Added detection testing service results inExcel Spawning PowerShell

detections/endpoint/excel_spawning_powershell.yml

@@ -15,20 +15,23 @@ description: The following detection identifies Microsoft Excel spawning PowerSh
   and identify any files that may have been written.
 search: '| tstats `security_content_summariesonly` count values(Processes.process)
   min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
-  where Processes.parent_process_name="excel.exe" Processes.process_name IN ("powershell.exe", "pwsh.exe")  by Processes.parent_process Processes.process_name
-  Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)` | `excel_spawning_powershell_filter`'
+  where Processes.parent_process_name="excel.exe" Processes.process_name IN ("powershell.exe",
+  "pwsh.exe")  by Processes.parent_process Processes.process_name Processes.user Processes.dest
+  | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
+  | `excel_spawning_powershell_filter`'
 how_to_implement: To successfully implement this search you need to be ingesting information
   on process that include the name of the process responsible for the changes from
   your endpoints into the `Endpoint` datamodel in the `Processes` node.
 known_false_positives: False positives should be limited, but if any are present,
   filter as needed.
 references:
-  - https://redcanary.com/threat-detection-report/techniques/powershell/
-  - https://attack.mitre.org/techniques/T1566/001/
+- https://redcanary.com/threat-detection-report/techniques/powershell/
+- https://attack.mitre.org/techniques/T1566/001/
 tags:
   analytic_story:
   - Spearphishing Attachments
-  dataset: []
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log
   kill_chain_phases:
   - Exploitation
   mitre_attack_id:
@@ -45,4 +48,5 @@ tags:
   - dest
   - user
   - parent_process_id
-  security_domain: endpoint
+  security_domain: endpoint
+  automated_detection_testing: passed