fixed validation errors

detections/endpoint/ryuk_test_files_detected.yml

@@ -1,11 +1,12 @@
-name: Samsam Test File Write
-id: b26a218c-cac9-4ac1-85d7-dfa8331ca4c3
+name: Ryuk Test Files Detected
+id: 57d44d70-28d9-4ed1-acf5-1c80ae2bbce3
 version: 1
 date: '2020-11-06'
-description: The search looks for files that contain the key word *Ryuk* under any folder in the C drive, which is consistent with Samsam propagation. how_to_implement: You must be ingesting data that records the file-system activity
-  from your hosts to populate the Endpoint file-system data-model node. If you are
+description: 'The search looks for files that contain the key word *Ryuk* under any folder in the C drive, which is consistent with Samsam propagation. how_to_implement: You must be ingesting data that records the file-system activity'
+how_to_implement: 'You must be ingesting data that records the filesystem activity
+  from your hosts to populate the Endpoint Filesystem data-model object. If you are
   using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
-  you want to collect data.
+  you want to collect data.'
 type: ESCU
 references: []
 author: Rod Soto, Jose Hernandez, Splunk

detections/endpoint/samsam_test_file_write.yml

@@ -1,5 +1,5 @@
 name: Samsam Test File Write
-id: 69c12d59-d951-431e-ab77-ec426b8d65e6
+id: 493a879d-519d-428f-8f57-a06a0fdc107e
 version: 1
 date: '2018-12-14'
 description: The search looks for a file named "test.txt" written to the windows system

detections/endpoint/windows_connhost_exe_force_flag.yml

@@ -1,4 +1,4 @@
-name: Windows connhost.exe started forcefully
+name: Windows connhost exe started forcefully
 id: c114aaca-68ee-41c2-ad8c-32bf21db8769
 version: 1
 date: '2020-11-06'
@@ -12,20 +12,20 @@ type: ESCU
 references: []
 author: Rod Soto, Jose Hernandez, Splunk
 search: '| `sysmon` CommandLine="*C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1*" EventCode=4688 
-  | | table CommandLine, Computer, EventCode, SubjectUserSid
-  | `windows_connhost_exe_force_flag`'
+  | table CommandLine, Computer, EventCode, SubjectUserSid
+  | `windows_connhost_exe_started_forcefully_filter`'
 known_false_positives: This process should not be ran forcefully, we have not see any false positives for this detection
 tags:
   mitre_attack_id:
     - T1059.003
   analytics_story:
-  - Ryuk Ransomware
+    - Ryuk Ransomware
   kill_chain_phases:
-  - Delivery
+    - Delivery
   cis20:
-  - CIS 8
+    - CIS 8
   nist:
-  - PR.PT
-  - DE.CM
+    - PR.PT
+    - DE.CM
   security_domain: endpoint
   asset_type: Endpoint

detections/endpoint/windows_disableantispyware_reg.yml

@@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | `drop_dm_object_name(Registry)` 
   | `security_content_ctime(lastTime)`
   | `security_content_ctime(firstTime)` 
-  | `windows_disableantispyware_reg_filter`'
+  | `windows_disableantispyware_registry_filter`'
 known_false_positives: It is unusual to turn this feature on a Windows system since it is a default security control, although it is not rare for some policies to disable it. 
   Although no false positives have been identified, use the provided filter macro to tune the search.
 tags:

detections/endpoint/windows_security_account_manager_stopped.yml

@@ -4,7 +4,6 @@ version: 1
 date: '2020-11-06'
 description: The search looks for a Windows Security Account Manager (SAM) was stopped via command-line. 
   This is consistent with Ryuk infections across a fleet of endpoints. 
-  directory tree, which is consistent with Samsam propagation.
 how_to_implement: You must be ingesting data that records the process-system activity
   from your hosts to populate the Endpoint Processes data-model object. If you are
   using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which