updates to new testing structure

automated_detection_testing/detection_service.py

@@ -146,7 +146,7 @@ def main(args):
 
         for test in results['results']:
             if not test['error']:
-                file_path = 'security-content/detections/' + test['detection'].replace(' ', '_').replace('-','_').replace('.','_').replace('/','_').lower() + '.yml'
+                file_path = 'security-content/detections/' + test['detection_file']
                 detection_obj = load_file(file_path)
                 detection_obj['tags']['automated_detection_testing'] = 'passed'
                 if 'attack_data' in test_file:

tests/T1003_001.yml

@@ -1,14 +1,19 @@
 name: Credential Dumping LSASS memory test
 detections:
   - name: Access LSASS Memory for Dump Creation
+    file: endpoint/access_lsass_memory_for_dump_creation.yml
     pass_condition: '| stats count | where count > 0'
   - name: Create Remote Thread into LSASS
+    file: endpoint/create_remote_thread_into_lsass.yml
     pass_condition: '| stats count | where count > 0'
   - name: Detect Credential Dumping through LSASS access
+    file: endpoint/detect_credential_dumping_through_lsass_access.yml
     pass_condition: '| stats count | where count > 0'
   - name: Dump LSASS via comsvcs DLL
+    file: endpoint/dump_lsass_via_comsvcs_dll.yml
     pass_condition: '| stats count | where count > 0'
   - name: Unsigned Image Loaded by LSASS
+    file: endpoint/unsigned_image_loaded_by_lsass.yml
     pass_condition: '| stats count | where count > 0'
 description: Test credential dumping detections
 target: default-attack-range-windows-domain-controller

tests/T1003_002.yml

@@ -1,6 +1,7 @@
 name: Credential Dumping sam test
 detections:
   - name: Attempted Credential Dump From Registry via Reg exe
+    file: endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
     pass_condition: '| stats count | where count > 0'
 description: Test credential dumping detections
 target: default-attack-range-windows-domain-controller

tests/T1082.yml

@@ -1,6 +1,7 @@
 name: System Information Discovery
 detections:
   - name: System Information Discovery Detection
+    file: endpoint/system_information_discovery_detection.yml
     pass_condition: '| stats count | where count > 0'
 description: Test System Information Discovery Detection
 target: default-attack-range-windows-domain-controller