test file

detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml

@@ -19,7 +19,7 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
   the entire logged PowerShell script block.'
 search: '`powershell` EventCode=4104 Message IN ("*copy*","*[System.IO.File]::Copy*") AND Message IN ("*System32\\config\\SAM*", "*System32\\config\\SYSTEM*","*System32\\config\\SECURITY*") | stats count min(_time) as firstTime max(_time)
   as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)`  | `detect_copy_of_shadowcopy_with_script_block_logging_filter`'
+  | `security_content_ctime(lastTime)` | `detect_copy_of_shadowcopy_with_script_block_logging_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
 known_false_positives: Limited false positives as the scope is limited to SAM, SYSTEM and SECURITY hives.
 references:

tests/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.test.yml

@@ -0,0 +1,12 @@
+name: Detect Copy of ShadowCopy with Script Block Logging Unit Test
+tests:
+- name: Detect Copy of ShadowCopy with Script Block Logging
+  file: detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/hivenightmare/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: wineventlog