From f81abbc79d4004af45da351f92ae402ca241bbc8 Mon Sep 17 00:00:00 2001
From: P4T12ICK <pbareib@splunk.com>
Date: Thu, 8 Oct 2020 13:01:52 +0200
Subject: [PATCH] updates

---
 automated_detection_testing/detection_service.py       |  9 +++++++++
 ...mpted_credential_dump_from_registry_via_reg_exe.yml |  4 +---
 tests/T1003_002.yml                                    | 10 +++++-----
 3 files changed, 15 insertions(+), 8 deletions(-)

diff --git a/automated_detection_testing/detection_service.py b/automated_detection_testing/detection_service.py
index 230e2c7111..c1cd2fd047 100644
--- a/automated_detection_testing/detection_service.py
+++ b/automated_detection_testing/detection_service.py
@@ -113,6 +113,9 @@ def main(args):
     # delete ssh key
     response = ec2.delete_key_pair(KeyName=ssh_key_name)
 
+    # read_test_file
+    test_file = load_file('security-content/tests/' + test_file_name + '.yml')
+
     # check if was succesful
     if not execution_error:
 
@@ -133,6 +136,12 @@ def main(args):
                 file_path = 'security-content/detections/' + test['detection'].replace(' ', '_').replace('-','_').replace('.','_').replace('/','_').lower() + '.yml'
                 detection_obj = load_file(file_path)
                 detection_obj['tags']['automated_detection_testing'] = 'passed'
+                if 'attack_data' in test_file:
+                    datasets = []
+                    for dataset in detection_test['attack_data']:
+                        datasets.append(dataset['data'])
+                    detection_obj['tags']['dataset'] = datasets
+
                 with open(file_path, 'w') as f:
                     yaml.dump(detection_obj, f)
 
diff --git a/detections/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
index 6ac893be67..100ae8d21c 100644
--- a/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
+++ b/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
@@ -14,8 +14,7 @@ author: Patrick Bareiss, Splunk
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
   as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=reg.exe
   OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security*
-  OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System*
-  OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*)
+  OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System*)
   by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempted_credential_dump_from_registry_via_reg_exe_filter` '
 known_false_positives: None identified.
@@ -34,4 +33,3 @@ tags:
   - DE.CM
   security_domain: endpoint
   asset_type: Endpoint
-
diff --git a/tests/T1003_002.yml b/tests/T1003_002.yml
index a05fd050d1..436e9fff65 100644
--- a/tests/T1003_002.yml
+++ b/tests/T1003_002.yml
@@ -2,11 +2,11 @@ name: Credential Dumping sam test
 detections:
   - name: Attempted Credential Dump From Registry via Reg exe
     pass_condition: '| stats count | where count > 0'
-    attack_data:
-      - file_name: windows-sysmon.log
-        data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.002/windows-sysmon.log
-        source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-        sourcetype: xmlwineventlog
 description: Test credential dumping detections
 target: default-attack-range-windows-domain-controller
 simulation_technique: 'T1003.002'
+attack_data:
+  - file_name: windows-sysmon.log
+    data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1003.002/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog