Added detection testing service results inDisable Logs Using WevtUtil

detections/endpoint/disable_logs_using_wevtutil.yml

@@ -6,19 +6,21 @@ author: Teoderick Contreras, Splunk
 type: batch
 datamodel:
 - Endpoint
-description: This search is to detect execution of wevtutil.exe to disable logs.
-  This technique was seen in several ransomware to disable the event logs to evade alerts and detections.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.process_name = "wevtutil.exe" Processes.process = "*sl*" 
-  by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid
-  | `drop_dm_object_name(Processes)`
-  | `security_content_ctime(firstTime)` 
+description: This search is to detect execution of wevtutil.exe to disable logs. This
+  technique was seen in several ransomware to disable the event logs to evade alerts
+  and detections.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "wevtutil.exe"
+  Processes.process = "*sl*" by Processes.parent_process_name Processes.parent_process
+  Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id
+  Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)` | `disable_logs_using_wevtutil_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
-known_false_positives: network operator may disable audit event logs for debugging purposes.
+  Sysmon TA.
+known_false_positives: network operator may disable audit event logs for debugging
+  purposes.
 references:
 - https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/
 tags:
@@ -42,4 +44,7 @@ tags:
   - Processes.user
   - Processes.process_id
   - Processes.process_guid
-  security_domain: endpoint
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/data1/windows-sysmon.log