diff --git a/detections/endpoint/ssa___system_process_running_from_unexpected_location.yml b/detections/endpoint/ssa___system_process_running_from_unexpected_location.yml
index a9d21e40aa..a47954ee99 100644
--- a/detections/endpoint/ssa___system_process_running_from_unexpected_location.yml
+++ b/detections/endpoint/ssa___system_process_running_from_unexpected_location.yml
@@ -1,7 +1,7 @@
 name: System Process Running from Unexpected Location
 id: 28179107-099a-464a-94d3-08301e6c055f
-version: 3
-date: '2020-08-25'
+version: 4
+date: '2022-03-17'
 author: Ignacio Bermudez Corrales, Splunk
 type: Anomaly
 datamodel:
@@ -69,7 +69,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   OR process_name="rdpsauachelper.exe" OR process_name="reagentc.exe" OR process_name="recoverydrive.exe"
   OR process_name="register-cimprovider.exe" OR process_name="registeriepkeys.exe"
   OR process_name="relpost.exe" OR process_name="remoteposworker.exe" OR process_name="rmclient.exe"
-  OR process_name="robocopy.exe" OR process_name="rpcping.exe" OR process_name="runlegacycplelevated.exe"
+  OR process_name="rpcping.exe" OR process_name="runlegacycplelevated.exe"
   OR process_name="runtimebroker.exe" OR process_name="sihclient.exe" OR process_name="searchfilterhost.exe"
   OR process_name="searchindexer.exe" OR process_name="searchprotocolhost.exe" OR
   process_name="secedit.exe" OR process_name="sensordataservice.exe" OR process_name="setieinstalleddate.exe"
@@ -190,7 +190,7 @@ search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map
   OR process_name="sdclt.exe" OR process_name="sdiagnhost.exe" OR process_name="secinit.exe"
   OR process_name="services.exe" OR process_name="sessionmsg.exe" OR process_name="sethc.exe"
   OR process_name="setspn.exe" OR process_name="setupcl.exe" OR process_name="setupugc.exe"
-  OR process_name="setx.exe" OR process_name="sfc.exe" OR process_name="shadow.exe"
+  OR process_name="setx.exe" OR process_name="shadow.exe"
   OR process_name="shrpubw.exe" OR process_name="shutdown.exe" OR process_name="sigverif.exe"
   OR process_name="sihost.exe" OR process_name="slui.exe" OR process_name="smss.exe"
   OR process_name="snmptrap.exe" OR process_name="sort.exe" OR process_name="spinstall.exe"
diff --git a/detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml b/detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml
new file mode 100644
index 0000000000..a735b611d7
--- /dev/null
+++ b/detections/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml
@@ -0,0 +1,88 @@
+name: Windows DotNet Binary in Non Standard Path
+id: 21179107-099a-324a-94d3-08301e6c065f
+version: 1
+date: '2022-03-17'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies native .net binaries within the Windows
+  operating system that may be abused by adversaries by moving it to a new directory.
+  The analytic identifies the .net binary by using a list. If one or the other matches an alert will be generated. Adversaries abuse
+  these binaries as they are native to Windows and native DotNet. Note that not all
+  SDK (post install of Windows) are captured in the list. Lookup - https://github.com/splunk/security_content/blob/develop/lookups/is_net_windows_file.csv.
+search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
+  "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
+  "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
+  null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
+  null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
+  null)), event_id=ucast(map_get(input_event, "event_id"), "string", null);
+
+  $cond_1 = | from $ssa_input | where process_name="msbuild.exe" OR process_name="comsvcconfig.exe" OR process_name="dfsradmin.exe" OR process_name="dfsvc.exe" OR process_name="microsoft.workflow.compiler.exe" OR process_name="smsvchost.exe" OR process_name="wsatconfig.exe" OR process_name="addinprocess.exe" OR process_name="addinprocess32.exe" OR process_name="addinutil.exe" OR process_name="aspnet_compiler.exe" OR process_name="aspnet_regbrowsers.exe" OR process_name="aspnet_regsql.exe" OR process_name="caspol.exe" OR process_name="datasvcutil.exe" OR process_name="edmgen.exe" OR process_name="installutil.exe" OR process_name="jsc.exe" OR process_name="ngentask.exe" OR process_name="regasm.exe" OR process_name="regsvcs.exe" OR process_name="sdnbr.exe" OR process_name="acu.exe" OR process_name="appvstreamingux.exe" OR process_name="dsac.exe" OR process_name="lbfoadmin.exe" OR process_name="microsoft.uev.synccontroller.exe" OR process_name="mtedit.exe" OR process_name="scriptrunner.exe" OR process_name="servermanager.exe" OR process_name="stordiag.exe" OR process_name="tzsync.exe" OR process_name="uevagentpolicygenerator.exe" OR process_name="uevappmonitor.exe" OR process_name="uevtemplatebaselinegenerator.exe" OR process_name="uevtemplateconfigitemgenerator.exe" OR process_name="powershell_ise.exe" OR process_name="iediagcmd.exe" OR process_name="xbox.tcui.exe" OR process_name="microsoft.activedirectory.webservices.exe" OR process_name="iisual.exe" OR process_name="filehistory.exe" OR process_name="secureassessmentbrowser.exe";
+
+  | from $cond_1 | where match_regex(process_path, /(?i)\\windows\\system32/)=false
+  AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false AND 
+  match_regex(process_path, /(?i)\\windows\\adws/)=false AND match_regex(process_path, /(?i)\\windows\\networkcontroller/)=false
+  AND match_regex(process_path, /(?i)\\windows\\systemapps/)=false AND match_regex(process_path, /(?i)\\winsxs/)=false
+  AND match_regex(process_path, /(?i)\\microsoft.net/)=false | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id",
+  event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();'
+how_to_implement: Collect endpoint data such as sysmon or 4688 events.
+known_false_positives: False positives may be present and filtering may be required.
+  Certain utilities will run from non-standard paths based on the third-party application
+  in use.
+references:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
+  - https://attack.mitre.org/techniques/T1036/003/
+  - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
+tags:
+  analytic_story:
+  - Masquerading - Rename System Utilities
+  - Unusual Processes
+  - Ransomware
+  - Signed Binary Proxy Execution InstallUtil
+  - WhisperGate
+  cis20:
+  - CIS 8
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: A system process $process_name$ with commandline $cmd_line$ spawn in non-default
+    folder path on host $dest_device_id$
+  mitre_attack_id:
+  - T1036
+  - T1036.003
+  - T1218
+  - T1218.004
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - process_name
+  - _time
+  - dest_user_id
+  - process_path
+  - cmd_line
+  risk_score: 49
+  risk_severity: medium
+  security_domain: endpoint
+  asset_type: Endpoint
diff --git a/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml b/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
new file mode 100644
index 0000000000..3666dac81f
--- /dev/null
+++ b/detections/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
@@ -0,0 +1,91 @@
+name: Windows LOLBin Binary in Non Standard Path
+id: 25689101-012a-324a-94d3-08301e6c065a
+version: 1
+date: '2022-03-18'
+author: Michael Haag, Splunk
+type: Anomaly
+datamodel:
+- Endpoint_Processes
+description: The following analytic identifies native living off the land binaries within the Windows
+  operating system that may be abused by adversaries by moving it to a new directory.
+  The list of binaries was derived from the https://lolbas-project.github.io site, and excluded common process names (cmd.exe) and DotNet binaries. It also does not include the category of OtherMSBinaries.
+search: ' $ssa_input = | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
+  "dest_device_id"), "string", null), user=ucast(map_get(input_event, "dest_user_id"),
+  "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
+  null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
+  null)), process_path=lower(ucast(map_get(input_event, "process_path"), "string",
+  null)), event_id=ucast(map_get(input_event, "event_id"), "string", null);
+
+  $cond_1 = | from $ssa_input | where process_name="appinstaller.exe" OR process_name="aspnet_compiler.exe" OR process_name="at.exe" OR process_name="atbroker.exe" OR process_name="bash.exe" OR process_name="bitsadmin.exe" OR process_name="certoc.exe" OR process_name="certreq.exe" OR process_name="certutil.exe" OR process_name="cmd.exe" OR 
+  process_name="cmdkey.exe" OR process_name="cmdl32.exe" OR process_name="cmstp.exe" OR process_name="configsecuritypolicy.exe" OR process_name="control.exe" OR process_name="csc.exe" OR process_name="cscript.exe" OR process_name="datasvcutil.exe" OR process_name="desktopimgdownldr.exe" OR process_name="dfsvc.exe" OR process_name="diantz.exe" OR 
+  process_name="diskshadow.exe" OR process_name="dllhost.exe" OR process_name="dnscmd.exe" OR process_name="esentutl.exe" OR process_name="eventvwr.exe" OR process_name="expand.exe" OR process_name="explorer.exe" OR process_name="extexport.exe" OR process_name="extrac32.exe" OR process_name="findstr.exe" OR process_name="finger.exe" OR process_name="fltmc.exe" OR 
+  process_name="forfiles.exe" OR process_name="ftp.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="gpscript.exe" OR process_name="hh.exe" OR process_name="imewdbld.exe" OR process_name="ie4uinit.exe" OR process_name="ieexec.exe" OR process_name="ilasm.exe" OR process_name="infdefaultinstall.exe" OR process_name="makecab.exe" OR process_name="mavinject.exe" OR process_name="microsoft.workflow.compiler.exe" OR process_name="mmc.exe" OR process_name="mpcmdrun.exe" OR 
+  process_name="msconfig.exe" OR process_name="msdt.exe" OR process_name="mshta.exe" OR 
+  process_name="msiexec.exe" OR process_name="netsh.exe" OR process_name="odbcconf.exe" OR process_name="offlinescannershell.exe" OR process_name="onedrivestandaloneupdater.exe" OR process_name="pcalua.exe" OR process_name="pcwrun.exe" OR process_name="pktmon.exe" OR process_name="pnputil.exe" OR process_name="presentationhost.exe" OR process_name="print.exe" OR process_name="printbrm.exe" OR process_name="psr.exe" OR process_name="rasautou.exe" OR 
+  process_name="reg.exe" OR process_name="regedit.exe" OR process_name="regini.exe" OR process_name="register-cimprovider.exe" OR process_name="regsvr32.exe" OR process_name="replace.exe" OR process_name="rpcping.exe" OR process_name="rundll32.exe" OR process_name="runonce.exe" OR process_name="runscripthelper.exe" OR process_name="sc.exe" OR process_name="schtasks.exe" OR process_name="scriptrunner.exe" OR 
+  process_name="settingsynchost.exe" OR process_name="syncappvpublishingserver.exe" OR process_name="ttdinject.exe" OR process_name="tttracer.exe" OR process_name="vbc.exe" OR process_name="verclsid.exe" OR process_name="wab.exe" OR process_name="wlrmdr.exe" OR process_name="wmic.exe" OR process_name="workfolders.exe" OR process_name="wscript.exe" OR process_name="wsreset.exe" OR process_name="wuauclt.exe" OR process_name="xwizard.exe";
+
+  | from $cond_1 | where match_regex(process_path, /(?i)\\windows\\system32/)=false
+  AND match_regex(process_path, /(?i)\\windows\\syswow64/)=false AND 
+  match_regex(process_path, /(?i)\\windows\\adws/)=false AND match_regex(process_path, /(?i)\\windows\\networkcontroller/)=false
+  AND match_regex(process_path, /(?i)\\windows\\systemapps/)=false AND match_regex(process_path, /(?i)\\winsxs/)=false
+  AND match_regex(process_path, /(?i)\\microsoft.net/)=false | eval start_time=timestamp,
+  end_time=timestamp, entities=mvappend(device, user), body=create_map(["event_id",
+  event_id, "process_path", process_path, "process_name", process_name]) | into write_ssa_detected_events();'
+how_to_implement: Collect endpoint data such as sysmon or 4688 events.
+known_false_positives: False positives may be present and filtering may be required.
+  Certain utilities will run from non-standard paths based on the third-party application
+  in use.
+references:
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1036.003/T1036.003.yaml
+  - https://attack.mitre.org/techniques/T1036/003/
+  - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
+  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.004/T1218.004.md
+tags:
+  analytic_story:
+  - Unusual Processes
+  - Ransomware
+  - WhisperGate
+  cis20:
+  - CIS 8
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Defense Evasion
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
+  impact: 70
+  kill_chain_phases:
+  - Actions on Objectives
+  message: A system process $process_name$ with commandline $cmd_line$ spawn in non-default
+    folder path on host $dest_device_id$
+  mitre_attack_id:
+  - T1036
+  - T1036.003
+  - T1218
+  - T1218.004
+  nist:
+  - PR.PT
+  - DE.CM
+  observable:
+  - name: dest_device_id
+    type: Hostname
+    role:
+    - Victim
+  - name: dest_user_id
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - dest_device_id
+  - process_name
+  - _time
+  - dest_user_id
+  - process_path
+  - cmd_line
+  risk_score: 49
+  risk_severity: medium
+  security_domain: endpoint
+  asset_type: Endpoint
diff --git a/tests/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.test.yml b/tests/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.test.yml
new file mode 100644
index 0000000000..4fb6794471
--- /dev/null
+++ b/tests/endpoint/ssa___windows_dotnet_binary_in_non_standard_path.test.yml
@@ -0,0 +1,10 @@
+name: Windows DotNet Binary in Non Standard Path Unit Test
+tests:
+  - name: Windows DotNet Binary in Non Standard Path
+    file: endpoint/ssa___windows_dotnet_binary_in_non_standard_path.yml
+    pass_condition: '@count_eq(1)'
+    description: Test Windows DotNet Binary in Non Standard Path
+    attack_data:
+      - file_name: dotnet_lolbin-windows-security.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
+        source: WinEventLog:Security
diff --git a/tests/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.test.yml b/tests/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.test.yml
new file mode 100644
index 0000000000..defbbe7db3
--- /dev/null
+++ b/tests/endpoint/ssa___windows_lolbin_binary_in_non_standard_path.test.yml
@@ -0,0 +1,10 @@
+name: Windows LOLBin Binary in Non Standard Path Unit Test
+tests:
+  - name: Windows LOLBin Binary in Non Standard Path
+    file: endpoint/ssa___windows_lolbin_binary_in_non_standard_path.yml
+    pass_condition: '@count_eq(1)'
+    description: Test Windows LOLBin Binary in Non Standard Path
+    attack_data:
+      - file_name: dotnet_lolbin-windows-security.log
+        data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1036/system_process_running_unexpected_location/dotnet_lolbin-windows-security.log
+        source: WinEventLog:Security