From a70ca7d827734dea51caaf389ba71f356639532f Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 18 Mar 2022 13:56:51 -0700
Subject: [PATCH 1/5] If a test or detection file is missing, then all of the
 missing files should be printed and an exception should be thrown. We must
 not be allowed to continue testing.

---
 .../ci/detection_testing_batch/modules/github_service.py  | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/bin/automated_detection_testing/ci/detection_testing_batch/modules/github_service.py b/bin/automated_detection_testing/ci/detection_testing_batch/modules/github_service.py
index ffedd07ea2..f8ecc0b762 100644
--- a/bin/automated_detection_testing/ci/detection_testing_batch/modules/github_service.py
+++ b/bin/automated_detection_testing/ci/detection_testing_batch/modules/github_service.py
@@ -147,7 +147,7 @@ class GithubService:
                          summary_file: str = None) -> list[str]:
         pruned_tests = []
         csvlines = []
-        
+        found_error = False
         for detection in detections_to_prune:
             if os.path.basename(detection).startswith("ssa") and exclude_ssa:
                 continue
@@ -164,6 +164,7 @@ class GithubService:
                     if not os.path.exists(test_filepath):
                         print("Detection [%s] references [%s], but it does not exist" % (
                             detection, test_filepath))
+                        found_error = True
                         #raise(Exception("Detection [%s] references [%s], but it does not exist"%(detection, test_filepath)))
                     elif test_filepath_without_security_content in previously_successful_tests:
                         print(
@@ -201,7 +202,10 @@ class GithubService:
                 for r in csvlines:
                     writer.writerow(r)
 
-        return pruned_tests
+        if found_error == False:
+            return pruned_tests
+        else:
+            raise(Exception("Error(s) in processing getting detections to test: see output above for specific error information."))
 
     def get_test_files(self, mode: str, folders: list[str],   types: list[str],
                        detections_list: Union[list[str], None],

From d984d1e245055d4361aef680b321e41a7ed33ab0 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 18 Mar 2022 14:01:31 -0700
Subject: [PATCH 2/5] Updating two incorrectly named tests.

---
 tests/endpoint/{macos_lolbin.yml => macos_lolbin.test.yml}        | 0
 ...ell_loading_dotnet_into_memory_via_reflection_filter.test.yml} | 0
 2 files changed, 0 insertions(+), 0 deletions(-)
 rename tests/endpoint/{macos_lolbin.yml => macos_lolbin.test.yml} (100%)
 rename tests/endpoint/{powershell_loading_dotnet_into_memory_via_reflection.test.yml => powershell_loading_dotnet_into_memory_via_reflection_filter.test.yml} (100%)

diff --git a/tests/endpoint/macos_lolbin.yml b/tests/endpoint/macos_lolbin.test.yml
similarity index 100%
rename from tests/endpoint/macos_lolbin.yml
rename to tests/endpoint/macos_lolbin.test.yml
diff --git a/tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection.test.yml b/tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection_filter.test.yml
similarity index 100%
rename from tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection.test.yml
rename to tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection_filter.test.yml

From 2db4f0caae0b8c53eff8f8fc3b5b8b825e32db20 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 18 Mar 2022 16:44:39 -0700
Subject: [PATCH 3/5] Final fix to incorrect naming of a test and detection to
 match each other.

