new test file

detections/endpoint/processes_created_by_netsh.yml

@@ -1,7 +1,7 @@
 name: Processes created by netsh
 id: b89919ed-fe5f-492c-b139-95dbb162041e
-version: 4
-date: '2020-07-21'
+version: 5
+date: '2020-11-23'
 description: This search looks for processes launching netsh.exe to execute various
   commands via the netsh command-line utility. Netsh.exe is a command-line scripting
   utility that allows you to, either locally or remotely, display or modify the network
@@ -15,11 +15,9 @@ how_to_implement: To successfully implement this search, you must be ingesting l
 type: ESCU
 references: []
 author: Bhavin Patel, Splunk
-search: '| tstats `security_content_summariesonly` count values(Processes.process)
-  as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where (Processes.parent_process="*C:\\Windows\\System32\\netsh.exe*" AND Processes.process_path!="C:\\Program Files\\rempl\\sedlauncher.exe") by Processes.user
-  Processes.dest Processes.parent_process Processes.parent_process_name Processes.process_name
-  | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+search: '| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
+  where Processes.process_name=netsh.exe by Processes.user Processes.dest Processes.parent_process Processes.parent_process_name Processes.process_name
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `processes_created_by_netsh_filter`'
 known_false_positives: It is unusual for netsh.exe to have any child processes in
   most environments. It makes sense to investigate the child process and verify whether
@@ -28,8 +26,7 @@ tags:
   analytics_story:
   - Netsh Abuse
   mitre_attack_id:
-  - T1059.001
-  - T1059.003
+  - T1562.004
   kill_chain_phases:
   - Actions on Objectives
   cis20:

tests/endpoint/processes_created_by_netsh.test.yml

@@ -0,0 +1,10 @@
+name: Processes created by netsh Unit Test
+detections:
+- name: Processes created by netsh
+  file: endpoint/processes_created_by_netsh.yml
+  pass_condition: '| stats count | where count > 0'
+attack_data:
+- file_name: windows-sysmon.log
+  data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1562.004/windows-sysmon.log
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+  sourcetype: xmlwineventlog