new test file

detections/deprecated/malicious_powershell_process_with_obfuscation_techniques.yml

@@ -8,7 +8,7 @@ how_to_implement: You must be ingesting data that records process activity from
   hosts to populate the Endpoint data model in the Processes node. You must also be
   ingesting logs with both the process name and command line from your endpoints.
   The command-line arguments are mapped to the "process" field in the Endpoint data
-  model.
+  model. Deprecated because the detection need rework and would need to work base on powershell logs.
 type: ESCU
 references: []
 author: David Dorsey, Splunk

detections/endpoint/monitor_registry_keys_for_print_monitors.yml

@@ -1,7 +1,7 @@
 name: Monitor Registry Keys for Print Monitors
 id: f5f6af30-7ba7-4295-bfe9-07de87c01bbc
-version: 1
-date: '2018-11-02'
+version: 2
+date: '2020-11-23'
 description: This search looks for registry activity associated with modifications
   to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. In this
   scenario, an attacker can load an arbitrary .dll into the print-monitor registry
@@ -18,15 +18,17 @@ references: []
 author: Bhavin Patel, Splunk
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime FROM datamodel=Endpoint.Registry where Registry.action=modified AND
-  Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*" by Registry.dest,
-  Registry.registry_key_name Registry.status Registry.user Registry.registry_path
-  Registry.action | `drop_dm_object_name(Registry)` | `monitor_registry_keys_for_print_monitors_filter`'
+  Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*" by Registry.dest, Registry.registry_key_name
+  Registry.user Registry.registry_path Registry.registry_value_name Registry.action | `drop_dm_object_name(Registry)`
+  | `monitor_registry_keys_for_print_monitors_filter`'
 known_false_positives: You will encounter noise from legitimate print-monitor registry
   entries.
 tags:
   analytics_story:
   - Suspicious Windows Registry Activities
   - Windows Persistence Techniques
+  mitre_attack_id:
+  - T1547.010
   kill_chain_phases:
   - Actions on Objectives
   cis20:

tests/endpoint/monitor_registry_keys_for_print_monitors.test.yml

@@ -0,0 +1,10 @@
+name: Monitor Registry Keys for Print Monitors Unit Test
+detections:
+- name: Monitor Registry Keys for Print Monitors
+  file: endpoint/monitor_registry_keys_for_print_monitors.yml
+  pass_condition: '| stats count | where count > 0'
+attack_data:
+- file_name: windows-sysmon.log
+  data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1547.010/windows-sysmon.log
+  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+  sourcetype: xmlwineventlog