fixed missing test files

detections/cloud/azure_ad_unusual_number_of_failed_authentications_from_ip.yml

@@ -67,3 +67,10 @@ tags:
   - Splunk Cloud
   risk_score: 54
   security_domain: access
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azuread/azure-audit.log
+    source: mscs:azure:eventhub
+    sourcetype: mscs:azure:eventhub
+    update_timestamp: true

detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml

@@ -63,3 +63,14 @@ tags:
   - Splunk Cloud
   risk_score: 90
   security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/crowdstrike_falcon.log
+    source: crowdstrike
+    sourcetype: crowdstrike:events:sensor

detections/endpoint/bits_job_persistence.yml

@@ -68,3 +68,14 @@ tags:
   - Splunk Cloud
   risk_score: 56
   security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log
+    source: crowdstrike
+    sourcetype: crowdstrike:events:sensor

detections/endpoint/bitsadmin_download_file.yml

@@ -74,3 +74,14 @@ tags:
   - Splunk Cloud
   risk_score: 49
   security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/crowdstrike_falcon.log
+    source: crowdstrike
+    sourcetype: crowdstrike:events:sensor

detections/endpoint/creation_of_shadow_copy.yml

@@ -59,3 +59,14 @@ tags:
   - Splunk Cloud
   risk_score: 81
   security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.003/atomic_red_team/crowdstrike_falcon.log
+    source: crowdstrike
+    sourcetype: crowdstrike:events:sensor

detections/endpoint/dump_lsass_via_procdump.yml

@@ -69,3 +69,14 @@ tags:
   - Splunk Cloud
   risk_score: 80
   security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/crowdstrike_falcon.log
+    source: crowdstrike
+    sourcetype: crowdstrike:events:sensor

detections/endpoint/living_off_the_land.yml

@@ -38,9 +38,6 @@ tags:
   - Living Off The Land
   asset_type: Endpoint
   confidence: 70
-  drilldown_search: '| from datamodel:"Risk.All_Risk" 
-  | search risk_object="$risk_object$" risk_object_type="$risk_object_type$" annotations.analytic_story="$annotations.analytic_story$" annotations.mitre_attack.mitre_tactic="$annotations.mitre_attack.mitre_tactic$" 
-  | `get_correlations` | rename annotations.mitre_attack.mitre_tactic_id as mitre_tactic_id, annotations.mitre_attack.mitre_tactic as mitre_tactic, annotations.mitre_attack.mitre_technique_id as mitre_technique_id, annotations.mitre_attack.mitre_technique as mitre_technique'
   impact: 90
   message: An increase of Living Off The Land behavior has been detected on $affected_systems$
   mitre_attack_id:

detections/endpoint/windows_disable_memory_crash_dump.yml

@@ -70,3 +70,9 @@ tags:
   - Splunk Cloud
   risk_score: 90
   security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/hermetic_wiper/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

detections/endpoint/windows_indirect_command_execution_via_pcalua.yml

@@ -46,3 +46,9 @@ tags:
   - Splunk Cloud
   risk_score: 25
   security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1202/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog