output of generate

src/default/analytic_stories.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security-content
-# On Date: 2019-05-10T21:05:35 UTC
+# On Date: 2019-05-15T20:03:38 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -232,7 +232,7 @@ investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU -
 support_searches = []
 data_models = ["Authentication", "Endpoint", "Network_Traffic", "Risk"]
 providing_technologies = ["Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"]
-description = Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data.
+description = Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data. 
 narrative = A common adversary goal is to identify and exfiltrate data of value from a target organization. This data may include email conversations and addresses, confidential company information, links to network design/infrastructure, important dates, and so on.\
 \
  Attacks are composed of three activities: identification, collection, and staging data for exfiltration. Identification typically involves scanning systems and observing user activity. Collection can involve the transfer of large amounts of data from various repositories. Staging/preparation includes moving data to a central location and compressing (and optionally encoding and/or encrypting) it. All of these activities provide opportunities for defenders to identify their presence. \
@@ -249,7 +249,7 @@ reference = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searc
 detection_searches = ["ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule"]
 mappings = {"mitre_attack": ["Command and Control", "Commonly Used Port", "Exfiltration"], "cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "nist": ["DE.AE"]}
 investigative_searches = ["ESCU - AWS Network Interface details via resourceId", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Web Activity From Host"]
-support_searches = ["ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Count of Unique IPs Connecting to Ports", "ESCU - Model Builder For DNS Query Length Outliers - MLTK", "ESCU - Model Builder For SMB Traffic Spike - MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
+support_searches = ["ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Count of Unique IPs Connecting to Ports", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
 data_models = ["Authentication", "Endpoint", "Network_Resolution", "Network_Traffic", "Risk", "Updates", "Vulnerabilities", "Web"]
 providing_technologies = ["AWS", "Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Nessus", "Netbackup", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"]
 description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators.
@@ -270,7 +270,7 @@ investigative_searches = ["ESCU - Get Certificate logs for a domain"]
 support_searches = []
 data_models = ["Certificates", "Network_Resolution", "Web"]
 providing_technologies = ["Bro", "Censys", "Splunk Stream"]
-description = Detect DNS and web requests to fake websites generated by the EvilGinx2 toolkit. These websites are designed to fool unwitting users who have clicked on a malicious link in a phishing email.
+description = Detect DNS and web requests to fake websites generated by the EvilGinx2 toolkit. These websites are designed to fool unwitting users who have clicked on a malicious link in a phishing email. 
 narrative = As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Because phishing is a technique that relies on human psychology, you will never be able to eliminate this vulnerability 100%. But you can use automated detection to significantly reduce the risks.\
 \
 This Analytic Story focuses on detecting signs of MiTM attacks enabled by [EvilGinx2](https://github.com/kgretzky/evilginx2), a toolkit that sets up a transparent proxy between the targeted site and the user. In this way, the attacker is able to intercept credentials and two-factor identification tokens. It employs a proxy template to allow a registered domain to impersonate targeted sites, such as Linkedin, Amazon, Okta, Github, Twitter, Instagram, Reddit, Office 365, and others. It can even register SSL certificates and camouflage them via a URL shortener, making them difficult to detect. Searches in this story look for signs of MiTM attacks enabled by EvilGinx2.
@@ -305,7 +305,7 @@ reference = ["https://www.us-cert.gov/ncas/alerts/TA18-074A"]
 detection_searches = ["ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Suspicious Reg.exe Process - Rule", "ESCU - Sc.exe Manipulating Windows Services - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Create local admin accounts using net.exe - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Scheduled Task Name Used by Dragonfly Threat Actors - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - First time seen command line argument - Rule"]
 mappings = {"mitre_attack": ["Defense Evasion", "Modify Registry", "Disabling Security Tools"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.CM"]}
 investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host"]
-support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Model Builder For DNS Query Length Outliers - MLTK", "ESCU - Model Builder For SMB Traffic Spike - MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Previously Seen Running Windows Services", "ESCU - Previously seen command line arguments", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
+support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Previously Seen Running Windows Services", "ESCU - Previously seen command line arguments", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
 data_models = ["Authentication", "Email", "Endpoint", "Network_Resolution", "Network_Traffic", "Risk", "Updates", "Vulnerabilities", "Web"]
 providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Exchange", "Microsoft Windows", "Nessus", "Netbackup", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"]
 description = Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more.
@@ -377,7 +377,7 @@ reference = ["https://www.cisecurity.org/controls/data-protection/", "https://ww
 detection_searches = ["ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule"]
 mappings = {"mitre_attack": ["Command and Control", "Exfiltration", "Commonly Used Port"], "cis20": ["CIS 13"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "nist": ["PR.PT", "PR.DS"]}
 investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"]
-support_searches = ["ESCU - Model Builder For DNS Query Length Outliers - MLTK"]
+support_searches = ["ESCU - Baseline of DNS Query Length - MLTK"]
 data_models = ["Authentication", "Change_Analysis", "Endpoint", "Network_Resolution", "Network_Traffic", "Risk"]
 providing_technologies = ["Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"]
 description = Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration.
@@ -425,7 +425,7 @@ reference = ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first
 detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Detect Use of cmd.exe to Launch Script Interpreters - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Detection of tools built by NirSoft - Rule"]
 mappings = {"mitre_attack": ["Execution", "Defense Evasion"], "cis20": ["CIS 3", "CIS 7", "CIS 12"], "kill_chain_phases": ["Delivery"], "nist": ["DE.AE", "PR.IP"]}
 investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Email Info", "ESCU - Get Emails From Specific Sender", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host"]
-support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Model Builder For SMB Traffic Spike - MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Previously seen command line arguments", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
+support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Previously seen command line arguments", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
 data_models = ["Authentication", "Email", "Endpoint", "Network_Traffic", "Risk", "Updates", "Vulnerabilities", "Web"]
 providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Exchange", "Microsoft Windows", "Nessus", "Netbackup", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"]
 description = Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment.
@@ -433,7 +433,7 @@ narrative = The trojan downloader known as Emotet first surfaced in 2014, when i
 \
 According to the TA, the the malware continues to be among the most costly and destructive malware affecting the private and public sectors. Researchers have linked it to the threat group Mealybug, which has also been on the security communitys radar since 2014.\
 \
-The searches in this Analytic Story will help you find executables that are rarely used in your environment, specific registry paths that malware often uses to ensure survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that Emotet or other malware has compromised your environment.
+The searches in this Analytic Story will help you find executables that are rarely used in your environment, specific registry paths that malware often uses to ensure survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that Emotet or other malware has compromised your environment. 
 
 [Hidden Cobra Malware]
 category = Malware
@@ -445,7 +445,7 @@ reference = ["https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-
 detection_searches = ["ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Create or delete hidden shares using net.exe - Rule", "ESCU - Suspicious File Write - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule"]
 mappings = {"mitre_attack": [], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]}
 investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host"]
-support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Identify Systems Creating Remote Desktop Traffic", "ESCU - Identify Systems Receiving Remote Desktop Traffic", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Model Builder For DNS Query Length Outliers - MLTK", "ESCU - Model Builder For SMB Traffic Spike - MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Previously seen command line arguments", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
+support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Identify Systems Creating Remote Desktop Traffic", "ESCU - Identify Systems Receiving Remote Desktop Traffic", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Previously seen command line arguments", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
 data_models = ["Authentication", "Email", "Endpoint", "Network_Resolution", "Network_Traffic", "Risk", "Updates", "Vulnerabilities", "Web"]
 providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Exchange", "Microsoft Windows", "Nessus", "Netbackup", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"]
 description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A.
@@ -551,7 +551,7 @@ reference = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to
 detection_searches = ["ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted - Rule"]
 mappings = {"mitre_attack": ["Execution", "PowerShell", "Scripting"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "nist": ["PR.PT", "DE.CM", "PR.IP"]}
 investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"]
-support_searches = ["ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Previously seen command line arguments"]
+support_searches = ["ESCU - Previously seen command line arguments"]
 data_models = ["Authentication", "Endpoint", "Risk"]
 providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Sysmon", "Tanium", "Ziften", "macOS"]
 description = Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent.
@@ -604,10 +604,10 @@ investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU -
 support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
 data_models = ["Authentication", "Endpoint", "Risk", "Updates", "Vulnerabilities", "Web"]
 providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Nessus", "Netbackup", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"]
-description = Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment.
+description = Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment. 
 narrative = It is critical to identify unauthorized software and processes running on enterprise endpoints and determine whether they are likely to be malicious. This Analytic Story requires the user to populate the Interesting Processes table within Enterprise Security with prohibited processes. An included support search will augment this data, adding information on processes thought to be malicious. This search requires data from endpoint detection-and-response solutions, endpoint data sources (such as Sysmon), or Windows Event Logs--assuming that the Active Directory administrator has enabled process tracking within the System Event Audit Logs.\
 \
-It is important to investigate any software identified as suspicious, in order to understand how it was installed or executed. Analyzing authentication logs or any historic notable events might elicit additional investigative leads of interest. For best results, schedule the search to run every two weeks.
+It is important to investigate any software identified as suspicious, in order to understand how it was installed or executed. Analyzing authentication logs or any historic notable events might elicit additional investigative leads of interest. For best results, schedule the search to run every two weeks. 
 
 [Monitor for Updates]
 category = Best Practices
@@ -657,7 +657,7 @@ reference = ["https://www.symantec.com/blogs/threat-intelligence/orangeworm-targ
 detection_searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Sc.exe Manipulating Windows Services - Rule", "ESCU - First Time Seen Running Windows Service - Rule"]
 mappings = {"mitre_attack": ["Persistence", "Privilege Escalation", "New Service", "Modify Existing Service", "Defense Evasion", "Disabling Security Tools"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"]}
 investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host"]
-support_searches = ["ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Previously Seen Running Windows Services", "ESCU - Previously seen command line arguments"]
+support_searches = ["ESCU - Previously Seen Running Windows Services", "ESCU - Previously seen command line arguments"]
 data_models = ["Authentication", "Endpoint", "Risk", "Web"]
 providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"]
 description = Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry.
@@ -711,7 +711,7 @@ reference = ["https://intelgraph.idefense.com/#/node/threat_group/view/29fbec10-
 detection_searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule"]
 mappings = {"mitre_attack": ["Execution"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]}
 investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host"]
-support_searches = ["ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Previously seen command line arguments"]
+support_searches = ["ESCU - Previously seen command line arguments"]
 data_models = ["Authentication", "Endpoint", "Risk", "Web"]
 providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"]
 description = Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group.
@@ -781,7 +781,7 @@ reference = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced
 detection_searches = ["ESCU - TOR Traffic - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule"]
 mappings = {"mitre_attack": ["Command and Control", "Commonly Used Port", "Exfiltration"], "cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "nist": ["DE.AE"]}
 investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable History", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Web Activity From Host"]
-support_searches = ["ESCU - Count of Unique IPs Connecting to Ports", "ESCU - Model Builder For SMB Traffic Spike - MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
+support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Count of Unique IPs Connecting to Ports", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
 data_models = ["Authentication", "Endpoint", "Network_Resolution", "Network_Traffic", "Risk", "Updates", "Vulnerabilities", "Web"]
 providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Nessus", "Netbackup", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"]
 description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers.
@@ -797,7 +797,7 @@ reference = ["https://www.symantec.com/connect/blogs/what-you-need-know-about-wa
 detection_searches = ["ESCU - Windows Event Log Cleared - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule"]
 mappings = {"mitre_attack": ["Defense Evasion", "Indicator Removal on Host"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"]}
 investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host"]
-support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Model Builder For SMB Traffic Spike - MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
+support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
 data_models = ["Authentication", "Endpoint", "Network_Traffic", "Risk", "Updates", "Vulnerabilities", "Web"]
 providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Nessus", "Netbackup", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"]
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others.
@@ -966,7 +966,7 @@ investigative_searches = ["ESCU - AWS Investigate User Activities By ARN", "ESCU
 support_searches = ["ESCU - Previously seen users in CloudTrail"]
 data_models = []
 providing_technologies = ["AWS", "Splunk Enterprise Security"]
-description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins.
+description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. 
 narrative = It is important to monitor and control who has access to your AWS infrastructure. Detecting suspicious logins to your AWS infrastructure will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any EC2 instances created by the attacker.
 
 [Suspicious AWS S3 Activities]
@@ -987,7 +987,7 @@ narrative = As cloud computing has exploded, so has the number of creative attac
 \
 Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\
 \
-Among things to look out for are S3 access from unfamiliar locations and by unfamiliar users. Some of the searches in this Analytic Story help you detect suspicious behavior and others help you investigate more deeply, when the situation warrants.
+Among things to look out for are S3 access from unfamiliar locations and by unfamiliar users. Some of the searches in this Analytic Story help you detect suspicious behavior and others help you investigate more deeply, when the situation warrants.   
 
 [Suspicious AWS Traffic]
 category = Cloud Security
@@ -1021,7 +1021,7 @@ reference = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.micro
 detection_searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Detect Prohibited Applications Spawning cmd.exe - Rule", "ESCU - Detect Use of cmd.exe to Launch Script Interpreters - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule"]
 mappings = {"mitre_attack": ["Execution"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]}
 investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Registry Activities", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host"]
-support_searches = ["ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Previously seen command line arguments"]
+support_searches = ["ESCU - Previously seen command line arguments"]
 data_models = ["Authentication", "Endpoint", "Risk", "Web"]
 providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"]
 description = Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems.
@@ -1037,7 +1037,7 @@ reference = ["http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns
 detection_searches = ["ESCU - Excessive DNS Failures - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule"]
 mappings = {"mitre_attack": ["Exfiltration", "Exfiltration Over Alternative Protocol", "Command and Control", "Commonly Used Port"], "cis20": ["CIS 8", "CIS 9", "CIS 12"], "kill_chain_phases": ["Command and Control"], "nist": ["PR.PT", "DE.AE", "DE.CM"]}
 investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"]
-support_searches = ["ESCU - Model Builder For DNS Query Length Outliers - MLTK"]
+support_searches = ["ESCU - Baseline of DNS Query Length - MLTK"]
 data_models = ["Authentication", "Endpoint", "Network_Resolution", "Network_Traffic", "Risk"]
 providing_technologies = ["Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"]
 description = Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses.
@@ -1155,7 +1155,7 @@ reference = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-wi
 detection_searches = ["ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule"]
 mappings = {"mitre_attack": ["Execution"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]}
 investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host"]
-support_searches = ["ESCU - Model Builder For Unusually Long Command Line - MLTK"]
+support_searches = []
 data_models = ["Authentication", "Endpoint", "Risk", "Web"]
 providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"]
 description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation.
@@ -1220,7 +1220,7 @@ investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU -
 support_searches = []
 data_models = ["Authentication", "Endpoint", "Risk"]
 providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Sysmon", "Tanium", "Ziften", "macOS"]
-description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others
+description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others 
 narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms.
 
