From ce279c60af1d616f41a4414398bc2376f219caa3 Mon Sep 17 00:00:00 2001
From: Joseph Zadeh <jzadeh@splunk.com>
Date: Wed, 22 Jul 2020 08:30:02 -0700
Subject: [PATCH 1/2] [TR-037] test for process execution via WMI (no mitre
 sub-technique for this attack type).

---
 tests/T1047.yml | 7 +++++++
 1 file changed, 7 insertions(+)
 create mode 100644 tests/T1047.yml

diff --git a/tests/T1047.yml b/tests/T1047.yml
new file mode 100644
index 0000000000..f039d41669
--- /dev/null
+++ b/tests/T1047.yml
@@ -0,0 +1,7 @@
+name: Process Execution via WMI
+detections:
+  - name: Process execution via wmi
+    pass_condition: '| stats count | where count = 1'
+description: Test the WMI local process execution attack behavior
+target: attack-range-windows-domain-controller
+simulation_technique: 'T1047'

From fc0a62a347e9f04ab7985f9b7d22abf7a740fd9a Mon Sep 17 00:00:00 2001
From: Patrick Bareiss <pbareib@splunk.com>
Date: Wed, 29 Jul 2020 10:06:06 +0200
Subject: [PATCH 2/2] updated CI pipeline

---
 .circleci/config.yml | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 1fd87e2dfe..64b96bce66 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -4,7 +4,7 @@
 #
 #############
 # Automatically generated by ci-generator.py in splunk/security-content
-# On Date: 2020-07-28T13:43:38 UTC
+# On Date: 2020-07-29T08:05:36 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -178,6 +178,24 @@ jobs:
             terraform init
             cd ..
             python attack_range.py --mode terraform --action test --test_file ../security-content/tests/T1574_009.yml
+      - run:
+          name: detection tests > T1047.yml
+          command: |
+            cd attack_range
+            source venv/bin/activate
+            # change attack_range default ssh keys
+            sed -i "s/key_name = .*$/key_name = attack-range-ci-job-security-content/g" attack_range.conf
+            sed -i "s/automated_testing = .*$/automated_testing = 1/g" attack_range.conf
+            sed -i "s/github_token =.*$/github_token = ${GITHUB_TOKEN}/g" attack_range.conf
+            sed -i "s/region = us-west-2/region = us-east-2/g" attack_range.conf
+            sed -i "s/private_key_path =.*$/private_key_path = ~\/.ssh\/id_rsa_3968782b01d635eb784228581d9cbe90/g" attack_range.conf
+            sed -i "s/windows_domain_controller = .*$/windows_domain_controller = 1/g" attack_range.conf
+            sed -i "s/capture_attack_data = .*$/capture_attack_data = 1/g" attack_range.conf
+            sed -i "s/art_branch = .*$/art_branch =  local-master/g" attack_range.conf
+            cd terraform/
+            terraform init
+            cd ..
+            python attack_range.py --mode terraform --action test --test_file ../security-content/tests/T1047.yml
       - run:
           name: detection tests > T1021_001.yml
           command: |