---
 ... powershell_loading_dotnet_into_memory_via_reflection.yml} | 0
 ...lly_high_number_of_cloud_infrastructure_api_calls.test.yml | 2 +-
 ...lly_high_number_of_cloud_security_group_api_calls.test.yml | 2 +-
 ...s_account_activity_from_previously_unseen_account.test.yml | 4 ++--
 ...cloud_api_calls_from_previously_unseen_user_roles.test.yml | 4 ++--
 ...ompute_instance_created_by_previously_unseen_user.test.yml | 4 ++--
 ...pute_instance_created_in_previously_unused_region.test.yml | 4 ++--
 ...ute_instance_created_with_previously_unseen_image.test.yml | 4 ++--
 ...ance_created_with_previously_unseen_instance_type.test.yml | 4 ++--
 ...oud_instance_modified_with_previously_unseen_user.test.yml | 4 ++--
 .../cloud_provisioning_from_previously_unseen_city.test.yml   | 4 ++--
 ...cloud_provisioning_from_previously_unseen_country.test.yml | 4 ++--
 ...ud_provisioning_from_previously_unseen_ip_address.test.yml | 4 ++--
 .../cloud_provisioning_from_previously_unseen_region.test.yml | 4 ++--
 tests/cloud/detect_aws_console_login_by_new_user.test.yml     | 4 ++--
 .../detect_aws_console_login_by_user_from_new_city.test.yml   | 4 ++--
 ...detect_aws_console_login_by_user_from_new_country.test.yml | 4 ++--
 .../detect_aws_console_login_by_user_from_new_region.test.yml | 4 ++--
 ...rshell_loading_dotnet_into_memory_via_reflection.test.yml} | 0
 19 files changed, 32 insertions(+), 32 deletions(-)
 rename detections/endpoint/{powershell_loading_dotnet_into_memory_via_reflection_filter.yml => powershell_loading_dotnet_into_memory_via_reflection.yml} (100%)
 rename tests/endpoint/{powershell_loading_dotnet_into_memory_via_reflection_filter.test.yml => powershell_loading_dotnet_into_memory_via_reflection.test.yml} (100%)

diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection_filter.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml
similarity index 100%
rename from detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection_filter.yml
rename to detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml
diff --git a/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml b/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml
index fae6763b30..290bc2758d 100644
--- a/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml
+++ b/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml
@@ -7,7 +7,7 @@ tests:
   latest_time: now
   baselines:
   - name: Baseline Of Cloud Infrastructure API Calls Per User
-    file: detections/cloud/baseline_of_cloud_infrastructure_api_calls_per_user.yml
+    file: baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml b/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml
index 91188972e6..0f73d485d2 100644
--- a/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml
+++ b/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml
@@ -7,7 +7,7 @@ tests:
   latest_time: now
   baselines:
   - name: Baseline Of Cloud Security Group API Calls Per User
-    file: detections/cloud/baseline_of_cloud_security_group_api_calls_per_user.yml
+    file: baselines/baseline_of_cloud_security_group_api_calls_per_user.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml b/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml
index 2c03b8db04..5213f6b857 100644
--- a/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml
+++ b/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen AWS Cross Account Activity - Initial
-    file: detections/cloud/previously_seen_aws_cross_account_activity_initial.yml
+    file: baselines/previously_seen_aws_cross_account_activity___initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen AWS Cross Account Activity - Update
-    file: detections/cloud/previously_seen_aws_cross_account_activity_update.yml
+    file: baselines/previously_seen_aws_cross_account_activity___update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml b/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml
index 0124df4117..1554b96ffa 100644
--- a/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml
+++ b/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen Cloud API Calls Per User Role - Initial
-    file: detections/cloud/previously_seen_cloud_api_calls_per_user_role_initial.yml
+    file: baselines/previously_seen_cloud_api_calls_per_user_role___initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen Cloud API Calls Per User Role - Update
-    file: detections/cloud/previously_seen_cloud_api_calls_per_user_role_update.yml
+    file: baselines/previously_seen_cloud_api_calls_per_user_role___update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml b/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml
index 65a2e8624f..f52b12aa01 100644
--- a/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml
+++ b/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen Cloud Compute Creations By User - Initial
-    file: detections/cloud/previously_seen_cloud_compute_creations_by_user_initial.yml
+    file: baselines/previously_seen_cloud_compute_creations_by_user___initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen Cloud Compute Creations By User - Update
-    file: detections/cloud/previously_seen_cloud_compute_creations_by_user_update.yml
+    file: baselines/previously_seen_cloud_compute_creations_by_user___update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml b/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml
index d91095aff0..9964e1d82b 100644
--- a/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml
+++ b/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen Cloud Regions - Initial
-    file: detections/cloud/previously_seen_cloud_regions_initial.yml
+    file: baselines/previously_seen_cloud_regions___initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen Cloud Regions - Update
-    file: detections/cloud/previously_seen_cloud_regions_update.yml
+    file: baselines/previously_seen_cloud_regions___update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml
index 50115a04bf..bcb75a79e1 100644
--- a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml
+++ b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen Cloud Compute Images - Initial
-    file: detections/cloud/previously_seen_cloud_compute_images_initial.yml
+    file: baselines/previously_seen_cloud_compute_images___initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen Cloud Compute Images - Update
-    file: detections/cloud/previously_seen_cloud_compute_images_update.yml
+    file: baselines/previously_seen_cloud_compute_images___update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml
index b72e7d26aa..27e1083bf4 100644
--- a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml
+++ b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen Cloud Compute Instance Types - Initial
-    file: detections/cloud/previously_seen_cloud_compute_instance_types_initial.yml
+    file: baselines/previously_seen_cloud_compute_instance_types___initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen Cloud Compute Instance Types - Update
-    file: detections/cloud/previously_seen_cloud_compute_instance_types_update.yml
+    file: baselines/previously_seen_cloud_compute_instance_types___update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml b/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml
index b2f6d85aaf..c5998f919f 100644
--- a/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml
+++ b/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen Cloud Instance Modifications By User - Initial
-    file: detections/cloud/previously_seen_cloud_instance_modifications_by_user_initial.yml
+    file: baselines/previously_seen_cloud_instance_modifications_by_user___initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen Cloud Instance Modifications By User - Update
-    file: detections/cloud/previously_seen_cloud_instance_modifications_by_user_update.yml
+    file: baselines/previously_seen_cloud_instance_modifications_by_user___update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml
index 5e1d145109..e1d4a7e3cd 100644
--- a/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml
+++ b/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen Cloud Provisioning Activity Sources - Initial
-    file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml
+    file: baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen Cloud Provisioning Activity Sources - Update
-    file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml
+    file: baselines/previously_seen_cloud_provisioning_activity_sources___update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml
index 3d3b73b3f7..9b32c57e92 100644
--- a/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml
+++ b/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen Cloud Provisioning Activity Sources - Initial
-    file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml
+    file: baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen Cloud Provisioning Activity Sources - Update
-    file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml
+    file: baselines/previously_seen_cloud_provisioning_activity_sources___update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml
index a8e77d70c8..22095ed888 100644
--- a/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml
+++ b/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen Cloud Provisioning Activity Sources - Initial
-    file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml
+    file: baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen Cloud Provisioning Activity Sources - Update
-    file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml
+    file: baselines/previously_seen_cloud_provisioning_activity_sources___update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml
index c483e82604..9f5969eb7d 100644
--- a/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml
+++ b/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen Cloud Provisioning Activity Sources - Initial
-    file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml
+    file: baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen Cloud Provisioning Activity Sources - Update
-    file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml
+    file: baselines/previously_seen_cloud_provisioning_activity_sources___update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/detect_aws_console_login_by_new_user.test.yml b/tests/cloud/detect_aws_console_login_by_new_user.test.yml
index ad1cb98bea..3ef59ba1c6 100644
--- a/tests/cloud/detect_aws_console_login_by_new_user.test.yml
+++ b/tests/cloud/detect_aws_console_login_by_new_user.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen Users In Cloudtrail - Initial
-    file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml
+    file: baselines/previously_seen_users_in_cloudtrail___initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen Users In Cloudtrail - Update
-    file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml
+    file: baselines/previously_seen_users_in_cloudtrail___update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml b/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml
index bbec97937b..72ca7c23c9 100644
--- a/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml
+++ b/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen Users In Cloudtrail - Initial
-    file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml
+    file: baselines/previously_seen_users_in_cloudtrail___initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen Users In Cloudtrail - Update
-    file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml
+    file: baselines/previously_seen_users_in_cloudtrail___update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml b/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml
index 8e4e13e7bc..72cf23e6e2 100644
--- a/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml
+++ b/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen Users In Cloudtrail - Initial
-    file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml
+    file: baselines/previously_seen_users_in_cloudtrail___initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen Users In Cloudtrail - Update
-    file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml
+    file: baselines/previously_seen_users_in_cloudtrail___update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml b/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml
index b494592421..23eb695f11 100644
--- a/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml
+++ b/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen Users In Cloudtrail - Initial
-    file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml
+    file: baselines/previously_seen_users_in_cloudtrail___initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen Users In Cloudtrail - Update
-    file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml
+    file: baselines/previously_seen_users_in_cloudtrail___update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection_filter.test.yml b/tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection.test.yml
similarity index 100%
rename from tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection_filter.test.yml
rename to tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection.test.yml