 [Windows File Extension and Association Abuse]

src/default/savedsearches.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security-content
-# On Date: 2019-05-10T21:05:35 UTC
+# On Date: 2019-05-15T20:03:38 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -11,7 +11,7 @@
 [ESCU - AWS Cloud Provisioning From Previously Unseen City - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This search looks for AWS provisioning activities from previously unseen cities.  Provisioning activities are defined broadly as any event that begins with "Run" or "Create."
+description = This search looks for AWS provisioning activities from previously unseen cities.  Provisioning activities are defined broadly as any event that begins with "Run" or "Create." 
 action.escu.mappings = {"cis20": ["CIS 1"], "nist": ["ID.AM"]}
 action.escu.eli5 = The subsearch returns all events with event names that start with "Run" or "Create," and then does a `GeoIP` lookup on the IP address that initiated the action within the last hour. It appends the historical data to those results in the lookup file. Next, it recalculates the `firstTime` and `lastTime` field for each country, region, city, and IP address and outputs this data to the lookup file to update the local cache. It then calculates the `firstTime` and `lastTime` for each city. It returns only those events from cities that have first been seen in the past hour. This is combined with the main search to return the time, user, IP address, city, event name, and error code from the action.
 action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources.
@@ -65,7 +65,7 @@ search = sourcetype=aws:cloudtrail (eventName=Run* OR eventName=Create*) | iploc
 [ESCU - AWS Cloud Provisioning From Previously Unseen Country - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This search looks for AWS provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that begins with "Run" or "Create."
+description = This search looks for AWS provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." 
 action.escu.mappings = {"cis20": ["CIS 1"], "nist": ["ID.AM"]}
 action.escu.eli5 = The subsearch returns all events with event names that start with "Run" or "Create," and then does a `GeoIP` lookup on the IP address that initiated the action within the last hour. It appends the historical data to those results in the lookup file. Next, it recalculates the `firstTime` and `lastTime` field for each country, region, city, and IP address and outputs this data to the lookup file to update the local cache. It then calculates the `firstTime` and `lastTime` for each country. It returns only those events from countries that have first been seen in the past hour. This is combined with the main search to return the time, user, IP address, city, event name, and error code from the action.
 action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources.
@@ -119,7 +119,7 @@ search = sourcetype=aws:cloudtrail (eventName=Run* OR eventName=Create*) | iploc
 [ESCU - AWS Cloud Provisioning From Previously Unseen IP Address - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = This search looks for AWS provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that begins with "Run" or "Create."
+description = This search looks for AWS provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." 
 action.escu.mappings = {"cis20": ["CIS 1"], "nist": ["ID.AM"]}
 action.escu.eli5 = The subsearch returns all events with event names that start with "Run" or "Create," and then does a `GeoIP` lookup on the IP address that initiated the action within the last hour. It appends the historical data to those results in the lookup file. Next, it recalculates the `firstTime` and `lastTime` field for each country, region, city, and IP address and outputs this data to the lookup file to update the local cache. It then calculates the `firstTime` and `lastTime` for each city. It returns only those events from IP addresses that have first been seen in the past hour. This is combined with the main search to return the time, user, IP address, city, event name, and error code from the action.
 action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. This search works best when you run the "Previously Seen AWS Provisioning Activity Sources" support search once to create a history of previously seen locations that have provisioned AWS resources.
@@ -1091,8 +1091,8 @@ action.escu.enabled = 1
 description = This search allows you to identify DNS requests that are unusually large for the record type being requested in your environment.
 action.escu.mappings = {"mitre_attack": ["Command and Control", "Exfiltration", "Commonly Used Port"], "kill_chain_phases": ["Command and Control"], "cis20": ["CIS 8", "CIS 12"], "nist": ["PR.PT", "DE.AE", "DE.CM"]}
 action.escu.data_models = ["Network_Resolution"]
-action.escu.eli5 = Attackers often use random, long domain names for components of their attack infrastructure. This search leverages the probability distribution function algorithm provided by the Machine Learning Toolkit (MLTK) to identify outliers in the length of the DNS query for each record type observed. The companion search "Model Builder For "DNS Query Length Outliers - MLTK"" creates a machine-learning (ML) model built over the historical data used by this search.
-action.escu.how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, the Machine Learning Toolkit (MLTK) version 4.2 or greater must be installed on your search heads, along with any required dependencies. Finally, the support search "Model Builder For "DNS Query Length Outliers - MLTK"" must be executed before this detection search, as it builds a machine-learning (ML) model over the historical data used by this search.
+action.escu.eli5 = Attackers often use random, long domain names for components of their attack infrastructure. This search leverages the probability distribution function algorithm provided by the Machine Learning Toolkit (MLTK) to identify outliers in the length of the DNS query for each record type observed. The companion search "Baseline of DNS Query Length - MLTK" creates a machine-learning (ML) model built over the historical data used by this search.
+action.escu.how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, the Machine Learning Toolkit (MLTK) version 4.2 or greater must be installed on your search heads, along with any required dependencies. Finally, the support search "Baseline of DNS Query Length - MLTK" must be executed before this detection search, as it builds a machine-learning (ML) model over the historical data used by this search.
 action.escu.known_false_positives = If you are seeing more results than desired, you may consider reducing the value for threshold in the search. You should also periodically re-run the support search to re-build the ML model on the latest data.
 action.escu.creation_date = 2019-05-08
 action.escu.modification_date = 2019-05-08
@@ -2176,7 +2176,7 @@ action.escu.modification_date = 2018-11-15
 action.escu.confidence = medium
 action.escu.full_search_name = ESCU - Detect Path Interception By Creation Of program.exe - Rule
 action.escu.search_type = detection
-action.escu.asset_at_risk =
+action.escu.asset_at_risk = 
 action.escu.fields_required = []
 action.escu.providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Tanium", "Ziften"]
 action.escu.analytic_story = ["Windows Persistence Techniques"]
@@ -2187,7 +2187,7 @@ action.correlationsearch.enabled = 1
 action.correlationsearch.label = Detect Path Interception By Creation Of program.exe
 action.notable = 1
 action.notable.param.nes_fields = dest, file_path, file_name
-action.notable.param.rule_description = A potentially malicious file program.exe was detected on the C: drive. The creation of this file is often associated with a motive to perform a path interception attack.
+action.notable.param.rule_description = A potentially malicious file program.exe was detected on the C: drive. The creation of this file is often associated with a motive to perform a path interception attack. 
 action.notable.param.rule_title = Path Interception attempt discovered $dest$ via creation of program.exe
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = medium
@@ -2379,7 +2379,7 @@ action.escu = 0
 action.escu.enabled = 1
 description = This search looks at S3 bucket-access logs and detects new or previously unseen remote IP addresses that have successfully accessed an S3 bucket.
 action.escu.mappings = {"mitre_attack": ["Execution", "Exfiltration"], "kill_chain_phases": ["Actions on Objectives"], "cis20": ["CIS 13", "CIS 14"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
-action.escu.eli5 = Here the subsearch executes first and returns all successful S3 bucket-access attempts (HTTP code "200") within the last hour. It groups the results by the earliest and latest times it has seen a remote IP accessing a particular bucket. It appends this information to the historical data from the lookup file and then recalculates the `firstTime` and `lastTime` field for each remote IP accessing an S3 bucket. Next, it returns only those remote IP addresses that have first been seen accessing a specific bucket within the past hour. This is combined with the main search to return the time, bucket name, source IP, city, and country operations performed, as well as the requested URI of the resource
+action.escu.eli5 = Here the subsearch executes first and returns all successful S3 bucket-access attempts (HTTP code "200") within the last hour. It groups the results by the earliest and latest times it has seen a remote IP accessing a particular bucket. It appends this information to the historical data from the lookup file and then recalculates the `firstTime` and `lastTime` field for each remote IP accessing an S3 bucket. Next, it returns only those remote IP addresses that have first been seen accessing a specific bucket within the past hour. This is combined with the main search to return the time, bucket name, source IP, city, and country operations performed, as well as the requested URI of the resource 
 action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your S3 access logs' inputs. This search works best when you run the "Previously Seen S3 Bucket Access by Remote IP" support search once to create a history of previously seen remote IPs and bucket names.
 action.escu.known_false_positives = S3 buckets can be accessed from any IP, as long as it can make a successful connection. This will be a false postive, since the search is looking for a new IP within the past hour
 action.escu.creation_date = 2018-06-25
@@ -2455,7 +2455,7 @@ action.escu.eli5 = This search and its corresponding subsearch run through a ser
 \
 1. Filters out anything that it determines is not a spike and returns the list of ARNs to the main search. The main search subsequently gets the names of all the API calls, the number of unique API calls, and the total number of API calls for each of these ARNs. Finally, it looks up the average and standard deviation and returns both the average and the number of standard deviations the spike is from the average.
 action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 action.escu.creation_date = 2018-03-12
 action.escu.modification_date = 2018-04-09
 action.escu.confidence = medium
@@ -2843,7 +2843,7 @@ quantity = 0
 realtime_schedule = 0
 schedule_window = auto
 is_visible = false
-search = | tstats `summariesonly` count earliest(_time) AS earliest latest(_time) AS latest from datamodel=Change_Analysis where (nodename = All_Changes) All_Changes.result="Removable Storage device" (All_Changes.result_id=4663 OR All_Changes.result_id=4656) (All_Changes.src_priority=high) by All_Changes.dest | `drop_dm_object_name("All_Changes")`| `ctime(earliest)`| `ctime(latest)`
+search = | tstats `summariesonly` count earliest(_time) AS earliest latest(_time) AS latest from datamodel=Change_Analysis where (nodename = All_Changes) All_Changes.result="Removable Storage device" (All_Changes.result_id=4663 OR All_Changes.result_id=4656) (All_Changes.src_priority=high) by All_Changes.dest | `drop_dm_object_name("All_Changes")`| `ctime(earliest)`| `ctime(latest)` 
 
 [ESCU - Detect Unauthorized Assets by MAC address - Rule]
 action.escu = 0
@@ -2924,7 +2924,7 @@ action.correlationsearch.label = Detect Use of cmd.exe to Launch Script Interpre
 action.notable = 1
 action.notable.param.nes_fields = dest, process_name, parent_process
 action.notable.param.rule_description = Potentially malicious script execution detected.
-action.notable.param.rule_title = Command prompt is executing scripts on $dest$ using $process_name$
+action.notable.param.rule_title = Command prompt is executing scripts on $dest$ using $process_name$ 
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = medium
 action.notable.param.recommended_actions = escu_investigate
@@ -2975,7 +2975,7 @@ dispatch.latest_time = -10m@m
 action.correlationsearch.enabled = 1
 action.correlationsearch.label = Detect attackers scanning for vulnerable JBoss servers
 action.notable = 1
-action.notable.param.nes_fields =
+action.notable.param.nes_fields = 
 action.notable.param.rule_description = This search looks for specific GET/HEAD requests to web servers that are indicative of reconnaissance attempts to identify vulnerable JBoss servers.
 action.notable.param.rule_title = Detect attackers scanning for vulnerable JBoss servers
 action.notable.param.security_domain = network
@@ -3007,7 +3007,7 @@ search = | tstats `summariesonly` count min(_time) as firstTime max(_time) as la
 [ESCU - Detect hosts connecting to dynamic domain providers - Rule]
 action.escu = 0
 action.escu.enabled = 1
-description = Malicious actors often abuse legitimate Dynamic DNS services to host malicious payloads or interactive command and control nodes. Attackers will automate domain resolution changes by routing dynamic domains to countless IP addresses to circumvent firewall blocks, blacklists as well as frustrate a network defenders analytic and investigative processes. This search will look for DNS queries made from within your infrastructure to suspicious dynamic domains.
+description = Malicious actors often abuse legitimate Dynamic DNS services to host malicious payloads or interactive command and control nodes. Attackers will automate domain resolution changes by routing dynamic domains to countless IP addresses to circumvent firewall blocks, blacklists as well as frustrate a network defenders analytic and investigative processes. This search will look for DNS queries made from within your infrastructure to suspicious dynamic domains. 
 action.escu.mappings = {"mitre_attack": ["Exfiltration", "Exfiltration Over Command and Control Channel", "Defense Evasion", "Commonly Used Port"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "cis20": ["CIS 8", "CIS 12", "CIS 13"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]}
 action.escu.data_models = ["Network_Resolution"]
 action.escu.eli5 = The search is querying an accelerated `Network_Resolution` data model to count and list the values of resolved domains for each DNS query and checks that against the list of Dynamic DNS providers (lookup - `dynamic_dns_providers`) by each host (DNS.src)
@@ -3265,7 +3265,7 @@ quantity = 0
 realtime_schedule = 0
 schedule_window = auto
 is_visible = false
-search = sourcetype=aws:cloudtrail eventName=ConsoleLogin | rename userIdentity.arn as arn  |stats earliest(_time) as earliest latest(_time) as latest by arn | inputlookup append=t previously_seen_users_console_logins.csv  | stats min(earliest) as earliest max(latest) as latest by arn | outputlookup previously_seen_users_console_logins.csv | eval userStatus=if(earliest >= relative_time(now(), "-70m@m"), "First Time Logging into AWS Console","Previously Seen User") | convert ctime(earliest) ctime(latest) | where userStatus ="First Time Logging into AWS Console"
+search = sourcetype=aws:cloudtrail eventName=ConsoleLogin | rename userIdentity.arn as arn  |stats earliest(_time) as earliest latest(_time) as latest by arn | inputlookup append=t previously_seen_users_console_logins.csv  | stats min(earliest) as earliest max(latest) as latest by arn | outputlookup previously_seen_users_console_logins.csv | eval userStatus=if(earliest >= relative_time(now(), "-70m@m"), "First Time Logging into AWS Console","Previously Seen User") | convert ctime(earliest) ctime(latest) | where userStatus ="First Time Logging into AWS Console" 
 
 [ESCU - Detect processes used for System Network Configuration Discovery - Rule]
 action.escu = 0
@@ -3870,7 +3870,7 @@ action.correlationsearch.enabled = 1
 action.correlationsearch.label = Email files written outside of the Outlook directory
 action.notable = 1
 action.notable.param.nes_fields = dest, file_path, action, file_name
-action.notable.param.rule_description = The system $dest$ has email files outside of the normal Outlook directory
+action.notable.param.rule_description = The system $dest$ has email files outside of the normal Outlook directory 
 action.notable.param.rule_title = Email files created or modified on $dest$ that are not in the normal Outlook directory
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = medium
@@ -4328,13 +4328,13 @@ action.escu.mappings = {"mitre_attack": ["Defense Evasion", "Persistence"], "kil
 action.escu.data_models = ["Endpoint"]
 action.escu.eli5 = This search is looking to detect command-line execution with of attrib.exe binary with the +h flag set.  The +h flag is used to hide a file.
 action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
-action.escu.known_false_positives = Some applications and users may legitimately use attrib.exe to interact with the files.
+action.escu.known_false_positives = Some applications and users may legitimately use attrib.exe to interact with the files. 
 action.escu.creation_date = 2017-10-23
 action.escu.modification_date = 2018-11-15
 action.escu.confidence = medium
 action.escu.full_search_name = ESCU - Hiding Files And Directories With Attrib.exe - Rule
 action.escu.search_type = detection
-action.escu.asset_at_risk =
+action.escu.asset_at_risk = 
 action.escu.fields_required = []
 action.escu.providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"]
 action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Persistence Techniques"]
@@ -4346,7 +4346,7 @@ action.correlationsearch.label = Hiding Files And Directories With Attrib.exe
 action.notable = 1
 action.notable.param.nes_fields = dest, user, process
 action.notable.param.rule_description = Attrib.exe is often used by attackers to hide malware files and directories in windows environments. This rule detects command-line arguments used to hide a file/directory
-action.notable.param.rule_title = Suspicious usage of attrib.exe on $dest$
+action.notable.param.rule_title = Suspicious usage of attrib.exe on $dest$ 
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = medium
 action.notable.param.recommended_actions = escu_investigate
@@ -5405,7 +5405,7 @@ action.correlationsearch.enabled = 1
 action.correlationsearch.label = Processes launching netsh
 action.notable = 1
 action.notable.param.nes_fields = dest, process, parent_process, cmdline
-action.notable.param.rule_description = A process detected on $dest$ is launching netsh.exe.
+action.notable.param.rule_description = A process detected on $dest$ is launching netsh.exe. 
 action.notable.param.rule_title = Process launching netsh.exe detected on $dest$
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = medium
@@ -5712,7 +5712,7 @@ action.escu.modification_date = 2019-02-27
 action.escu.confidence = medium
 action.escu.full_search_name = ESCU - Reg.exe used to hide files/directories via registry keys - Rule
 action.escu.search_type = detection
-action.escu.asset_at_risk =
+action.escu.asset_at_risk = 
 action.escu.fields_required = []
 action.escu.providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"]
 action.escu.analytic_story = ["Suspicious Windows Registry Activities", "Windows Defense Evasion Tactics", "Windows Persistence Techniques"]
@@ -5724,7 +5724,7 @@ action.correlationsearch.label = Reg.exe used to hide files/directories via regi
 action.notable = 1
 action.notable.param.nes_fields = dest, process
 action.notable.param.rule_description = Regedit.exe is used by attackers to hide malware files/directories in windows environments via registry key settings. This rule detects command-line arguments used to hide a file/directory
-action.notable.param.rule_title = Regedit.exe used to hide a file/directory on $dest$
+action.notable.param.rule_title = Regedit.exe used to hide a file/directory on $dest$ 
 action.notable.param.security_domain = endpoint
 action.notable.param.severity = medium
 action.notable.param.recommended_actions = escu_investigate
@@ -6341,7 +6341,7 @@ description = This search uses the Machine Learning Toolkit (MLTK) to identify s
 action.escu.mappings = {"mitre_attack": ["Commonly Used Port"], "kill_chain_phases": ["Actions on Objectives"], "cis20": ["CIS 8"], "nist": ["DE.CM"]}
 action.escu.data_models = ["Network_Traffic"]
 action.escu.eli5 = Attackers often leverage Server Message Block (SMB) traffic, a protocol used for Windows file-sharing activity. A high-profile example of SMB abuse was the WannaCry ransomware, which leveraged a vulnerability in the SMB protocol to propagate to other systems. Attackers have also used SMB for lateral movement with a target environment and to test credentials against target systems. While SMB is highly prevalent in Windows environments, a spike in SMB traffic may still be indicative of this type of malicious activity. This search leverages Splunk's Machine Learning Toolkit (MLTK) to identify spikes in SMB traffic that are unusual for a given hour of day/day of week combination. If such a spike is detected, you may want to investigate the source and analyze the cause of the abnormal traffic.
-action.escu.how_to_implement = This search requires you to be ingesting your network traffic logs and populating the Network_Traffic data model. In addition, the Machine Learning Toolkit (MLTK) version 4.2 or greater must be installed on your search heads, along with any required dependencies. Finally, the support search "Model Builder For "SMB Traffic Spike - MLTK"" must be executed before this detection search, as it builds a machine-learning (ML) model over the historical data used by this search.
+action.escu.how_to_implement = This search requires you to be ingesting your network traffic logs and populating the Network_Traffic data model. In addition, the Machine Learning Toolkit (MLTK) version 4.2 or greater must be installed on your search heads, along with any required dependencies. Finally, the support search "Baseline of SMB Traffic - MLTK" must be executed before this detection search, as it builds a machine-learning (ML) model over the historical data used by this search.
 action.escu.known_false_positives = If you are seeing more results than desired, you may consider reducing the value of the threshold in the search. You should also periodically re-run the support search to re-build the ML model on the latest data.
 action.escu.creation_date = 2019-05-08
 action.escu.modification_date = 2019-05-08
@@ -7422,7 +7422,7 @@ action.notable.param.rule_title = LNK file $file_name$ is executing process $pro
 action.notable.param.security_domain = network
 action.notable.param.severity = high
 action.notable.param.recommended_actions = escu_investigate
-action.notable.param.next_steps =
+action.notable.param.next_steps = 
 action.risk = 1
 action.risk.param._risk_object = dest
 action.risk.param._risk_object_type = system
@@ -7512,7 +7512,7 @@ action.escu.modification_date = 2019-02-28
 action.escu.confidence = medium
 action.escu.full_search_name = ESCU - Suspicious wevtutil Usage - Rule
 action.escu.search_type = detection
-action.escu.asset_at_risk =
+action.escu.asset_at_risk = 
 action.escu.fields_required = []
 action.escu.providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"]
 action.escu.analytic_story = ["Ransomware", "Windows Log Manipulation"]
@@ -7934,7 +7934,7 @@ action.escu.modification_date = 2019-02-28
 action.escu.confidence = medium
 action.escu.full_search_name = ESCU - Unusually Long Command Line - Rule
 action.escu.search_type = detection
-action.escu.asset_at_risk =
+action.escu.asset_at_risk = 
 action.escu.fields_required = []
 action.escu.providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"]
 action.escu.analytic_story = ["Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Suspicious Command-Line Executions", "Unusual Processes"]
@@ -7979,15 +7979,15 @@ action.escu.enabled = 1
 description = Command lines that are extremely long may be indicative of malicious activity on your hosts. This search leverages the Machine Learning Toolkit (MLTK) to help identify command lines with lengths that are unusual for a given user.
 action.escu.mappings = {"mitre_attack": ["Execution"], "kill_chain_phases": ["Actions on Objectives"], "cis20": ["CIS 8"], "nist": ["PR.PT", "DE.CM"]}
 action.escu.data_models = ["Endpoint"]
-action.escu.eli5 = This search leverages the Machine Learning Toolkit (MLTK) to identify outliers in the length of the command lines observed to be used by a specific user. The companion search, "Model Builder For "Unusually Long Command Line - MLTK," creates a machine-learning (ML) model built over the historical data used by this search.
-action.escu.how_to_implement = You must be ingesting endpoint data that monitors command lines and populates the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. In addition, MLTK version >= 4.2 must be installed on your search heads, along with any required dependencies. Finally, the support search "Model Builder For "Unusually Long Command Line - MLTK"" must be executed before this detection search, as it builds an ML model over the historical data used by this search.
+action.escu.eli5 = This search leverages the Machine Learning Toolkit (MLTK) to identify outliers in the length of the command lines observed to be used by a specific user. The companion search, "Baseline of Command Line Length - MLTK," creates a machine-learning (ML) model built over the historical data used by this search.
+action.escu.how_to_implement = You must be ingesting endpoint data that monitors command lines and populates the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. In addition, MLTK version >= 4.2 must be installed on your search heads, along with any required dependencies. Finally, the support search "Baseline of Command Line Length - MLTK" must be executed before this detection search, as it builds an ML model over the historical data used by this search.
 action.escu.known_false_positives = Some legitimate applications use long command lines for installs or updates. You should review identified command lines for legitimacy. You may modify the first part of the search to omit legitimate command lines from consideration. If you are seeing more results than desired, you may consider changing the value of threshold in the search to a smaller value. You should also periodically re-run the support search to re-build the ML model on the latest data. You may get unexpected results if the user identified in the results is not present in the data used to build the associated model.
 action.escu.creation_date = 2019-05-08
 action.escu.modification_date = 2019-05-08
 action.escu.confidence = medium
 action.escu.full_search_name = ESCU - Unusually Long Command Line - MLTK - Rule
 action.escu.search_type = detection
-action.escu.asset_at_risk =
+action.escu.asset_at_risk = 
 action.escu.fields_required = []
 action.escu.providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"]
 action.escu.analytic_story = ["Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Suspicious Command-Line Executions", "Unusual Processes"]
@@ -8571,7 +8571,7 @@ action.escu.fields_required = ["arn"]
 disabled=true
 schedule_window = auto
 is_visible = false
-search = | search sourcetype=aws:cloudtrail userIdentity.arn={arn} | table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType
+search = | search sourcetype=aws:cloudtrail userIdentity.arn={arn} | table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType 
 
 [ESCU - AWS Investigate User Activities By AccessKeyId]
 action.escu = 0
@@ -8831,7 +8831,7 @@ action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = investigative
 action.escu.full_search_name = ESCU - Get Certificate logs for a domain
-description = This search queries the Certificates datamodel and give you all the information for a specific domain. Please note that if the certificate information
+description = This search queries the Certificates datamodel and give you all the information for a specific domain. Please note that if the certificate information 
 action.escu.creation_date = 2019-04-29
 action.escu.modification_date = 2019-04-29
 action.escu.analytic_story = ["Common Phishing Frameworks"]
@@ -8873,7 +8873,7 @@ action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = investigative
 action.escu.full_search_name = ESCU - Get DNS traffic ratio
-description = This search calculates the ratio of DNS traffic originating and coming from a host to a list of DNS servers over the last 24 hours. A high value of this ratio could be very useful to quickly understand if a src_ip (host) is sending a high volume of data out via port 53, could be an indicator of data exfiltration via DNS.
+description = This search calculates the ratio of DNS traffic originating and coming from a host to a list of DNS servers over the last 24 hours. A high value of this ratio could be very useful to quickly understand if a src_ip (host) is sending a high volume of data out via port 53, could be an indicator of data exfiltration via DNS.  
 action.escu.creation_date = 2017-04-10
 action.escu.modification_date = 2017-11-09
 action.escu.analytic_story = ["Command and Control", "Data Protection", "Dynamic DNS", "Hidden Cobra Malware", "Suspicious DNS Traffic"]
@@ -9168,7 +9168,7 @@ action.escu.fields_required = ["process_name", "dest"]
 disabled=true
 schedule_window = auto
 is_visible = false
-search = | tstats `summariesonly` count min(_time)  max(_time) as lastTime from datamodel=Endpoint.Processes where Proceses.dest={dest} Proceses.process_name={process_name} by Processes.parent_process Processes.process_name Processes.user Processes.dest | `drop_dm_object_name(Processes)` | `ctime(firstTime)`|`ctime(lastTime)`
+search = | tstats `summariesonly` count min(_time)  max(_time) as lastTime from datamodel=Endpoint.Processes where Proceses.dest={dest} Proceses.process_name={process_name} by Processes.parent_process Processes.process_name Processes.user Processes.dest | `drop_dm_object_name(Processes)` | `ctime(firstTime)`|`ctime(lastTime)` 
 
 [ESCU - Get Process Information For Port Activity]
 action.escu = 0
@@ -9241,7 +9241,7 @@ action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = investigative
 action.escu.full_search_name = ESCU - Get Risk Modifiers For Endpoint
-description = For the last 7 days, the search will query the Risk data model in Splunk Enterprise Security and calculate the count, sum of the risk\_scores, names of the correlation searches that contributed to create a risk score for a specific endpoint(machine\_name)
+description = For the last 7 days, the search will query the Risk data model in Splunk Enterprise Security and calculate the count, sum of the risk\_scores, names of the correlation searches that contributed to create a risk score for a specific endpoint(machine\_name) 
 action.escu.creation_date = 2017-10-14
 action.escu.modification_date = 2017-10-19
 action.escu.analytic_story = ["Account Monitoring and Controls", "Apache Struts Vulnerability", "Asset Tracking", "Brand Monitoring", "ColdRoot MacOS RAT", "Collection and Staging", "Command and Control", "Credential Dumping", "DHS Report TA18-074A", "DNS Amplification Attacks", "Data Protection", "Disabling Security Tools", "Dynamic DNS", "Emotet Malware (TA18-201A)", "Hidden Cobra Malware", "Host Redirection", "JBoss Vulnerability", "Lateral Movement", "Malicious PowerShell", "Monitor Backup Solution", "Monitor for Unauthorized Software", "Monitor for Updates", "Netsh Abuse", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Router & Infrastructure Security", "SQL Injection", "SamSam Ransomware", "Spectre And Meltdown Vulnerabilities", "Splunk Enterprise Vulnerability", "Splunk Enterprise Vulnerability CVE-2018-11409", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious Emails", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Use of Cleartext Protocols", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse"]
@@ -9263,7 +9263,7 @@ action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = investigative
 action.escu.full_search_name = ESCU - Get Risk Modifiers For User
-description = For the last 7 days, the search will query the Risk data model in Splunk Enterprise Security and calculate the count, sum of the risk_scores, names of the correlation searches that contributed to create a risk score for a specific user
+description = For the last 7 days, the search will query the Risk data model in Splunk Enterprise Security and calculate the count, sum of the risk_scores, names of the correlation searches that contributed to create a risk score for a specific user 
 action.escu.creation_date = 2017-10-14
 action.escu.modification_date = 2017-10-19
 action.escu.analytic_story = ["Account Monitoring and Controls", "Apache Struts Vulnerability", "Asset Tracking", "Brand Monitoring", "ColdRoot MacOS RAT", "Collection and Staging", "Command and Control", "Credential Dumping", "DHS Report TA18-074A", "DNS Amplification Attacks", "Data Protection", "Disabling Security Tools", "Dynamic DNS", "Emotet Malware (TA18-201A)", "Hidden Cobra Malware", "Host Redirection", "JBoss Vulnerability", "Lateral Movement", "Malicious PowerShell", "Monitor Backup Solution", "Monitor for Unauthorized Software", "Monitor for Updates", "Netsh Abuse", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Router & Infrastructure Security", "SQL Injection", "SamSam Ransomware", "Spectre And Meltdown Vulnerabilities", "Splunk Enterprise Vulnerability", "Suspicious Command-Line Executions", "Suspicious DNS Traffic", "Suspicious Emails", "Suspicious MSHTA Activity", "Suspicious WMI Use", "Suspicious Windows Registry Activities", "Unusual Processes", "Use of Cleartext Protocols", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Log Manipulation", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse"]
@@ -9278,7 +9278,7 @@ action.escu.fields_required = ["user"]
 disabled=true
 schedule_window = auto
 is_visible = false
-search = | from datamodel:Risk.All_Risk | search risk_object_type=user risk_object={user} | stats count sum(risk_score) as risk_score values(search_name)  min(_time) as firstTime max(_time) as lastTime by risk_object |`ctime(firstTime)` |`ctime(lastTime)`
+search = | from datamodel:Risk.All_Risk | search risk_object_type=user risk_object={user} | stats count sum(risk_score) as risk_score values(search_name)  min(_time) as firstTime max(_time) as lastTime by risk_object |`ctime(firstTime)` |`ctime(lastTime)` 
 
 [ESCU - Get Sysmon WMI Activity for Host]
 action.escu = 0
@@ -9406,7 +9406,7 @@ action.escu.fields_required = ["user"]
 disabled=true
 schedule_window = auto
 is_visible = false
-search = | search sourcetype=aws:cloudtrail user={user} | table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType
+search = | search sourcetype=aws:cloudtrail user={user} | table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType 
 
 [ESCU - Investigate AWS activities via region name]
 action.escu = 0
@@ -9456,7 +9456,7 @@ action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = investigative
 action.escu.full_search_name = ESCU - Investigate Successful Remote Desktop Authentications
-description = This search returns the source, destination, and user for all successful remote-desktop authentications. A successful authentication after a brute-force attack on a destination machine is suspicious behavior.
+description = This search returns the source, destination, and user for all successful remote-desktop authentications. A successful authentication after a brute-force attack on a destination machine is suspicious behavior. 
 action.escu.creation_date = 2018-12-14
 action.escu.modification_date = 2018-12-14
 action.escu.analytic_story = ["DHS Report TA18-074A", "Emotet Malware (TA18-201A)", "Hidden Cobra Malware", "JBoss Vulnerability", "Lateral Movement", "Monitor for Unauthorized Software", "Ransomware", "SamSam Ransomware"]
@@ -9543,7 +9543,7 @@ action.escu = 0
 action.escu.enabled = 1
 action.escu.search_type = investigative
 action.escu.full_search_name = ESCU - Investigate Web POSTs From src
-description = This investigative search retrieves POST requests from a specified source IP or hostname. Identifying the POST requests, as well as their associated destination URLs and user agent(s), may help you scope and characterize the suspicious traffic.
+description = This investigative search retrieves POST requests from a specified source IP or hostname. Identifying the POST requests, as well as their associated destination URLs and user agent(s), may help you scope and characterize the suspicious traffic. 
 action.escu.creation_date = 2018-12-06
 action.escu.modification_date = 2018-12-06
 action.escu.analytic_story = ["Apache Struts Vulnerability"]
@@ -9579,7 +9579,7 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["Splunk Enterprise Security"]
 action.escu.eli5 = This search outputs the interesting processes lookup table and filters out all processes in the table that haven't already been inserted by ESCU. It then appends to those results all the processes currently identified by ESCU that should be prohibited. Next, it fills in the required fields with processes identified by ESCU, and then writes the results back to the interesting process lookup table. This is done so any new processes identified that should be prohibited will be added to the lookup table without creating any duplicate entries.
 action.escu.how_to_implement = This search should be run on each new install of ESCU.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
@@ -9599,12 +9599,54 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["AWS"]
 action.escu.eli5 = This search returns all log events that are API calls, pulls out the ARN that initiated each call, and collects them in one-hour groupings. Next, it calculates the number of API calls made per ARN per hour. For each ARN, it calculates the average and standard deviation of this count on a per-hour basis.  It also includes the number of data points each ARN had. This table is then stored in a lookup file.
 action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
 search = sourcetype=aws:cloudtrail eventType=AwsApiCall | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup api_call_by_user_baseline | stats count
 
+[ESCU - Baseline of Command Line Length- MLTK]
+action.escu = 0
+action.escu.enabled = 1
+action.escu.search_type = support
+action.escu.full_search_name = ESCU - Baseline of Command Line Length- MLTK
+description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies outliers in the length of the command line.
+action.escu.creation_date = 2019-05-08
+action.escu.modification_date = 2019-05-08
+action.escu.analytic_story = []
+action.escu.data_models = ["Endpoint"]
+dispatch.earliest_time = -31d@d
+dispatch.latest_time = -1d@d
+action.escu.providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"]
+action.escu.eli5 = Create a machine-learning (ML) model to characterize the length of the command lines used in your environment. This can help you identify unusually long ones that may indicate that attackers are executing commands on yout systems.
+action.escu.how_to_implement = You must be ingesting endpoint data and populating the Endpoint data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.
+action.escu.known_false_positives = 
+disabled=true
+schedule_window = auto
+is_visible = false
+search = | tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name Processes.process | `drop_dm_object_name(Processes)` | search user!=unknown | `ctime(firstTime)`| `ctime(lastTime)`| eval processlen=len(process) | fit DensityFunction processlen by user into cmdline_pdfmodel
+
+[ESCU - Baseline of DNS Query Length - MLTK]
+action.escu = 0
+action.escu.enabled = 1
+action.escu.search_type = support
+action.escu.full_search_name = ESCU - Baseline of DNS Query Length - MLTK
+description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query.
+action.escu.creation_date = 2019-05-08
+action.escu.modification_date = 2019-05-08
+action.escu.analytic_story = ["Command and Control", "DHS Report TA18-074A", "Data Protection", "Hidden Cobra Malware", "Suspicious DNS Traffic"]
+action.escu.data_models = ["Network_Resolution"]
+dispatch.earliest_time = -31d@d
+dispatch.latest_time = -1d@d
+action.escu.providing_technologies = ["Splunk Stream", "Bro"]
+action.escu.eli5 = Create a machine-learning (ML) model to characterize the length of DNS requests seen in your environment to help identify unusually long ones that may be indicative of attacker infrastrucutre or the use of DNS as a command-and-control channel in your environment.
+action.escu.how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.
+action.escu.known_false_positives = 
+disabled=true
+schedule_window = auto
+is_visible = false
+search = | tstats `summariesonly` count from datamodel=Network_Resolution by DNS.query DNS.record_type |  `drop_dm_object_name("DNS")` | eval query_length = len(query) | fit DensityFunction query_length by record_type into dns_query_pdfmodel
+
 [ESCU - Baseline of Network ACL Activity by ARN]
 action.escu = 0
 action.escu.enabled = 1
@@ -9619,7 +9661,7 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["AWS"]
 action.escu.eli5 = Use this search to create a baseline for API calls related to network ACLs for the users who initiated this activity. It returns all logged API calls for network activity, pulls out the ARN that initiated each call, and collects the `eventNames` in one-hour groupings. Next, it calculates the number of API calls made per ARN per-hour. For each ARN, it calculates the average and standard deviation of this count on a per-hour basis. It also includes the number of data points for each ARN. This table is stored in a lookup file.
 action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for network ACLs, edit the macro `NetworkACLEvents`.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
@@ -9639,12 +9681,33 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["AWS"]
 action.escu.eli5 = Use this search to create a baseline for API calls related to deleting an S3 bucket, grouped by the users who initiated this activity. It returns all logged API calls for S3 bucket-deletion activity and then pulls out the ARN that initiated each call. Next, it calculates the number of API calls made per ARN per hour. For each ARN, it calculates the average and standard deviation of this count on a per-hour basis. It also includes the number of data points for each ARN. This table is stored in a lookup file.
 action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
 search = sourcetype=aws:cloudtrail eventName=DeleteBucket | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup s3_deletion_baseline | stats count
 
+[ESCU - Baseline of SMB Traffic - MLTK]
+action.escu = 0
+action.escu.enabled = 1
+action.escu.search_type = support
+action.escu.full_search_name = ESCU - Baseline of SMB Traffic - MLTK
+description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week.
+action.escu.creation_date = 2019-05-08
+action.escu.modification_date = 2019-05-08
+action.escu.analytic_story = ["Command and Control", "DHS Report TA18-074A", "Emotet Malware (TA18-201A)", "Hidden Cobra Malware", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware"]
+action.escu.data_models = ["Network_Traffic"]
+dispatch.earliest_time = -31d@d
+dispatch.latest_time = -1d@d
+action.escu.providing_technologies = ["Splunk Stream", "Bro"]
+action.escu.eli5 = Create a machine-learning (ML) model to characterize the number of SMB connections observed in your environment. This may help identify spikes in SMB traffic that may be indicative of attackers scanning or attempting to propagate to other systems in your environment. By default, this model is built over 30 days of data and profiles the number of SMB connections in your environment by the hour of day/day of week that the connections occur.
+action.escu.how_to_implement = You must be ingesting network traffic and populating the Network_Traffic data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. To improve your results, you may consider adding "src" to the by clause, which will build the model for each unique source in your enviornment. However, if you have a large number of hosts in your environment, this search may be very resource intensive. In this case, you may need to raise the value of max_inputs and/or max_groups in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.
+action.escu.known_false_positives = 
+disabled=true
+schedule_window = auto
+is_visible = false
+search = | tstats `summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=10m, All_Traffic.src | eval HourOfDay=strftime(_time, "%H") | eval DayOfWeek=strftime(_time, "%A") | `drop_dm_object_name("All_Traffic")` | fit DensityFunction count by "HourOfDay,DayOfWeek" into smb_pdfmodel
+
 [ESCU - Baseline of Security Group Activity by ARN]
 action.escu = 0
 action.escu.enabled = 1
@@ -9659,7 +9722,7 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["AWS"]
 action.escu.eli5 = Use this search to create a baseline for API calls related to security groups by the users who initiated this activity. It returns all logged API calls for all security-group-related activity, pulls out the ARN that initiated each call, and collects the `eventNames` in one-hour groupings. Next, it calculates the number of API calls made per ARN per hour. For each ARN, it calculates the average and standard deviation of this count on a per-hour basis. It also includes the number of data points for each ARN. This table is stored in a lookup file.
 action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for security groups, edit the macro `securityGroupAPIs`.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
@@ -9679,7 +9742,7 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["AWS"]
 action.escu.eli5 = Use this search to create a baseline of blocked outbound network connections by each source IP in your AWS environment. This search returns all log events that correspond to a blocked outbound network connection, extracts the source IP from where the outbound connection was initiated, and collects the events in one-hour groupings. Next, it calculates the number of outbound connections blocked per hour. For each source IP, it calculates the average and standard deviation of this count on a per-hour basis.  It also includes the number of data points each source IP had. This table is then stored in a lookup file.
 action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow logs.`.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
@@ -9700,7 +9763,7 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["Splunk Stream", "Bro"]
 action.escu.eli5 = For each port being accessed on the network, this search gives the total number of connections observed, and the number of unique IP addresses making those connections.
 action.escu.how_to_implement = To successfully implement this search, you must be ingesting network traffic, and populating the Network_Traffic data model.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
@@ -9721,7 +9784,7 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["Splunk Enterprise Security"]
 action.escu.eli5 = This search gives you the number and the names of the hosts of each host in your environment by category. It will then sort them by the count.
 action.escu.how_to_implement = To successfully implement this search you must first leverage the Assets and Identity framework in Enterprise Security to populate your assets_by_str.csv file which should then be mapped to the Identity_Management data model. The Identity_Management data model will contain a list of known authorized company assets. Ensure that all inventoried systems are constantly vetted and updated.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
@@ -9741,7 +9804,7 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["AWS"]
 action.escu.eli5 = We first look for all successful CloudTrail API activity caused by types of user accounts and then remove all the events caused by users in the Identity table. This generates a list of accounts--typically service accounts--configured in your AWS environment. We output this list of service accounts to `aws_service_accounts.csv`.
 action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the service account entires in `aws_service_accounts.csv`, which is a lookup file created as a result of running this support search. Please remove the entries of service accounts that are not legitimate.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
@@ -9761,7 +9824,7 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["Splunk Enterprise"]
 action.escu.eli5 = This search starts with the dnstwist command consuming domains from a file called domains.csv in the DA-ESS-SOC/lookups directory. This search then adds a domain\_abuse=true term to each permutation, removes all the valid domain names and stores all that information into a lookup file that is used in the associated detection search. Alternatively domain dnstwist permutations can be calculated from domains in the `cim_corporate_email_domains.csv` and `cim_corporate_web_domains.csv` lookups located in **Splunk\_SA\_CIM** using argument `populate_from_cim=true`. Also an individual domain can be passed using argument `domain=<domain>`
 action.escu.how_to_implement = To successfully implement this search you need to update the file called domains.csv in the DA-ESS-SOC/lookup directory. Or `cim_corporate_email_domains.csv` and `cim_corporate_web_domains.csv` from **Splunk\_SA\_CIM**.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
@@ -9782,7 +9845,7 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["Splunk Stream", "Bro"]
 action.escu.eli5 = Discover the DNS records and their answers for domains owned by the company using network traffic events. The discovered events are exported as a lookup named `discovered_dns_records.csv`
 action.escu.how_to_implement = To successfully implement this search, you must be ingesting DNS logs, and populating the Network_Resolution data model. Also make sure that the cim_corporate_web_domains and cim_corporate_email_domains lookups are populated with the domains owned by your corporation
-action.escu.known_false_positives = Please vet the lookup created by this baseline search
+action.escu.known_false_positives = Please vet the lookup created by this baseline search 
 action.escu.fields_required = ["query", "answer"]
 disabled=true
 schedule_window = auto
@@ -9804,7 +9867,7 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["Splunk Stream", "Bro"]
 action.escu.eli5 = This search counts the numbers of times the system has tried to connect to another system on TCP/3389, the default port used for RDP traffic.
 action.escu.how_to_implement = To successfully implement this search, you must ingest network traffic and populate the Network_Traffic data model.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
@@ -9825,7 +9888,7 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["Splunk Stream", "Bro"]
 action.escu.eli5 = This search counts the numbers of times the system has received a connection to TCP/ 3389, the default port used for RDP traffic.
 action.escu.how_to_implement = To successfully implement this search you must ingest network traffic and populate the Network_Traffic data model. If a system receives a lot of remote desktop traffic, you can apply the category common_rdp_destination to it.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
@@ -9846,75 +9909,12 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"]
 action.escu.eli5 = This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system. It does this by looking for the process name in the Endpoint data model.
 action.escu.how_to_implement = To successfully implement this search you must be ingesting endpoint data that records process activity.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
 search = | tstats `summariesonly` count from datamodel=Endpoint.Processes where Processes.process_name="*mstsc.exe*" by Processes.dest Processes.process_name | `drop_dm_object_name(Processes)` | sort - count
 
-[ESCU - Model Builder For DNS Query Length Outliers - MLTK]
-action.escu = 0
-action.escu.enabled = 1
-action.escu.search_type = support
-action.escu.full_search_name = ESCU - Model Builder For DNS Query Length Outliers - MLTK
-description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query.
-action.escu.creation_date = 2019-05-08
-action.escu.modification_date = 2019-05-08
-action.escu.analytic_story = ["Command and Control", "DHS Report TA18-074A", "Data Protection", "Hidden Cobra Malware", "Suspicious DNS Traffic"]
-action.escu.data_models = ["Network_Resolution"]
-dispatch.earliest_time = -31d@d
-dispatch.latest_time = -1d@d
-action.escu.providing_technologies = ["Splunk Stream", "Bro"]
-action.escu.eli5 = Create a machine-learning (ML) model to characterize the length of DNS requests seen in your environment to help identify unusually long ones that may be indicative of attacker infrastrucutre or the use of DNS as a command-and-control channel in your environment.
-action.escu.how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.
-action.escu.known_false_positives =
-disabled=true
-schedule_window = auto
-is_visible = false
-search = | tstats `summariesonly` count from datamodel=Network_Resolution by DNS.query DNS.record_type |  `drop_dm_object_name("DNS")` | eval query_length = len(query) | fit DensityFunction query_length by record_type into dns_query_pdfmodel
-
-[ESCU - Model Builder For SMB Traffic Spike - MLTK]
-action.escu = 0
-action.escu.enabled = 1
-action.escu.search_type = support
-action.escu.full_search_name = ESCU - Model Builder For SMB Traffic Spike - MLTK
-description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week.
-action.escu.creation_date = 2019-05-08
-action.escu.modification_date = 2019-05-08
-action.escu.analytic_story = ["Command and Control", "DHS Report TA18-074A", "Emotet Malware (TA18-201A)", "Hidden Cobra Malware", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware"]
-action.escu.data_models = ["Network_Traffic"]
-dispatch.earliest_time = -31d@d
-dispatch.latest_time = -1d@d
-action.escu.providing_technologies = ["Splunk Stream", "Bro"]
-action.escu.eli5 = Create a machine-learning (ML) model to characterize the number of SMB connections observed in your environment. This may help identify spikes in SMB traffic that may be indicative of attackers scanning or attempting to propagate to other systems in your environment. By default, this model is built over 30 days of data and profiles the number of SMB connections in your environment by the hour of day/day of week that the connections occur.
-action.escu.how_to_implement = You must be ingesting network traffic and populating the Network_Traffic data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. To improve your results, you may consider adding "src" to the by clause, which will build the model for each unique source in your enviornment. However, if you have a large number of hosts in your environment, this search may be very resource intensive. In this case, you may need to raise the value of max_inputs and/or max_groups in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.
-action.escu.known_false_positives =
-disabled=true
-schedule_window = auto
-is_visible = false
-search = | tstats `summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=10m, All_Traffic.src | eval HourOfDay=strftime(_time, "%H") | eval DayOfWeek=strftime(_time, "%A") | `drop_dm_object_name("All_Traffic")` | fit DensityFunction count by "HourOfDay,DayOfWeek" into smb_pdfmodel
-
-[ESCU - Model Builder For Unusually Long Command Line - MLTK]
-action.escu = 0
-action.escu.enabled = 1
-action.escu.search_type = support
-action.escu.full_search_name = ESCU - Model Builder For Unusually Long Command Line - MLTK
-description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies outliers in the length of the command line.
-action.escu.creation_date = 2019-05-08
-action.escu.modification_date = 2019-05-08
-action.escu.analytic_story = ["Command and Control", "DHS Report TA18-074A", "Emotet Malware (TA18-201A)", "Hidden Cobra Malware", "Malicious PowerShell", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Suspicious Command-Line Executions", "Unusual Processes"]
-action.escu.data_models = ["Endpoint"]
-dispatch.earliest_time = -31d@d
-dispatch.latest_time = -1d@d
-action.escu.providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"]
-action.escu.eli5 = Create a machine-learning (ML) model to characterize the length of the command lines used in your environment. This can help you identify unusually long ones that may indicate that attackers are executing commands on yout systems.
-action.escu.how_to_implement = You must be ingesting endpoint data and populating the Endpoint data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.
-action.escu.known_false_positives =
-disabled=true
-schedule_window = auto
-is_visible = false
-search = | tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name Processes.process | `drop_dm_object_name(Processes)` | search user!=unknown | `ctime(firstTime)`| `ctime(lastTime)`| eval processlen=len(process) | fit DensityFunction processlen by user into cmdline_pdfmodel
-
 [ESCU - Monitor Successful Backups]
 action.escu = 0
 action.escu.enabled = 1
@@ -9929,7 +9929,7 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["Netbackup"]
 action.escu.eli5 = This search gives you the count and the hostname of all the systems that had a successful backup each day.
 action.escu.how_to_implement = To successfully implement this search you must be ingesting your backup logs.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
@@ -9949,7 +9949,7 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["Netbackup"]
 action.escu.eli5 = This search gives you the count and hostname of all the systems that had a backup failure each day
 action.escu.how_to_implement = To successfully implement this search you must be ingesting your backup logs.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
@@ -9969,7 +9969,7 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["AWS"]
 action.escu.eli5 = In this support search, we look for **AssumeRole** events where the requesting account is different from the requested account. The first and last times these events are seen are written to a lookup file.
 action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
@@ -9989,7 +9989,7 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["AWS"]
 action.escu.eli5 = This search includes any event name that begins with "run" or "create," and then determines the first and last time these events were seen for each IP address that initiated the action. The search then consults a **GeoIP** database to determine the physical location of this IP address. This table outputs to a file.
 action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
@@ -10009,7 +10009,7 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["AWS"]
 action.escu.eli5 = In this support search, we create a table of the first time (earliest) and most recent time (latest) that this region has been seen in our dataset, grouped by the value `awsRegion`. We only look for those events where an instance has been started. All of these entries will be added to the `previously_seen_aws_regions.csv` lookup file, which will act like a baseline for detections. Please validate the entries of region names in the lookup file.
 action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
@@ -10029,7 +10029,7 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["AWS"]
 action.escu.eli5 = In this support search, we create a table of the earliest and latest time that a specific AMI ID has been seen. This table is then outputted to a csv file.
 action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
@@ -10049,7 +10049,7 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["AWS"]
 action.escu.eli5 = In this support search, we create a table of the earliest and latest time that a specific EC2 instance type has been seen. The instanceType request field is not required and defaults to m1.small, so any time this field is null, the search defaults the field to m1.small. This table is then outputted to a csv file.
 action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
@@ -10069,7 +10069,7 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["AWS"]
 action.escu.eli5 = In this support search, we create a table of the earliest and latest times that an ARN has launched a EC2 instance. This table is then outputted to a csv file.
 action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
@@ -10089,7 +10089,7 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["AWS"]
 action.escu.eli5 = In this support search, we create a table of the earliest and latest times that an ARN has modified a EC2 instance. The list of APIs that modify an EC2 are defined in the `ec2ModificationAPIs` macro for ease of use. This table is then outputted to a file.
 action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2ModificationAPIs`.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
@@ -10109,7 +10109,7 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.eli5 = In this support search, we look for Windows system-event code that indicates a status change of a Windows service. It extracts both the name of the service and the action taken by the service from the logs. It keeps only services that have entered the running state. Finally, it finds the first time the service has been seen running across the enterprise and writes that file to a lookup table.
 action.escu.how_to_implement = While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows security-event logs for it to execute successfully.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
@@ -10129,7 +10129,7 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["AWS"]
 action.escu.eli5 = In this support search, we are looking for successful API calls made by user roles within your AWS infrastructure. The intent is to create an initial baseline cache of names of the API calls per security role for the previous 30 days--including the earliest and latest times seen in our dataset--grouped by the value of user role and the name of the API call. It is also worth noting that the role of a particular user is parsed as "userName" in the CloudTrail logs.
 action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user role entries in `previously_seen_api_calls_from_user_roles.csv`, which is a lookup file created as a result of running this support search.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
@@ -10149,7 +10149,7 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["AWS"]
 action.escu.eli5 = In this support search, we are looking for successful S3 bucket-access attempts made from remote IPs. The intent is to create an initial baseline cache of remote IP addresses per bucket name for the previous 30 days--including the earliest and latest times seen in our dataset--grouped by the value of remote IP and the name of the S3 bucket.
 action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your S3 access-logs inputs. You must validate the remote IP and bucket name entries in `previously_seen_S3_access_from_remote_ip.csv`, which is a lookup file created as a result of running this support search.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
@@ -10170,7 +10170,7 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"]
 action.escu.eli5 = In this support search, we look for command-line arguments using the parameter `/c` to execute processes and create an initial baseline cache for the previous 30 days. This will include the earliest and latest times a particular command-line argument is seen in our dataset, grouped by the command-line value.
 action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the "process" field in the Endpoint data model.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
@@ -10190,7 +10190,7 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["AWS"]
 action.escu.eli5 = In this support search, we look for console login events by a particular user and create an initial baseline cache for the previous seven days, including the earliest and latest times a particular user ARN is seen in our dataset, grouped by the ARN value.
 action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins.csv`, which is a lookup file created as a result of running this support search.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
@@ -10211,7 +10211,7 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"]
 action.escu.eli5 = This search looks to see if a registry key was created at `HKLM\Software\Microsoft\Windows\CurrentVersion\QualityCompat`. It will tell you when it was created and, if possible, what process created it.
 action.escu.how_to_implement = You need to be ingesting logs with both the process name and command-line from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
@@ -10232,7 +10232,7 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.eli5 = This search gives you the count of the number of systems that attempted and failed to install a Windows update each day.
 action.escu.how_to_implement = You must be ingesting your Windows Update Logs
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false
@@ -10253,7 +10253,7 @@ dispatch.latest_time = -10m@m
 action.escu.providing_technologies = ["Microsoft Windows"]
 action.escu.eli5 = This search gives you the count and name of all the systems that had a successful update applied each day
 action.escu.how_to_implement = You must be ingesting your Windows Update Logs
-action.escu.known_false_positives =
+action.escu.known_false_positives = 
 disabled=true
 schedule_window = auto
 is_visible = false

