From b355f71dbd7129ffa97db9fb131e744148f31eb4 Mon Sep 17 00:00:00 2001
From: root <root@97f126d63064>
Date: Tue, 13 Oct 2020 14:54:12 +0000
Subject: [PATCH] Added detection testing service results inSystem Information
 Discovery Detection

---
 ...system_information_discovery_detection.yml | 28 +++++++++----------
 1 file changed, 13 insertions(+), 15 deletions(-)

diff --git a/detections/system_information_discovery_detection.yml b/detections/system_information_discovery_detection.yml
index 9126c171ad..3f8917bf14 100644
--- a/detections/system_information_discovery_detection.yml
+++ b/detections/system_information_discovery_detection.yml
@@ -1,24 +1,20 @@
-name: System Information Discovery Detection
-id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72
-version: 1
+author: Patrick Bareiss, Splunk
 date: '2020-10-12'
 description: Detect system information discovery techniques used by attackers to understand
   configurations of the system to further exploit it.
-type: ESCU
+id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72
+known_false_positives: Administrators debugging servers
+name: System Information Discovery Detection
 references:
 - https://oscp.infosecsanyam.in/priv-escalation/windows-priv-escalation
-author: Patrick Bareiss, Splunk
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
-  from datamodel=Endpoint.Processes
-  where (Processes.process="*wmic* qfe*" OR Processes.process=*systeminfo* OR Processes.process=*hostname*)
-  by Processes.user Processes.process_name Processes.process Processes.dest
-  | `drop_dm_object_name(Processes)`
-  | eventstats dc(process) as dc_processes_by_dest by dest
-  | where dc_processes_by_dest > 2
-  | stats values(process) min(firstTime) as firstTime max(lastTime) as lastTime by user, dest
-  | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where (Processes.process="*wmic* qfe*"
+  OR Processes.process=*systeminfo* OR Processes.process=*hostname*) by Processes.user
+  Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
+  | eventstats dc(process) as dc_processes_by_dest by dest | where dc_processes_by_dest
+  > 2 | stats values(process) min(firstTime) as firstTime max(lastTime) as lastTime
+  by user, dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `system_information_discovery_detection_filter`'
-known_false_positives: Administrators debugging servers
 tags:
   analytics_story:
   - Discovery Techniques
@@ -36,3 +32,5 @@ tags:
   nist:
   - DE.CM
   security_domain: endpoint
+type: ESCU
+version: 1