Added detection testing service results inChange Default File Association

detections/endpoint/change_default_file_association.yml

@@ -6,16 +6,16 @@ author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
-description: This analytic is developed to detect suspicious registry modification to change the default file association of windows to malicious payload.
-  This techninique was seen in some APT where it modify the default process to run file association, like .txt to notepad.exe. Instead notepad.exe it will point to a Script 
-  or other payload that will load malicious command to the compromised host.
+description: This analytic is developed to detect suspicious registry modification
+  to change the default file association of windows to malicious payload. This techninique
+  was seen in some APT where it modify the default process to run file association,
+  like .txt to notepad.exe. Instead notepad.exe it will point to a Script or other
+  payload that will load malicious command to the compromised host.
 search: '| tstats `security_content_summariesonly` count  min(_time) as firstTime
-  max(_time) as lastTime FROM datamodel=Endpoint.Registry 
-  where Registry.registry_path ="*\\shell\\open\\command\\*" Registry.registry_path = "*HKCR\\*"
-  by Registry.dest  Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name 
-  | `security_content_ctime(lastTime)`  
-  | `security_content_ctime(firstTime)`
-  | `drop_dm_object_name(Registry)`
+  max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path
+  ="*\\shell\\open\\command\\*" Registry.registry_path = "*HKCR\\*" by Registry.dest  Registry.user
+  Registry.registry_path Registry.registry_key_name Registry.registry_value_name |
+  `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)`
   | `change_default_file_association_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
   that records registry activity from your hosts to populate the endpoint data model
@@ -25,7 +25,7 @@ how_to_implement: To successfully implement this search, you must be ingesting d
   to the registry.
 known_false_positives: unknown
 references:
--  https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features
+- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features
 tags:
   analytic_story:
   - Windows Persistence Techniques
@@ -42,15 +42,14 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Registry.dest 
-  - Registry.user 
-  - Registry.registry_path 
-  - Registry.registry_key_name 
-  - Registry.registry_value_name 
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_path
+  - Registry.registry_key_name
+  - Registry.registry_value_name
   security_domain: endpoint
   impact: 80
   confidence: 100
-  # (impact * confidence)/100
   risk_score: 80
   context:
   - source:endpoint
@@ -64,4 +63,5 @@ tags:
   - name: user
     type: user
     role:
-    - Victim
+    - Victim
+  automated_detection_testing: passed