Added detection testing service results inDetect Credential Dumping through LSASS access

detections/detect_credential_dumping_through_lsass_access.yml

@@ -1,6 +1,4 @@
-name: Detect Credential Dumping through LSASS access
-id: 2c365e57-4414-4540-8dc0-73ab10729996
-version: 3
+author: Patrick Bareiss, Splunk
 date: '2019-12-03'
 description: This search looks for reading lsass memory consistent with credential
   dumping.
@@ -10,33 +8,36 @@ how_to_implement: This search needs Sysmon Logs and a sysmon configuration, whic
   (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition
   with configurations for your Splunk environment. The search also uses a post-filter
   macro designed to filter out known false positives.
-type: ESCU
+id: 2c365e57-4414-4540-8dc0-73ab10729996
+known_false_positives: The activity may be legitimate. Other tools can access lsass
+  for legitimate reasons, and it's possible this event could be generated in those
+  cases. In these cases, false positives should be fairly obvious and you may need
+  to tweak the search to eliminate noise.
+name: Detect Credential Dumping through LSASS access
 references: []
-author: Patrick Bareiss, Splunk
 search: '`sysmon` EventCode=10 TargetImage=*lsass.exe (GrantedAccess=0x1010 OR GrantedAccess=0x1410)
   | stats count min(_time) as firstTime max(_time) as lastTime by Computer, SourceImage,
   SourceProcessId, TargetImage, TargetProcessId, EventCode, GrantedAccess | rename
   Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `detect_credential_dumping_through_lsass_access_filter` '
-known_false_positives: The activity may be legitimate. Other tools can access lsass
-  for legitimate reasons, and it's possible this event could be generated in those
-  cases. In these cases, false positives should be fairly obvious and you may need
-  to tweak the search to eliminate noise.
 tags:
   analytics_story:
   - Credential Dumping
   - Detect Zerologon Attack
-  mitre_attack_id:
-  - T1003.001
-  kill_chain_phases:
-  - Actions on Objectives
+  asset_type: Windows
+  automated_detection_testing: passed
   cis20:
   - CIS 3
   - CIS 5
   - CIS 16
+  kill_chain_phases:
+  - Actions on Objectives
+  mitre_attack_id:
+  - T1003.001
   nist:
   - PR.IP
   - PR.AC
   - DE.CM
   security_domain: endpoint
-  asset_type: Windows
+type: ESCU
+version: 3