🧪 test: add regression data for rule 07aa184a-870d-413d-893a-157f317f6f58

Author: frack113

regression_data/rules/windows/process_creation/proc_creation_win_susp_gather_network_info_execution/07aa184a-870d-413d-893a-157f317f6f58.evtx

@@ -0,0 +1,66 @@
+{
+  "Event": {
+    "#attributes": {
+      "xmlns": "http://schemas.microsoft.com/win/2004/08/events/event"
+    },
+    "System": {
+      "Provider": {
+        "#attributes": {
+          "Name": "Microsoft-Windows-Sysmon",
+          "Guid": "5770385F-C22A-43E0-BF4C-06F5698FFBD9"
+        }
+      },
+      "EventID": 1,
+      "Version": 5,
+      "Level": 4,
+      "Task": 1,
+      "Opcode": 0,
+      "Keywords": "0x8000000000000000",
+      "TimeCreated": {
+        "#attributes": {
+          "SystemTime": "2026-08-12T18:18:19.1149079Z"
+        }
+      },
+      "EventRecordID": 488235,
+      "Correlation": null,
+      "Execution": {
+        "#attributes": {
+          "ProcessID": 3288,
+          "ThreadID": 3372
+        }
+      },
+      "Channel": "Microsoft-Windows-Sysmon/Operational",
+      "Computer": "SigmaCatchVm",
+      "Security": {
+        "#attributes": {
+          "UserID": "S-1-5-18"
+        }
+      }
+    },
+    "EventData": {
+      "RuleName": "technique_id=T1059.003,technique_name=Windows Command Shell",
+      "UtcTime": "2026-08-12 18:18:19.112",
+      "ProcessGuid": "570E49AA-B8EB-6A7C-B309-000000001400",
+      "ProcessId": 12236,
+      "Image": "C:\\Windows\\System32\\cmd.exe",
+      "FileVersion": "10.0.26100.8737 (WinBuild.160101.0800)",
+      "Description": "Windows Command Processor",
+      "Product": "Microsoft® Windows® Operating System",
+      "Company": "Microsoft Corporation",
+      "OriginalFileName": "Cmd.Exe",
+      "CommandLine": "\"cmd.exe\" /c wscript.exe C:\\Windows\\System32\\gatherNetworkInfo.vbs",
+      "CurrentDirectory": "C:\\Users\\frack113\\AppData\\Local\\Temp\\",
+      "User": "SigmaCatchVm\\frack113",
+      "LogonGuid": "570E49AA-C366-6A76-1EDD-080000000000",
+      "LogonId": "0x8dd1e",
+      "TerminalSessionId": 1,
+      "IntegrityLevel": "High",
+      "Hashes": "SHA1=6142A8457F497ABC4B102D75F549F76A9E3577C7,MD5=1F4D18374A699452622E80F6D5BB743E,SHA256=65EC268ADD3973B6DCA64222985DA47CAEAEE44A340B0EC1466782914FD743D9,IMPHASH=010B165E4C37F484601D3DBD700C9423",
+      "ParentProcessGuid": "570E49AA-A962-6A7C-F601-000000001400",
+      "ParentProcessId": 8368,
+      "ParentImage": "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe",
+      "ParentCommandLine": "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\"",
+      "ParentUser": "SigmaCatchVm\\frack113"
+    }
+  }
+}

regression_data/rules/windows/process_creation/proc_creation_win_susp_gather_network_info_execution/07aa184a-870d-413d-893a-157f317f6f58.json

@@ -0,0 +1,13 @@
+id: 9a9d4da5-dd28-4dad-b8cc-ab8380d0ba82
+description: N/A
+date: 2026-08-12
+author: frack113
+rule_metadata:
+- id: 07aa184a-870d-413d-893a-157f317f6f58
+  title: Suspicious Reconnaissance Activity Via GatherNetworkInfo.VBS
+regression_tests_info:
+- name: Positive Detection Test
+  type: evtx
+  provider: Microsoft-Windows-Sysmon
+  match_count: 1
+  path: regression_data/rules/windows/process_creation/proc_creation_win_susp_gather_network_info_execution/07aa184a-870d-413d-893a-157f317f6f58.evtx

regression_data/rules/windows/process_creation/proc_creation_win_susp_gather_network_info_execution/info.yml

@@ -31,3 +31,4 @@ detection:
 falsepositives:
     - Unknown
 level: high
+regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_susp_gather_network_info_execution/info.yml