From 565c8610cd16a0a8d04a427c9701ebe0e108bb74 Mon Sep 17 00:00:00 2001
From: root <root@6aa0e479410f>
Date: Tue, 13 Oct 2020 15:40:24 +0000
Subject: [PATCH] Added detection testing service results inSystem Information
 Discovery Detection

---
 ...system_information_discovery_detection.yml | 82 +++++++++++--------
 1 file changed, 46 insertions(+), 36 deletions(-)

diff --git a/detections/system_information_discovery_detection.yml b/detections/system_information_discovery_detection.yml
index 3f8917bf14..8577696180 100644
--- a/detections/system_information_discovery_detection.yml
+++ b/detections/system_information_discovery_detection.yml
@@ -1,36 +1,46 @@
-author: Patrick Bareiss, Splunk
-date: '2020-10-12'
-description: Detect system information discovery techniques used by attackers to understand
-  configurations of the system to further exploit it.
-id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72
-known_false_positives: Administrators debugging servers
-name: System Information Discovery Detection
-references:
-- https://oscp.infosecsanyam.in/priv-escalation/windows-priv-escalation
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*"
-  OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.user
-  Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
-  | eventstats dc(process) as dc_processes_by_dest by dest | where dc_processes_by_dest
-  > 2 | stats values(process) min(firstTime) as firstTime max(lastTime) as lastTime
-  by user, dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
-  | `system_information_discovery_detection_filter`'
-tags:
-  analytics_story:
-  - Discovery Techniques
-  asset_type: Windows
-  automated_detection_testing: passed
-  cis20:
-  - CIS 6
-  - CIS 8
-  dataset:
-  - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1082/windows-sysmon.log
-  kill_chain_phases:
-  - Actions on Objectives
-  mitre_attack_id:
-  - T1082
-  nist:
-  - DE.CM
-  security_domain: endpoint
-type: ESCU
-version: 1
+!!python/object/apply:collections.OrderedDict
+- - - author
+    - Patrick Bareiss, Splunk
+  - - date
+    - '2020-10-12'
+  - - description
+    - Detect system information discovery techniques used by attackers to understand
+      configurations of the system to further exploit it.
+  - - id
+    - 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72
+  - - known_false_positives
+    - Administrators debugging servers
+  - - name
+    - System Information Discovery Detection
+  - - references
+    - - https://oscp.infosecsanyam.in/priv-escalation/windows-priv-escalation
+  - - search
+    - '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+      as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic*
+      qfe*" OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by
+      Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
+      | eventstats dc(process) as dc_processes_by_dest by dest | where dc_processes_by_dest
+      > 2 | stats values(process) min(firstTime) as firstTime max(lastTime) as lastTime
+      by user, dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+      | `system_information_discovery_detection_filter`'
+  - - tags
+    - analytics_story:
+      - Discovery Techniques
+      asset_type: Windows
+      automated_detection_testing: passed
+      cis20:
+      - CIS 6
+      - CIS 8
+      dataset:
+      - https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1082/windows-sysmon.log
+      kill_chain_phases:
+      - Actions on Objectives
+      mitre_attack_id:
+      - T1082
+      nist:
+      - DE.CM
+      security_domain: endpoint
+  - - type
+    - ESCU
+  - - version
+    - 1