Fixed name of one detection. Fixed misnamed macros

in a handful of detections. Updated test information
for all detections since they originally pointed to a
single log file with multiple sources in it, leading to
it being parsed incorrectly.

detections/endpoint/powershell_script_block_with_url_chain.yml

@@ -69,6 +69,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/i_am_goot.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-powershell-xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
-    sourcetype: XmlWinEventLog
+    sourcetype: XmlWinEventLog

detections/endpoint/powershell_webrequest_using_memory_stream.yml

@@ -16,7 +16,7 @@ search: '`powershell` EventCode=4104  ScriptBlockText IN ("*system.net.webclient
 | rename Computer as dest, EventCode as signature_id
 | `security_content_ctime(firstTime)`
 | `security_content_ctime(lastTime)`
-| `powershell_webrequest_using_memorystream_filter`'
+| `powershell_webrequest_using_memory_stream_filter`'
 how_to_implement: The following analytic requires PowerShell operational logs
   to be imported. Modify the powershell macro as needed to match the sourcetype or
   add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
@@ -64,6 +64,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/i_am_goot.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-powershell-xml.log
     source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
     sourcetype: XmlWinEventLog

detections/endpoint/suspicious_process_executed_from_container_file_filter.yml

@@ -58,6 +58,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/i_am_goot.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: XmlWinEventLog
+    sourcetype: xmlwineventlog

detections/endpoint/windows_registry_payload_injection.yml

@@ -69,6 +69,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/i_am_goot.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: XmlWinEventLog
+    sourcetype: xmlwineventlog

detections/endpoint/windows_scheduled_task_service_spawned_shell.yml

@@ -65,6 +65,6 @@ tags:
 tests:
 - name: True Positive Test
   attack_data:
-  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/i_am_goot.log
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/gootloader/partial_ttps/windows-sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-    sourcetype: XmlWinEventLog
+    sourcetype: xmlwineventlog