Added detection testing service results inReg exe Manipulating Windows Services Registry Keys

detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml

@@ -7,11 +7,12 @@ description: The search looks for reg.exe modifying registry keys that define Wi
 type: ESCU
 references: []
 author: Rico Valdez, Splunk
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process_name) as process_name
-  values(Processes.parent_process_name) as parent_process_name values(Processes.user) as user FROM datamodel=Endpoint.Processes
-  where Processes.process_name=reg.exe Processes.process=*reg* Processes.process=*add* Processes.process=*Services*
-  by Processes.process_id Processes.dest Processes.process | `drop_dm_object_name("Processes")`
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime values(Processes.process_name) as process_name values(Processes.parent_process_name)
+  as parent_process_name values(Processes.user) as user FROM datamodel=Endpoint.Processes
+  where Processes.process_name=reg.exe Processes.process=*reg* Processes.process=*add*
+  Processes.process=*Services* by Processes.process_id Processes.dest Processes.process
+  | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `reg_exe_manipulating_windows_services_registry_keys_filter`'
 known_false_positives: It is unusual for a service to be created or modified by directly
   manipulating the registry. However, there may be legitimate instances of this behavior.
@@ -36,3 +37,4 @@ tags:
   - DE.CM
   security_domain: endpoint
   asset_type: Endpoint
+  automated_detection_testing: passed