From 923e3c2d79e1dfe4582b5391df975645f04de484 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 18 Mar 2022 16:55:22 -0700
Subject: [PATCH 4/5] Revert "Final fix to incorrect naming of a test and
 detection to match each other." inluded modified files that should not have
 been in this commit.  Rolling back those changes. This reverts commit
 2db4f0caae0b8c53eff8f8fc3b5b8b825e32db20.

---
 ...hell_loading_dotnet_into_memory_via_reflection_filter.yml} | 0
 ...lly_high_number_of_cloud_infrastructure_api_calls.test.yml | 2 +-
 ...lly_high_number_of_cloud_security_group_api_calls.test.yml | 2 +-
 ...s_account_activity_from_previously_unseen_account.test.yml | 4 ++--
 ...cloud_api_calls_from_previously_unseen_user_roles.test.yml | 4 ++--
 ...ompute_instance_created_by_previously_unseen_user.test.yml | 4 ++--
 ...pute_instance_created_in_previously_unused_region.test.yml | 4 ++--
 ...ute_instance_created_with_previously_unseen_image.test.yml | 4 ++--
 ...ance_created_with_previously_unseen_instance_type.test.yml | 4 ++--
 ...oud_instance_modified_with_previously_unseen_user.test.yml | 4 ++--
 .../cloud_provisioning_from_previously_unseen_city.test.yml   | 4 ++--
 ...cloud_provisioning_from_previously_unseen_country.test.yml | 4 ++--
 ...ud_provisioning_from_previously_unseen_ip_address.test.yml | 4 ++--
 .../cloud_provisioning_from_previously_unseen_region.test.yml | 4 ++--
 tests/cloud/detect_aws_console_login_by_new_user.test.yml     | 4 ++--
 .../detect_aws_console_login_by_user_from_new_city.test.yml   | 4 ++--
 ...detect_aws_console_login_by_user_from_new_country.test.yml | 4 ++--
 .../detect_aws_console_login_by_user_from_new_region.test.yml | 4 ++--
 ...loading_dotnet_into_memory_via_reflection_filter.test.yml} | 0
 19 files changed, 32 insertions(+), 32 deletions(-)
 rename detections/endpoint/{powershell_loading_dotnet_into_memory_via_reflection.yml => powershell_loading_dotnet_into_memory_via_reflection_filter.yml} (100%)
 rename tests/endpoint/{powershell_loading_dotnet_into_memory_via_reflection.test.yml => powershell_loading_dotnet_into_memory_via_reflection_filter.test.yml} (100%)

diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection_filter.yml
similarity index 100%
rename from detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml
rename to detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection_filter.yml
diff --git a/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml b/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml
index 290bc2758d..fae6763b30 100644
--- a/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml
+++ b/tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml
@@ -7,7 +7,7 @@ tests:
   latest_time: now
   baselines:
   - name: Baseline Of Cloud Infrastructure API Calls Per User
-    file: baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml
+    file: detections/cloud/baseline_of_cloud_infrastructure_api_calls_per_user.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml b/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml
index 0f73d485d2..91188972e6 100644
--- a/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml
+++ b/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml
@@ -7,7 +7,7 @@ tests:
   latest_time: now
   baselines:
   - name: Baseline Of Cloud Security Group API Calls Per User
-    file: baselines/baseline_of_cloud_security_group_api_calls_per_user.yml
+    file: detections/cloud/baseline_of_cloud_security_group_api_calls_per_user.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml b/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml
index 5213f6b857..2c03b8db04 100644
--- a/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml
+++ b/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen AWS Cross Account Activity - Initial
-    file: baselines/previously_seen_aws_cross_account_activity___initial.yml
+    file: detections/cloud/previously_seen_aws_cross_account_activity_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen AWS Cross Account Activity - Update
-    file: baselines/previously_seen_aws_cross_account_activity___update.yml
+    file: detections/cloud/previously_seen_aws_cross_account_activity_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml b/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml
index 1554b96ffa..0124df4117 100644
--- a/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml
+++ b/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen Cloud API Calls Per User Role - Initial
-    file: baselines/previously_seen_cloud_api_calls_per_user_role___initial.yml
+    file: detections/cloud/previously_seen_cloud_api_calls_per_user_role_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen Cloud API Calls Per User Role - Update
-    file: baselines/previously_seen_cloud_api_calls_per_user_role___update.yml
+    file: detections/cloud/previously_seen_cloud_api_calls_per_user_role_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml b/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml
index f52b12aa01..65a2e8624f 100644
--- a/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml
+++ b/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen Cloud Compute Creations By User - Initial
-    file: baselines/previously_seen_cloud_compute_creations_by_user___initial.yml
+    file: detections/cloud/previously_seen_cloud_compute_creations_by_user_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen Cloud Compute Creations By User - Update
-    file: baselines/previously_seen_cloud_compute_creations_by_user___update.yml
+    file: detections/cloud/previously_seen_cloud_compute_creations_by_user_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml b/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml
index 9964e1d82b..d91095aff0 100644
--- a/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml
+++ b/tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen Cloud Regions - Initial
-    file: baselines/previously_seen_cloud_regions___initial.yml
+    file: detections/cloud/previously_seen_cloud_regions_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen Cloud Regions - Update
-    file: baselines/previously_seen_cloud_regions___update.yml
+    file: detections/cloud/previously_seen_cloud_regions_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml
index bcb75a79e1..50115a04bf 100644
--- a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml
+++ b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen Cloud Compute Images - Initial
-    file: baselines/previously_seen_cloud_compute_images___initial.yml
+    file: detections/cloud/previously_seen_cloud_compute_images_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen Cloud Compute Images - Update
-    file: baselines/previously_seen_cloud_compute_images___update.yml
+    file: detections/cloud/previously_seen_cloud_compute_images_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml
index 27e1083bf4..b72e7d26aa 100644
--- a/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml
+++ b/tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen Cloud Compute Instance Types - Initial
-    file: baselines/previously_seen_cloud_compute_instance_types___initial.yml
+    file: detections/cloud/previously_seen_cloud_compute_instance_types_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen Cloud Compute Instance Types - Update
-    file: baselines/previously_seen_cloud_compute_instance_types___update.yml
+    file: detections/cloud/previously_seen_cloud_compute_instance_types_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml b/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml
index c5998f919f..b2f6d85aaf 100644
--- a/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml
+++ b/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen Cloud Instance Modifications By User - Initial
-    file: baselines/previously_seen_cloud_instance_modifications_by_user___initial.yml
+    file: detections/cloud/previously_seen_cloud_instance_modifications_by_user_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen Cloud Instance Modifications By User - Update
-    file: baselines/previously_seen_cloud_instance_modifications_by_user___update.yml
+    file: detections/cloud/previously_seen_cloud_instance_modifications_by_user_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml
index e1d4a7e3cd..5e1d145109 100644
--- a/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml
+++ b/tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen Cloud Provisioning Activity Sources - Initial
-    file: baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml
+    file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen Cloud Provisioning Activity Sources - Update
-    file: baselines/previously_seen_cloud_provisioning_activity_sources___update.yml
+    file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml
index 9b32c57e92..3d3b73b3f7 100644
--- a/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml
+++ b/tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen Cloud Provisioning Activity Sources - Initial
-    file: baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml
+    file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen Cloud Provisioning Activity Sources - Update
-    file: baselines/previously_seen_cloud_provisioning_activity_sources___update.yml
+    file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml
index 22095ed888..a8e77d70c8 100644
--- a/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml
+++ b/tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen Cloud Provisioning Activity Sources - Initial
-    file: baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml
+    file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen Cloud Provisioning Activity Sources - Update
-    file: baselines/previously_seen_cloud_provisioning_activity_sources___update.yml
+    file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml b/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml
index 9f5969eb7d..c483e82604 100644
--- a/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml
+++ b/tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen Cloud Provisioning Activity Sources - Initial
-    file: baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml
+    file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen Cloud Provisioning Activity Sources - Update
-    file: baselines/previously_seen_cloud_provisioning_activity_sources___update.yml
+    file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/detect_aws_console_login_by_new_user.test.yml b/tests/cloud/detect_aws_console_login_by_new_user.test.yml
index 3ef59ba1c6..ad1cb98bea 100644
--- a/tests/cloud/detect_aws_console_login_by_new_user.test.yml
+++ b/tests/cloud/detect_aws_console_login_by_new_user.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen Users In Cloudtrail - Initial
-    file: baselines/previously_seen_users_in_cloudtrail___initial.yml
+    file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen Users In Cloudtrail - Update
-    file: baselines/previously_seen_users_in_cloudtrail___update.yml
+    file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml b/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml
index 72ca7c23c9..bbec97937b 100644
--- a/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml
+++ b/tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen Users In Cloudtrail - Initial
-    file: baselines/previously_seen_users_in_cloudtrail___initial.yml
+    file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen Users In Cloudtrail - Update
-    file: baselines/previously_seen_users_in_cloudtrail___update.yml
+    file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml b/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml
index 72cf23e6e2..8e4e13e7bc 100644
--- a/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml
+++ b/tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen Users In Cloudtrail - Initial
-    file: baselines/previously_seen_users_in_cloudtrail___initial.yml
+    file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen Users In Cloudtrail - Update
-    file: baselines/previously_seen_users_in_cloudtrail___update.yml
+    file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml b/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml
index 23eb695f11..b494592421 100644
--- a/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml
+++ b/tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml
@@ -7,12 +7,12 @@ tests:
   latest_time: now
   baselines:
   - name: Previously Seen Users In Cloudtrail - Initial
-    file: baselines/previously_seen_users_in_cloudtrail___initial.yml
+    file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
   - name: Previously Seen Users In Cloudtrail - Update
-    file: baselines/previously_seen_users_in_cloudtrail___update.yml
+    file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml
     pass_condition: '| stats count | where count > 0'
     earliest_time: -30d
     latest_time: -1d
diff --git a/tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection.test.yml b/tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection_filter.test.yml
similarity index 100%
rename from tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection.test.yml
rename to tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection_filter.test.yml

From 1aab69727255e0ef6954fceca4737da763bd00a9 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 18 Mar 2022 16:58:45 -0700
Subject: [PATCH 5/5] Properly fixing name of test and detection to match each
 other.

---
 ...l => powershell_loading_dotnet_into_memory_via_reflection.yml} | 0
 ...powershell_loading_dotnet_into_memory_via_reflection.test.yml} | 0
 2 files changed, 0 insertions(+), 0 deletions(-)
 rename detections/endpoint/{powershell_loading_dotnet_into_memory_via_reflection_filter.yml => powershell_loading_dotnet_into_memory_via_reflection.yml} (100%)
 rename tests/endpoint/{powershell_loading_dotnet_into_memory_via_reflection_filter.test.yml => powershell_loading_dotnet_into_memory_via_reflection.test.yml} (100%)

diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection_filter.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml
similarity index 100%
rename from detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection_filter.yml
rename to detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml
diff --git a/tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection_filter.test.yml b/tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection.test.yml
similarity index 100%
rename from tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection_filter.test.yml
rename to tests/endpoint/powershell_loading_dotnet_into_memory_via_reflection.test.yml