From dfe21c1da89488ea69a070446c1b54a1265dba76 Mon Sep 17 00:00:00 2001
From: P4T12ICK <pbareib@splunk.com>
Date: Fri, 18 Jun 2021 13:24:50 +0200
Subject: [PATCH] wip labeled data

---
 .../modules/splunk_sdk.py                     | 32 +++++++++++++++++++
 .../modules/testing_service.py                |  4 +++
 ...dential_dump_from_registry_via_reg_exe.yml |  1 +
 3 files changed, 37 insertions(+)

diff --git a/automated_detection_testing/ci/detection_testing_batch/modules/splunk_sdk.py b/automated_detection_testing/ci/detection_testing_batch/modules/splunk_sdk.py
index 6a792ba1ca..2dd68fc390 100644
--- a/automated_detection_testing/ci/detection_testing_batch/modules/splunk_sdk.py
+++ b/automated_detection_testing/ci/detection_testing_batch/modules/splunk_sdk.py
@@ -54,6 +54,38 @@ def test_baseline_search(splunk_host, splunk_password, search, pass_condition, b
         return test_results
 
 
+def run_modified_splunk_search(splunk_host, splunk_password, search, detection_name, detection_file, earliest_time, latest_time):
+    try:
+        service = client.connect(
+            host=splunk_host,
+            port=8089,
+            username='admin',
+            password=splunk_password
+        )
+    except Exception as e:
+        print("Unable to connect to Splunk instance: " + str(e))
+        return 1, {}
+
+    if search.startswith('|'):
+        search = search
+    else:
+        search = 'search ' + search
+
+    kwargs = {"exec_mode": "blocking",
+              "dispatch.earliest_time": "-1d",
+              "dispatch.latest_time": "now"}
+
+    splunk_search = search + ' ' + pass_condition
+
+    try:
+        job = service.jobs.create(splunk_search, **kwargs)
+    except Exception as e:
+        print("Unable to execute detection: " + str(e))
+        return 1, {}
+
+    print(job)
+
+
 def test_detection_search(splunk_host, splunk_password, search, pass_condition, detection_name, detection_file, earliest_time, latest_time):
     try:
         service = client.connect(
diff --git a/automated_detection_testing/ci/detection_testing_batch/modules/testing_service.py b/automated_detection_testing/ci/detection_testing_batch/modules/testing_service.py
index 7e5f625d65..6edb84b674 100644
--- a/automated_detection_testing/ci/detection_testing_batch/modules/testing_service.py
+++ b/automated_detection_testing/ci/detection_testing_batch/modules/testing_service.py
@@ -9,6 +9,7 @@ import requests
 from modules.DataManipulation import DataManipulation
 from modules import splunk_sdk, aws_service
 
+
 def prepare_detection_testing(ssh_key_name, private_key, splunk_ip, splunk_password):
     with open(ssh_key_name, 'w') as file :
         file.write(private_key)
@@ -97,6 +98,9 @@ def test_detection(ssh_key_name, private_key, splunk_ip, splunk_password, test_f
     detection = load_file(os.path.join(os.path.dirname(__file__), '../security_content/detections', detection_file_name))
     result_detection = splunk_sdk.test_detection_search(splunk_ip, splunk_password, detection['search'], test['pass_condition'], detection['name'], test['file'], test['earliest_time'], test['latest_time'])
 
+    # for testing
+    splunk_sdk.run_modified_splunk_search(splunk_ip, splunk_password, detection['search'], detection['name'], test['file'], test['earliest_time'], test['latest_time'])
+
     result_detection['detection_name'] = test['name']
     result_detection['detection_file'] = test['file']
     result_test['detection_result'] = result_detection
diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
index f78fdc15d1..6ef34eec85 100644
--- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
+++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
@@ -51,3 +51,4 @@ tags:
   - Processes.dest
   security_domain: endpoint
 
+