src/default/use_case_library.conf

@@ -1,6 +1,6 @@
 #############
 # Automatically generated by generator.py in splunk/security-content
-# On Date: 2019-05-10T21:05:35 UTC
+# On Date: 2019-05-15T20:03:38 UTC
 # Author: Splunk Security Research
 # Contact: research@splunk.com
 #############
@@ -177,7 +177,7 @@ references = ["https://attack.mitre.org/wiki/Collection", "https://attack.mitre.
 maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}]
 spec_version = 1
 searches = ["ESCU - Suspicious writes to windows Recycle Bin - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"]
-description = Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data.
+description = Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data. 
 narrative = A common adversary goal is to identify and exfiltrate data of value from a target organization. This data may include email conversations and addresses, confidential company information, links to network design/infrastructure, important dates, and so on.\
 \
  Attacks are composed of three activities: identification, collection, and staging data for exfiltration. Identification typically involves scanning systems and observing user activity. Collection can involve the transfer of large amounts of data from various repositories. Staging/preparation includes moving data to a central location and compressing (and optionally encoding and/or encrypting) it. All of these activities provide opportunities for defenders to identify their presence. \
@@ -191,7 +191,7 @@ version = 1.0
 references = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"]
 maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}]
 spec_version = 1
-searches = ["ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Count of Unique IPs Connecting to Ports", "ESCU - Model Builder For DNS Query Length Outliers - MLTK", "ESCU - Model Builder For SMB Traffic Spike - MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
+searches = ["ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Count of Unique IPs Connecting to Ports", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
 description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators.
 narrative = Threat actors typically architect and implement an infrastructure to use in various ways during the course of their attack campaigns. In some cases, they leverage this infrastructure for scanning and performing reconnaissance activities. In others, they may use this infrastructure to launch actual attacks. One of the most important functions of this infrastructure is to establish servers that will communicate with implants on compromised endpoints. These servers establish a command and control channel that is used to proxy data between the compromised endpoint and the attacker. These channels relay commands from the attacker to the compromised endpoint and the output of those commands back to the attacker.\
 \
@@ -205,7 +205,7 @@ references = ["https://github.com/kgretzky/evilginx2", "https://attack.mitre.org
 maintainers = [{"company": "Splunk", "email": "research@splunk.com", "name": "Splunk Research Team"}]
 spec_version = 2
 searches = ["ESCU - Detect DNS requests to Phishing Sites leveraging EvilGinx2 - Rule", "ESCU - Get Certificate logs for a domain"]
-description = Detect DNS and web requests to fake websites generated by the EvilGinx2 toolkit. These websites are designed to fool unwitting users who have clicked on a malicious link in a phishing email.
+description = Detect DNS and web requests to fake websites generated by the EvilGinx2 toolkit. These websites are designed to fool unwitting users who have clicked on a malicious link in a phishing email. 
 narrative = As most people know, these emails use fraudulent domains, [email scraping](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), familiar contact names inserted as senders, and other tactics to lure targets into clicking a malicious link, opening an attachment with a [nefarious payload](https://www.cyberscoop.com/emotet-trojan-phishing-scraping-templates-cofense-geodo/), or entering sensitive personal information that perpetrators may intercept. This attack technique requires a relatively low level of skill and allows adversaries to easily cast a wide net. Because phishing is a technique that relies on human psychology, you will never be able to eliminate this vulnerability 100%. But you can use automated detection to significantly reduce the risks.\
 \
 This Analytic Story focuses on detecting signs of MiTM attacks enabled by [EvilGinx2](https://github.com/kgretzky/evilginx2), a toolkit that sets up a transparent proxy between the targeted site and the user. In this way, the attacker is able to intercept credentials and two-factor identification tokens. It employs a proxy template to allow a registered domain to impersonate targeted sites, such as Linkedin, Amazon, Okta, Github, Twitter, Instagram, Reddit, Office 365, and others. It can even register SSL certificates and camouflage them via a URL shortener, making them difficult to detect. Searches in this story look for signs of MiTM attacks enabled by EvilGinx2.
@@ -232,7 +232,7 @@ version = 2.0
 references = ["https://www.us-cert.gov/ncas/alerts/TA18-074A"]
 maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}]
 spec_version = 1
-searches = ["ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Suspicious Reg.exe Process - Rule", "ESCU - Sc.exe Manipulating Windows Services - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Create local admin accounts using net.exe - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Scheduled Task Name Used by Dragonfly Threat Actors - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Model Builder For DNS Query Length Outliers - MLTK", "ESCU - Model Builder For SMB Traffic Spike - MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Previously Seen Running Windows Services", "ESCU - Previously seen command line arguments", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
+searches = ["ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Suspicious Reg.exe Process - Rule", "ESCU - Sc.exe Manipulating Windows Services - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Create local admin accounts using net.exe - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Scheduled Task Name Used by Dragonfly Threat Actors - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Previously Seen Running Windows Services", "ESCU - Previously seen command line arguments", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
 description = Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more.
 narrative = The frequency of nation-state cyber attacks has increased significantly over the last decade. Employing numerous tactics and techniques, these attacks continue to escalate in complexity. \
 \
@@ -289,7 +289,7 @@ version = 1.0
 references = ["https://www.cisecurity.org/controls/data-protection/", "https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 1
-searches = ["ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Model Builder For DNS Query Length Outliers - MLTK"]
+searches = ["ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Baseline of DNS Query Length - MLTK"]
 description = Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration.
 narrative = Attackers can leverage a variety of resources to compromise or exfiltrate enterprise data. Common exfiltration techniques include remote-access channels via low-risk, high-payoff active-collections operations and close-access operations using insiders and removable media. While this Analytic Story is not a comprehensive listing of all the methods by which attackers can exfiltrate data, it provides a useful starting point.
 
@@ -322,13 +322,13 @@ version = 1.0
 references = ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf", "https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 1
-searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Detect Use of cmd.exe to Launch Script Interpreters - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Email Info", "ESCU - Get Emails From Specific Sender", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Model Builder For SMB Traffic Spike - MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Previously seen command line arguments", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
+searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Detect Use of cmd.exe to Launch Script Interpreters - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Email Info", "ESCU - Get Emails From Specific Sender", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Previously seen command line arguments", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
 description = Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment.
 narrative = The trojan downloader known as Emotet first surfaced in 2014, when it was discovered targeting the banking industry to steal credentials. However, according to a joint technical alert (TA) issued by three government agencies (https://www.us-cert.gov/ncas/alerts/TA18-201A), Emotet has evolved far beyond those beginnings to become what a ThreatPost article called a threat-delivery service(see https://threatpost.com/emotet-malware-evolves-beyond-banking-to-threat-delivery-service/134342/).  For example, in early 2018, Emotet was found to be using its loader function to spread the Quakbot and Ransomware variants. \
 \
 According to the TA, the the malware continues to be among the most costly and destructive malware affecting the private and public sectors. Researchers have linked it to the threat group Mealybug, which has also been on the security communitys radar since 2014.\
 \
-The searches in this Analytic Story will help you find executables that are rarely used in your environment, specific registry paths that malware often uses to ensure survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that Emotet or other malware has compromised your environment.
+The searches in this Analytic Story will help you find executables that are rarely used in your environment, specific registry paths that malware often uses to ensure survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that Emotet or other malware has compromised your environment. 
 
 [analytic_story://Hidden Cobra Malware]
 category = Malware
@@ -337,7 +337,7 @@ version = 2.0
 references = ["https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"]
 maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}]
 spec_version = 1
-searches = ["ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Create or delete hidden shares using net.exe - Rule", "ESCU - Suspicious File Write - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Identify Systems Creating Remote Desktop Traffic", "ESCU - Identify Systems Receiving Remote Desktop Traffic", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Model Builder For DNS Query Length Outliers - MLTK", "ESCU - Model Builder For SMB Traffic Spike - MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Previously seen command line arguments", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
+searches = ["ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Create or delete hidden shares using net.exe - Rule", "ESCU - Suspicious File Write - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Identify Systems Creating Remote Desktop Traffic", "ESCU - Identify Systems Receiving Remote Desktop Traffic", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Previously seen command line arguments", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
 description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A.
 narrative = North Korea's government-sponsored "cyber army" has been slowly building momentum and gaining sophistication over the last 15 years or so. As a result, the group's activity, which the US government refers to as "Hidden Cobra," has surreptitiously crept onto the collective radar as a preeminent global threat.\
 \
@@ -423,7 +423,7 @@ version = 4.0
 references = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"]
 maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}]
 spec_version = 1
-searches = ["ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Previously seen command line arguments"]
+searches = ["ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Attempt To Set Default PowerShell Execution Policy To Unrestricted - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Previously seen command line arguments"]
 description = Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent.
 narrative = The searches in this Analytic Story monitor for parameters often used for malicious purposes. It is helpful to understand how often the notable events generated by this story occur, as well as the commonalities between some of these events. These factors may provide clues about whether this is a common occurrence of minimal concern or a rare event that may require more extensive investigation. Likewise, it is important to determine whether the issue is restricted to a single user/system or is broader in scope.\
 \
@@ -464,10 +464,10 @@ references = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic
 maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}]
 spec_version = 1
 searches = ["ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
-description = Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment.
+description = Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment. 
 narrative = It is critical to identify unauthorized software and processes running on enterprise endpoints and determine whether they are likely to be malicious. This Analytic Story requires the user to populate the Interesting Processes table within Enterprise Security with prohibited processes. An included support search will augment this data, adding information on processes thought to be malicious. This search requires data from endpoint detection-and-response solutions, endpoint data sources (such as Sysmon), or Windows Event Logs--assuming that the Active Directory administrator has enabled process tracking within the System Event Audit Logs.\
 \
-It is important to investigate any software identified as suspicious, in order to understand how it was installed or executed. Analyzing authentication logs or any historic notable events might elicit additional investigative leads of interest. For best results, schedule the search to run every two weeks.
+It is important to investigate any software identified as suspicious, in order to understand how it was installed or executed. Analyzing authentication logs or any historic notable events might elicit additional investigative leads of interest. For best results, schedule the search to run every two weeks. 
 
 [analytic_story://Monitor for Updates]
 category = Best Practices
@@ -504,7 +504,7 @@ version = 2.0
 references = ["https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia", "https://www.infosecurity-magazine.com/news/healthcare-targeted-by-hacker/"]
 maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}]
 spec_version = 1
-searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Sc.exe Manipulating Windows Services - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Previously Seen Running Windows Services", "ESCU - Previously seen command line arguments"]
+searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Sc.exe Manipulating Windows Services - Rule", "ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host", "ESCU - Previously Seen Running Windows Services", "ESCU - Previously seen command line arguments"]
 description = Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry.
 narrative = In May of 2018, the attack group Orangeworm was implicated for installing a custom backdoor called Trojan.Kwampirs within large international healthcare corporations in the United States, Europe, and Asia. This malware provides the attackers with remote access to the target system, decrypting and extracting a copy of its main DLL payload from its resource section. Before writing the payload to disk, it inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.\
 \
@@ -548,7 +548,7 @@ version = 1.0
 references = ["https://intelgraph.idefense.com/#/node/threat_group/view/29fbec10-8cc8-4662-8362-2c24c1eeb74c", "https://intelgraph.idefense.com/#/node/intelligence_alert/view/62bb3669-9386-4264-b51a-59876cf50ffe", "http://blog.amossys.fr/badflick-is-not-so-bad.html"]
 maintainers = [{"company": "iDefense", "email": "iDefense.IntelOps@accenture.com", "name": "iDefense Cyber Espionage Team"}]
 spec_version = 1
-searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Previously seen command line arguments"]
+searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host", "ESCU - Previously seen command line arguments"]
 description = Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group.
 narrative = This story was created as a joint effort between iDefense and Splunk.\
 \
@@ -613,7 +613,7 @@ version = 1.0
 references = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"]
 maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}]
 spec_version = 1
-searches = ["ESCU - TOR Traffic - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable History", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Count of Unique IPs Connecting to Ports", "ESCU - Model Builder For SMB Traffic Spike - MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
+searches = ["ESCU - TOR Traffic - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable History", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Web Activity From Host", "ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Count of Unique IPs Connecting to Ports", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
 description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers.
 narrative = A traditional security best practice is to control the ports, protocols, and services allowed within your environment. By limiting the services and protocols to those explicitly approved by policy, administrators can minimize the attack surface. The combined effect allows both network defenders and security controls to focus and not be mired in superfluous traffic or data types. Looking for deviations to policy can identify attacker activity that abuses services and protocols to run on alternate or non-standard ports in the attempt to avoid detection or frustrate forensic analysts.
 
@@ -624,7 +624,7 @@ version = 1.0
 references = ["https://www.symantec.com/connect/blogs/what-you-need-know-about-wannacry-ransomware", "https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"]
 maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}]
 spec_version = 1
-searches = ["ESCU - Windows Event Log Cleared - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Model Builder For SMB Traffic Spike - MLTK", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
+searches = ["ESCU - Windows Event Log Cleared - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host", "ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"]
 description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others.
 narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware.
 
@@ -751,7 +751,7 @@ references = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integ
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 1
 searches = ["ESCU - Detect new user AWS Console Login - Rule", "ESCU - AWS Investigate User Activities By ARN", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Previously seen users in CloudTrail"]
-description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins.
+description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. 
 narrative = It is important to monitor and control who has access to your AWS infrastructure. Detecting suspicious logins to your AWS infrastructure will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any EC2 instances created by the attacker.
 
 [analytic_story://Suspicious AWS S3 Activities]
@@ -767,7 +767,7 @@ narrative = As cloud computing has exploded, so has the number of creative attac
 \
 Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\
 \
-Among things to look out for are S3 access from unfamiliar locations and by unfamiliar users. Some of the searches in this Analytic Story help you detect suspicious behavior and others help you investigate more deeply, when the situation warrants.
+Among things to look out for are S3 access from unfamiliar locations and by unfamiliar users. Some of the searches in this Analytic Story help you detect suspicious behavior and others help you investigate more deeply, when the situation warrants.   
 
 [analytic_story://Suspicious AWS Traffic]
 category = Cloud Security
@@ -793,7 +793,7 @@ version = 2.0
 references = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 1
-searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Detect Prohibited Applications Spawning cmd.exe - Rule", "ESCU - Detect Use of cmd.exe to Launch Script Interpreters - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Registry Activities", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host", "ESCU - Model Builder For Unusually Long Command Line - MLTK", "ESCU - Previously seen command line arguments"]
+searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Detect Prohibited Applications Spawning cmd.exe - Rule", "ESCU - Detect Use of cmd.exe to Launch Script Interpreters - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Registry Activities", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host", "ESCU - Previously seen command line arguments"]
 description = Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems.
 narrative = The ability to execute arbitrary commands via the Windows CLI is a primary goal for the adversary. With access to the shell, an attacker can easily run scripts and interact with the target system. Often, attackers may only have limited access to the shell or may obtain access in unusual ways. In addition, malware may execute and interact with the CLI in ways that would be considered unusual and inconsistent with typical user activity. This provides defenders with opportunities to identify suspicious use and investigate, as appropriate. This Analytic Story contains various searches to help identify this suspicious activity, as well as others to aid you in deeper investigation.
 
@@ -804,7 +804,7 @@ version = 1.0
 references = ["http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/", "http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680", "https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454"]
 maintainers = [{"company": "Splunk", "email": "rvaldez@splunk.com", "name": "Rico Valdez"}]
 spec_version = 1
-searches = ["ESCU - Excessive DNS Failures - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Model Builder For DNS Query Length Outliers - MLTK"]
+searches = ["ESCU - Excessive DNS Failures - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Process Responsible For The DNS Traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Baseline of DNS Query Length - MLTK"]
 description = Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses.
 narrative = Although DNS is one of the fundamental underlying protocols that make the Internet work, it is often ignored (perhaps because of its complexity and effectiveness).  However, attackers have discovered ways to abuse the protocol to meet their objectives. One potential abuse involves manipulating DNS to hijack traffic and redirect it to an IP address under the attacker's control. This could inadvertently send users intending to visit google.com, for example, to an unrelated malicious website. Another technique involves using the DNS protocol for command-and-control activities with the attacker's malicious code or to covertly exfiltrate data. The searches within this Analytic Story look for these types of abuses.
 
@@ -892,7 +892,7 @@ version = 2.0
 references = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"]
 maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
 spec_version = 1
-searches = ["ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host", "ESCU - Model Builder For Unusually Long Command Line - MLTK"]
+searches = ["ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host"]
 description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation.
 narrative = Being able to profile a host's processes within your environment can help you more quickly identify processes that seem out of place when compared to the rest of the population of hosts or asset types.\
 \
@@ -940,7 +940,7 @@ references = ["https://attack.mitre.org/wiki/Defense_Evasion"]
 maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}]
 spec_version = 1
 searches = ["ESCU - Suspicious Reg.exe Process - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Hiding Files And Directories With Attrib.exe - Rule", "ESCU - Reg.exe used to hide files/directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"]
-description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others
+description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others 
 narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms.
 
 [analytic_story://Windows File Extension and Association Abuse]
@@ -1242,8 +1242,8 @@ providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon
 type = detection
 asset_type = Endpoint
 confidence = medium
-explanation = Attackers often use random, long domain names for components of their attack infrastructure. This search leverages the probability distribution function algorithm provided by the Machine Learning Toolkit (MLTK) to identify outliers in the length of the DNS query for each record type observed. The companion search "Model Builder For "DNS Query Length Outliers - MLTK"" creates a machine-learning (ML) model built over the historical data used by this search.
-how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, the Machine Learning Toolkit (MLTK) version 4.2 or greater must be installed on your search heads, along with any required dependencies. Finally, the support search "Model Builder For "DNS Query Length Outliers - MLTK"" must be executed before this detection search, as it builds a machine-learning (ML) model over the historical data used by this search.
+explanation = Attackers often use random, long domain names for components of their attack infrastructure. This search leverages the probability distribution function algorithm provided by the Machine Learning Toolkit (MLTK) to identify outliers in the length of the DNS query for each record type observed. The companion search "Baseline of DNS Query Length - MLTK" creates a machine-learning (ML) model built over the historical data used by this search.
+how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, the Machine Learning Toolkit (MLTK) version 4.2 or greater must be installed on your search heads, along with any required dependencies. Finally, the support search "Baseline of DNS Query Length - MLTK" must be executed before this detection search, as it builds a machine-learning (ML) model over the historical data used by this search.
 annotations = {"mitre_attack": ["Command and Control", "Exfiltration", "Commonly Used Port"], "kill_chain_phases": ["Command and Control"], "cis20": ["CIS 8", "CIS 12"], "nist": ["PR.PT", "DE.AE", "DE.CM"]}
 known_false_positives = If you are seeing more results than desired, you may consider reducing the value for threshold in the search. You should also periodically re-run the support search to re-build the ML model on the latest data.
 providing_technologies = ["Splunk Stream", "Bro"]
@@ -1464,7 +1464,7 @@ providing_technologies = ["Bro", "Splunk Stream"]
 
 [savedsearch://ESCU - Detect Path Interception By Creation Of program.exe - Rule]
 type = detection
-asset_type =
+asset_type = 
 confidence = medium
 explanation = This search queries the Endpoint file-system data model node to list out all the values of destination machines, as well as the values of file hashes and file paths that have the file "program.exe" in the C: drive. Path interception occurs when an executable is placed in a specific path so that it is executed by an application instead of by the intended target. In this case, applications vulnerable to path interception (because of unquoted service paths with spaces in Windows registry) allow attackers to execute maliciously crafted program.exes.
 how_to_implement = You must be ingesting data that records the file-system activity from your hosts to populate the Endpoint file-system data model node. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or other endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report file system reads and writes.
@@ -1506,7 +1506,7 @@ providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon
 type = detection
 asset_type = S3 Bucket
 confidence = low
-explanation = Here the subsearch executes first and returns all successful S3 bucket-access attempts (HTTP code "200") within the last hour. It groups the results by the earliest and latest times it has seen a remote IP accessing a particular bucket. It appends this information to the historical data from the lookup file and then recalculates the `firstTime` and `lastTime` field for each remote IP accessing an S3 bucket. Next, it returns only those remote IP addresses that have first been seen accessing a specific bucket within the past hour. This is combined with the main search to return the time, bucket name, source IP, city, and country operations performed, as well as the requested URI of the resource
+explanation = Here the subsearch executes first and returns all successful S3 bucket-access attempts (HTTP code "200") within the last hour. It groups the results by the earliest and latest times it has seen a remote IP accessing a particular bucket. It appends this information to the historical data from the lookup file and then recalculates the `firstTime` and `lastTime` field for each remote IP accessing an S3 bucket. Next, it returns only those remote IP addresses that have first been seen accessing a specific bucket within the past hour. This is combined with the main search to return the time, bucket name, source IP, city, and country operations performed, as well as the requested URI of the resource 
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your S3 access logs' inputs. This search works best when you run the "Previously Seen S3 Bucket Access by Remote IP" support search once to create a history of previously seen remote IPs and bucket names.
 annotations = {"mitre_attack": ["Execution", "Exfiltration"], "kill_chain_phases": ["Actions on Objectives"], "cis20": ["CIS 13", "CIS 14"], "nist": ["PR.DS", "PR.AC", "DE.CM"]}
 known_false_positives = S3 buckets can be accessed from any IP, as long as it can make a successful connection. This will be a false postive, since the search is looking for a new IP within the past hour
@@ -1541,7 +1541,7 @@ explanation = This search and its corresponding subsearch run through a series o
 1. Filters out anything that it determines is not a spike and returns the list of ARNs to the main search. The main search subsequently gets the names of all the API calls, the number of unique API calls, and the total number of API calls for each of these ARNs. Finally, it looks up the average and standard deviation and returns both the average and the number of standard deviations the spike is from the average.
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. You can modify `dataPointThreshold` and `deviationThreshold` to better fit your environment. The `dataPointThreshold` variable is the minimum number of data points required to have a statistically significant amount of data to determine. The `deviationThreshold` variable is the number of standard deviations away from the mean that the value must be to be considered a spike.
 annotations = {"mitre_attack": ["Credential Access", "Execution"], "kill_chain_phases": ["Actions on Objectives"], "cis20": ["CIS 16"], "nist": ["DE.DP", "DE.CM", "PR.AC"]}
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["AWS"]
 
 [savedsearch://ESCU - Detect Spike in Network ACL Activity - Rule]
@@ -1960,12 +1960,12 @@ providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon
 
 [savedsearch://ESCU - Hiding Files And Directories With Attrib.exe - Rule]
 type = detection
-asset_type =
+asset_type = 
 confidence = medium
 explanation = This search is looking to detect command-line execution with of attrib.exe binary with the +h flag set.  The +h flag is used to hide a file.
 how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
 annotations = {"mitre_attack": ["Defense Evasion", "Persistence"], "kill_chain_phases": ["Actions on Objectives"], "cis20": ["CIS 8"], "nist": ["DE.CM"]}
-known_false_positives = Some applications and users may legitimately use attrib.exe to interact with the files.
+known_false_positives = Some applications and users may legitimately use attrib.exe to interact with the files. 
 providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"]
 
 [savedsearch://ESCU - Hosts receiving high volume of network traffic from email server - Rule]
@@ -2220,7 +2220,7 @@ providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon
 
 [savedsearch://ESCU - Reg.exe used to hide files/directories via registry keys - Rule]
 type = detection
-asset_type =
+asset_type = 
 confidence = medium
 explanation = Reg.exe is a binary native to Windows platform used to edit the registry hives of the system. Attackers can leverage this binary to hide files by passing in arguments that are used to hide the files. In the search, we first gather results with keywords, add, Hidden, and REG_DWORD, that will be in the raw event and filter by process and the command-line. We then leverage regular expressions on the command-line field to look for /d value as 2 which is responsible for hiding a file or directory.
 how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
@@ -2343,7 +2343,7 @@ type = detection
 asset_type = Endpoint
 confidence = medium
 explanation = Attackers often leverage Server Message Block (SMB) traffic, a protocol used for Windows file-sharing activity. A high-profile example of SMB abuse was the WannaCry ransomware, which leveraged a vulnerability in the SMB protocol to propagate to other systems. Attackers have also used SMB for lateral movement with a target environment and to test credentials against target systems. While SMB is highly prevalent in Windows environments, a spike in SMB traffic may still be indicative of this type of malicious activity. This search leverages Splunk's Machine Learning Toolkit (MLTK) to identify spikes in SMB traffic that are unusual for a given hour of day/day of week combination. If such a spike is detected, you may want to investigate the source and analyze the cause of the abnormal traffic.
-how_to_implement = This search requires you to be ingesting your network traffic logs and populating the Network_Traffic data model. In addition, the Machine Learning Toolkit (MLTK) version 4.2 or greater must be installed on your search heads, along with any required dependencies. Finally, the support search "Model Builder For "SMB Traffic Spike - MLTK"" must be executed before this detection search, as it builds a machine-learning (ML) model over the historical data used by this search.
+how_to_implement = This search requires you to be ingesting your network traffic logs and populating the Network_Traffic data model. In addition, the Machine Learning Toolkit (MLTK) version 4.2 or greater must be installed on your search heads, along with any required dependencies. Finally, the support search "Baseline of SMB Traffic - MLTK" must be executed before this detection search, as it builds a machine-learning (ML) model over the historical data used by this search.
 annotations = {"mitre_attack": ["Commonly Used Port"], "kill_chain_phases": ["Actions on Objectives"], "cis20": ["CIS 8"], "nist": ["DE.CM"]}
 known_false_positives = If you are seeing more results than desired, you may consider reducing the value of the threshold in the search. You should also periodically re-run the support search to re-build the ML model on the latest data.
 providing_technologies = ["Bro", "Splunk Stream"]
@@ -2560,7 +2560,7 @@ providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon
 
 [savedsearch://ESCU - Suspicious wevtutil Usage - Rule]
 type = detection
-asset_type =
+asset_type = 
 confidence = medium
 explanation = This search looks for execution of wevtutil.exe with command-line arguments that indicate that it has been used to delete the setup, application, security, or system event logs. The search returns the number of times the behavior was observed, the first and last time it was seen, the host exhibiting the behavior and the user context of the process execution.
 how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model.
@@ -2640,7 +2640,7 @@ providing_technologies = ["Netbackup"]
 
 [savedsearch://ESCU - Unusually Long Command Line - Rule]
 type = detection
-asset_type =
+asset_type = 
 confidence = medium
 explanation = This search calculates the average and standard deviation for the length of the command lines on each of your endpoints and alerts when it detects a command line with a length over 10 times the standard deviation larger than the average command line.
 how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships, from your endpoints to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model.
@@ -2650,10 +2650,10 @@ providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon
 
 [savedsearch://ESCU - Unusually Long Command Line - MLTK - Rule]
 type = detection
-asset_type =
+asset_type = 
 confidence = medium
-explanation = This search leverages the Machine Learning Toolkit (MLTK) to identify outliers in the length of the command lines observed to be used by a specific user. The companion search, "Model Builder For "Unusually Long Command Line - MLTK," creates a machine-learning (ML) model built over the historical data used by this search.
-how_to_implement = You must be ingesting endpoint data that monitors command lines and populates the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. In addition, MLTK version >= 4.2 must be installed on your search heads, along with any required dependencies. Finally, the support search "Model Builder For "Unusually Long Command Line - MLTK"" must be executed before this detection search, as it builds an ML model over the historical data used by this search.
+explanation = This search leverages the Machine Learning Toolkit (MLTK) to identify outliers in the length of the command lines observed to be used by a specific user. The companion search, "Baseline of Command Line Length - MLTK," creates a machine-learning (ML) model built over the historical data used by this search.
+how_to_implement = You must be ingesting endpoint data that monitors command lines and populates the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" field in the Endpoint data model. In addition, MLTK version >= 4.2 must be installed on your search heads, along with any required dependencies. Finally, the support search "Baseline of Command Line Length - MLTK" must be executed before this detection search, as it builds an ML model over the historical data used by this search.
 annotations = {"mitre_attack": ["Execution"], "kill_chain_phases": ["Actions on Objectives"], "cis20": ["CIS 8"], "nist": ["PR.PT", "DE.CM"]}
 known_false_positives = Some legitimate applications use long command lines for installs or updates. You should review identified command lines for legitimacy. You may modify the first part of the search to omit legitimate command lines from consideration. If you are seeing more results than desired, you may consider changing the value of threshold in the search to a smaller value. You should also periodically re-run the support search to re-build the ML model on the latest data. You may get unexpected results if the user identified in the results is not present in the data used to build the associated model.
 providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"]
@@ -3174,238 +3174,238 @@ latest_time_offset = 3600
 type = support
 explanation = This search outputs the interesting processes lookup table and filters out all processes in the table that haven't already been inserted by ESCU. It then appends to those results all the processes currently identified by ESCU that should be prohibited. Next, it fills in the required fields with processes identified by ESCU, and then writes the results back to the interesting process lookup table. This is done so any new processes identified that should be prohibited will be added to the lookup table without creating any duplicate entries.
 how_to_implement = This search should be run on each new install of ESCU.
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["Splunk Enterprise Security"]
 
 [savedsearch://ESCU - Baseline of API Calls per User ARN]
 type = support
 explanation = This search returns all log events that are API calls, pulls out the ARN that initiated each call, and collects them in one-hour groupings. Next, it calculates the number of API calls made per ARN per hour. For each ARN, it calculates the average and standard deviation of this count on a per-hour basis.  It also includes the number of data points each ARN had. This table is then stored in a lookup file.
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs.
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["AWS"]
 
+[savedsearch://ESCU - Baseline of Command Line Length- MLTK]
+type = support
+explanation = Create a machine-learning (ML) model to characterize the length of the command lines used in your environment. This can help you identify unusually long ones that may indicate that attackers are executing commands on yout systems.
+how_to_implement = You must be ingesting endpoint data and populating the Endpoint data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.
+known_false_positives = 
+providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"]
+
+[savedsearch://ESCU - Baseline of DNS Query Length - MLTK]
+type = support
+explanation = Create a machine-learning (ML) model to characterize the length of DNS requests seen in your environment to help identify unusually long ones that may be indicative of attacker infrastrucutre or the use of DNS as a command-and-control channel in your environment.
+how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.
+known_false_positives = 
+providing_technologies = ["Splunk Stream", "Bro"]
+
 [savedsearch://ESCU - Baseline of Network ACL Activity by ARN]
 type = support
 explanation = Use this search to create a baseline for API calls related to network ACLs for the users who initiated this activity. It returns all logged API calls for network activity, pulls out the ARN that initiated each call, and collects the `eventNames` in one-hour groupings. Next, it calculates the number of API calls made per ARN per-hour. For each ARN, it calculates the average and standard deviation of this count on a per-hour basis. It also includes the number of data points for each ARN. This table is stored in a lookup file.
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for network ACLs, edit the macro `NetworkACLEvents`.
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["AWS"]
 
