7 +31,7 @@ tags:
   - Linux Privilege Escalation
   - Linux Persistence Techniques
   dataset:
-  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.001/sysmon_linux.log
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.001/at_execution/sysmon_linux.log
   kill_chain_phases:
   - Privilege Escalation
   mitre_attack_id:
@@ -41,17 +43,16 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.dest 
-  - Processes.user 
-  - Processes.parent_process_name 
-  - Processes.process_name 
-  - Processes.process 
-  - Processes.process_id 
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
   impact: 30
-  confidence: 30 
-  # (impact * confidence)/100
+  confidence: 30
   risk_score: 9
   context:
   - source:endpoint
@@ -67,4 +68,5 @@ tags:
   cis20:
   - CIS 3
   - CIS 5
-  - CIS 16
+  - CIS 16
+  automated_detection_testing: passed