From 0838a2835d60e51445a3f22dee5c452346a90110 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-0-148>
Date: Tue, 8 Dec 2020 14:58:22 +0000
Subject: [PATCH] Added detection testing service results inWMI Permanent Event
 Subscription - Sysmon

---
 .../endpoint/wmi_permanent_event_subscription___sysmon.yml     | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml
index c95f8b1775..4a57b90630 100644
--- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml
+++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml
@@ -31,3 +31,6 @@ tags:
   - PR.IP
   security_domain: endpoint
   asset_type: Endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.003/atomic_red_team/windows-sysmon.log