 [savedsearch://ESCU - Baseline of S3 Bucket deletion activity by ARN]
 type = support
 explanation = Use this search to create a baseline for API calls related to deleting an S3 bucket, grouped by the users who initiated this activity. It returns all logged API calls for S3 bucket-deletion activity and then pulls out the ARN that initiated each call. Next, it calculates the number of API calls made per ARN per hour. For each ARN, it calculates the average and standard deviation of this count on a per-hour basis. It also includes the number of data points for each ARN. This table is stored in a lookup file.
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs.
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["AWS"]
 
+[savedsearch://ESCU - Baseline of SMB Traffic - MLTK]
+type = support
+explanation = Create a machine-learning (ML) model to characterize the number of SMB connections observed in your environment. This may help identify spikes in SMB traffic that may be indicative of attackers scanning or attempting to propagate to other systems in your environment. By default, this model is built over 30 days of data and profiles the number of SMB connections in your environment by the hour of day/day of week that the connections occur.
+how_to_implement = You must be ingesting network traffic and populating the Network_Traffic data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. To improve your results, you may consider adding "src" to the by clause, which will build the model for each unique source in your enviornment. However, if you have a large number of hosts in your environment, this search may be very resource intensive. In this case, you may need to raise the value of max_inputs and/or max_groups in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.
+known_false_positives = 
+providing_technologies = ["Splunk Stream", "Bro"]
+
 [savedsearch://ESCU - Baseline of Security Group Activity by ARN]
 type = support
 explanation = Use this search to create a baseline for API calls related to security groups by the users who initiated this activity. It returns all logged API calls for all security-group-related activity, pulls out the ARN that initiated each call, and collects the `eventNames` in one-hour groupings. Next, it calculates the number of API calls made per ARN per hour. For each ARN, it calculates the average and standard deviation of this count on a per-hour basis. It also includes the number of data points for each ARN. This table is stored in a lookup file.
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for security groups, edit the macro `securityGroupAPIs`.
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["AWS"]
 
 [savedsearch://ESCU - Baseline of blocked outbound traffic from AWS]
 type = support
 explanation = Use this search to create a baseline of blocked outbound network connections by each source IP in your AWS environment. This search returns all log events that correspond to a blocked outbound network connection, extracts the source IP from where the outbound connection was initiated, and collects the events in one-hour groupings. Next, it calculates the number of outbound connections blocked per hour. For each source IP, it calculates the average and standard deviation of this count on a per-hour basis.  It also includes the number of data points each source IP had. This table is then stored in a lookup file.
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow logs.`.
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["AWS"]
 
 [savedsearch://ESCU - Count of Unique IPs Connecting to Ports]
 type = support
 explanation = For each port being accessed on the network, this search gives the total number of connections observed, and the number of unique IP addresses making those connections.
 how_to_implement = To successfully implement this search, you must be ingesting network traffic, and populating the Network_Traffic data model.
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["Splunk Stream", "Bro"]
 
 [savedsearch://ESCU - Count of assets by category]
 type = support
 explanation = This search gives you the number and the names of the hosts of each host in your environment by category. It will then sort them by the count.
 how_to_implement = To successfully implement this search you must first leverage the Assets and Identity framework in Enterprise Security to populate your assets_by_str.csv file which should then be mapped to the Identity_Management data model. The Identity_Management data model will contain a list of known authorized company assets. Ensure that all inventoried systems are constantly vetted and updated.
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["Splunk Enterprise Security"]
 
 [savedsearch://ESCU - Create a list of approved AWS service accounts]
 type = support
 explanation = We first look for all successful CloudTrail API activity caused by types of user accounts and then remove all the events caused by users in the Identity table. This generates a list of accounts--typically service accounts--configured in your AWS environment. We output this list of service accounts to `aws_service_accounts.csv`.
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the service account entires in `aws_service_accounts.csv`, which is a lookup file created as a result of running this support search. Please remove the entries of service accounts that are not legitimate.
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["AWS"]
 
 [savedsearch://ESCU - DNSTwist Domain Names]
 type = support
 explanation = This search starts with the dnstwist command consuming domains from a file called domains.csv in the DA-ESS-SOC/lookups directory. This search then adds a domain\_abuse=true term to each permutation, removes all the valid domain names and stores all that information into a lookup file that is used in the associated detection search. Alternatively domain dnstwist permutations can be calculated from domains in the `cim_corporate_email_domains.csv` and `cim_corporate_web_domains.csv` lookups located in **Splunk\_SA\_CIM** using argument `populate_from_cim=true`. Also an individual domain can be passed using argument `domain=<domain>`
 how_to_implement = To successfully implement this search you need to update the file called domains.csv in the DA-ESS-SOC/lookup directory. Or `cim_corporate_email_domains.csv` and `cim_corporate_web_domains.csv` from **Splunk\_SA\_CIM**.
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["Splunk Enterprise"]
 
 [savedsearch://ESCU - Discover DNS records]
 type = support
 explanation = Discover the DNS records and their answers for domains owned by the company using network traffic events. The discovered events are exported as a lookup named `discovered_dns_records.csv`
 how_to_implement = To successfully implement this search, you must be ingesting DNS logs, and populating the Network_Resolution data model. Also make sure that the cim_corporate_web_domains and cim_corporate_email_domains lookups are populated with the domains owned by your corporation
-known_false_positives = Please vet the lookup created by this baseline search
+known_false_positives = Please vet the lookup created by this baseline search 
 providing_technologies = ["Splunk Stream", "Bro"]
 
 [savedsearch://ESCU - Identify Systems Creating Remote Desktop Traffic]
 type = support
 explanation = This search counts the numbers of times the system has tried to connect to another system on TCP/3389, the default port used for RDP traffic.
 how_to_implement = To successfully implement this search, you must ingest network traffic and populate the Network_Traffic data model.
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["Splunk Stream", "Bro"]
 
 [savedsearch://ESCU - Identify Systems Receiving Remote Desktop Traffic]
 type = support
 explanation = This search counts the numbers of times the system has received a connection to TCP/ 3389, the default port used for RDP traffic.
 how_to_implement = To successfully implement this search you must ingest network traffic and populate the Network_Traffic data model. If a system receives a lot of remote desktop traffic, you can apply the category common_rdp_destination to it.
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["Splunk Stream", "Bro"]
 
 [savedsearch://ESCU - Identify Systems Using Remote Desktop]
 type = support
 explanation = This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system. It does this by looking for the process name in the Endpoint data model.
 how_to_implement = To successfully implement this search you must be ingesting endpoint data that records process activity.
-known_false_positives =
-providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"]
-
-[savedsearch://ESCU - Model Builder For DNS Query Length Outliers - MLTK]
-type = support
-explanation = Create a machine-learning (ML) model to characterize the length of DNS requests seen in your environment to help identify unusually long ones that may be indicative of attacker infrastrucutre or the use of DNS as a command-and-control channel in your environment.
-how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.
-known_false_positives =
-providing_technologies = ["Splunk Stream", "Bro"]
-
-[savedsearch://ESCU - Model Builder For SMB Traffic Spike - MLTK]
-type = support
-explanation = Create a machine-learning (ML) model to characterize the number of SMB connections observed in your environment. This may help identify spikes in SMB traffic that may be indicative of attackers scanning or attempting to propagate to other systems in your environment. By default, this model is built over 30 days of data and profiles the number of SMB connections in your environment by the hour of day/day of week that the connections occur.
-how_to_implement = You must be ingesting network traffic and populating the Network_Traffic data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. To improve your results, you may consider adding "src" to the by clause, which will build the model for each unique source in your enviornment. However, if you have a large number of hosts in your environment, this search may be very resource intensive. In this case, you may need to raise the value of max_inputs and/or max_groups in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.
-known_false_positives =
-providing_technologies = ["Splunk Stream", "Bro"]
-
-[savedsearch://ESCU - Model Builder For Unusually Long Command Line - MLTK]
-type = support
-explanation = Create a machine-learning (ML) model to characterize the length of the command lines used in your environment. This can help you identify unusually long ones that may indicate that attackers are executing commands on yout systems.
-how_to_implement = You must be ingesting endpoint data and populating the Endpoint data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"]
 
 [savedsearch://ESCU - Monitor Successful Backups]
 type = support
 explanation = This search gives you the count and the hostname of all the systems that had a successful backup each day.
 how_to_implement = To successfully implement this search you must be ingesting your backup logs.
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["Netbackup"]
 
 [savedsearch://ESCU - Monitor Unsuccessful Backups]
 type = support
 explanation = This search gives you the count and hostname of all the systems that had a backup failure each day
 how_to_implement = To successfully implement this search you must be ingesting your backup logs.
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["Netbackup"]
 
 [savedsearch://ESCU - Previously Seen AWS Cross Account Activity]
 type = support
 explanation = In this support search, we look for **AssumeRole** events where the requesting account is different from the requested account. The first and last times these events are seen are written to a lookup file.
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search.
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["AWS"]
 
 [savedsearch://ESCU - Previously Seen AWS Provisioning Activity Sources]
 type = support
 explanation = This search includes any event name that begins with "run" or "create," and then determines the first and last time these events were seen for each IP address that initiated the action. The search then consults a **GeoIP** database to determine the physical location of this IP address. This table outputs to a file.
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["AWS"]
 
 [savedsearch://ESCU - Previously Seen AWS Regions]
 type = support
 explanation = In this support search, we create a table of the first time (earliest) and most recent time (latest) that this region has been seen in our dataset, grouped by the value `awsRegion`. We only look for those events where an instance has been started. All of these entries will be added to the `previously_seen_aws_regions.csv` lookup file, which will act like a baseline for detections. Please validate the entries of region names in the lookup file.
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs.
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["AWS"]
 
 [savedsearch://ESCU - Previously Seen EC2 AMIs]
 type = support
 explanation = In this support search, we create a table of the earliest and latest time that a specific AMI ID has been seen. This table is then outputted to a csv file.
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs.
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["AWS"]
 
 [savedsearch://ESCU - Previously Seen EC2 Instance Types]
 type = support
 explanation = In this support search, we create a table of the earliest and latest time that a specific EC2 instance type has been seen. The instanceType request field is not required and defaults to m1.small, so any time this field is null, the search defaults the field to m1.small. This table is then outputted to a csv file.
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs.
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["AWS"]
 
 [savedsearch://ESCU - Previously Seen EC2 Launches By User]
 type = support
 explanation = In this support search, we create a table of the earliest and latest times that an ARN has launched a EC2 instance. This table is then outputted to a csv file.
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs.
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["AWS"]
 
 [savedsearch://ESCU - Previously Seen EC2 Modifications By User]
 type = support
 explanation = In this support search, we create a table of the earliest and latest times that an ARN has modified a EC2 instance. The list of APIs that modify an EC2 are defined in the `ec2ModificationAPIs` macro for ease of use. This table is then outputted to a file.
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2ModificationAPIs`.
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["AWS"]
 
 [savedsearch://ESCU - Previously Seen Running Windows Services]
 type = support
 explanation = In this support search, we look for Windows system-event code that indicates a status change of a Windows service. It extracts both the name of the service and the action taken by the service from the logs. It keeps only services that have entered the running state. Finally, it finds the first time the service has been seen running across the enterprise and writes that file to a lookup table.
 how_to_implement = While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows security-event logs for it to execute successfully.
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Previously seen API call per user roles in CloudTrail]
 type = support
 explanation = In this support search, we are looking for successful API calls made by user roles within your AWS infrastructure. The intent is to create an initial baseline cache of names of the API calls per security role for the previous 30 days--including the earliest and latest times seen in our dataset--grouped by the value of user role and the name of the API call. It is also worth noting that the role of a particular user is parsed as "userName" in the CloudTrail logs.
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user role entries in `previously_seen_api_calls_from_user_roles.csv`, which is a lookup file created as a result of running this support search.
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["AWS"]
 
 [savedsearch://ESCU - Previously seen S3 bucket access by remote IP]
 type = support
 explanation = In this support search, we are looking for successful S3 bucket-access attempts made from remote IPs. The intent is to create an initial baseline cache of remote IP addresses per bucket name for the previous 30 days--including the earliest and latest times seen in our dataset--grouped by the value of remote IP and the name of the S3 bucket.
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your S3 access-logs inputs. You must validate the remote IP and bucket name entries in `previously_seen_S3_access_from_remote_ip.csv`, which is a lookup file created as a result of running this support search.
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["AWS"]
 
 [savedsearch://ESCU - Previously seen command line arguments]
 type = support
 explanation = In this support search, we look for command-line arguments using the parameter `/c` to execute processes and create an initial baseline cache for the previous 30 days. This will include the earliest and latest times a particular command-line argument is seen in our dataset, grouped by the command-line value.
 how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the "process" field in the Endpoint data model.
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"]
 
 [savedsearch://ESCU - Previously seen users in CloudTrail]
 type = support
 explanation = In this support search, we look for console login events by a particular user and create an initial baseline cache for the previous seven days, including the earliest and latest times a particular user ARN is seen in our dataset, grouped by the ARN value.
 how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins.csv`, which is a lookup file created as a result of running this support search.
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["AWS"]
 
 [savedsearch://ESCU - Systems Ready for Spectre-Meltdown Windows Patch]
 type = support
 explanation = This search looks to see if a registry key was created at `HKLM\Software\Microsoft\Windows\CurrentVersion\QualityCompat`. It will tell you when it was created and, if possible, what process created it.
 how_to_implement = You need to be ingesting logs with both the process name and command-line from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"]
 
 [savedsearch://ESCU - Windows Updates Install Failures]
 type = support
 explanation = This search gives you the count of the number of systems that attempted and failed to install a Windows update each day.
 how_to_implement = You must be ingesting your Windows Update Logs
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["Microsoft Windows"]
 
 [savedsearch://ESCU - Windows Updates Install Successes]
 type = support
 explanation = This search gives you the count and name of all the systems that had a successful update applied each day
 how_to_implement = You must be ingesting your Windows Update Logs
-known_false_positives =
+known_false_positives = 
 providing_technologies = ["Microsoft Windows"]
 
 ### END BASELINES ###