diff --git a/detections/endpoint/ryuk_test_files_detected.yml b/detections/endpoint/ryuk_test_files_detected.yml
index 4b609b2b5f..1f9938949b 100644
--- a/detections/endpoint/ryuk_test_files_detected.yml
+++ b/detections/endpoint/ryuk_test_files_detected.yml
@@ -1,11 +1,12 @@
-name: Samsam Test File Write
-id: b26a218c-cac9-4ac1-85d7-dfa8331ca4c3
+name: Ryuk Test Files Detected
+id: 57d44d70-28d9-4ed1-acf5-1c80ae2bbce3
 version: 1
 date: '2020-11-06'
-description: The search looks for files that contain the key word *Ryuk* under any folder in the C drive, which is consistent with Samsam propagation. how_to_implement: You must be ingesting data that records the file-system activity
-  from your hosts to populate the Endpoint file-system data-model node. If you are
+description: 'The search looks for files that contain the key word *Ryuk* under any folder in the C drive, which is consistent with Samsam propagation. how_to_implement: You must be ingesting data that records the file-system activity'
+how_to_implement: 'You must be ingesting data that records the filesystem activity
+  from your hosts to populate the Endpoint Filesystem data-model object. If you are
   using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which
-  you want to collect data.
+  you want to collect data.'
 type: ESCU
 references: []
 author: Rod Soto, Jose Hernandez, Splunk
diff --git a/detections/endpoint/samsam_test_file_write.yml b/detections/endpoint/samsam_test_file_write.yml
index 4e7b278bb3..7fcdf0b8c6 100644
--- a/detections/endpoint/samsam_test_file_write.yml
+++ b/detections/endpoint/samsam_test_file_write.yml
@@ -1,5 +1,5 @@
 name: Samsam Test File Write
-id: 69c12d59-d951-431e-ab77-ec426b8d65e6
+id: 493a879d-519d-428f-8f57-a06a0fdc107e
 version: 1
 date: '2018-12-14'
 description: The search looks for a file named "test.txt" written to the windows system
diff --git a/detections/endpoint/windows_connhost_exe_force_flag.yml b/detections/endpoint/windows_connhost_exe_force_flag.yml
index fa912a9ccf..d238f63107 100644
--- a/detections/endpoint/windows_connhost_exe_force_flag.yml
+++ b/detections/endpoint/windows_connhost_exe_force_flag.yml
@@ -1,4 +1,4 @@
-name: Windows connhost.exe started forcefully
+name: Windows connhost exe started forcefully
 id: c114aaca-68ee-41c2-ad8c-32bf21db8769
 version: 1
 date: '2020-11-06'
@@ -12,20 +12,20 @@ type: ESCU
 references: []
 author: Rod Soto, Jose Hernandez, Splunk
 search: '| `sysmon` CommandLine="*C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1*" EventCode=4688 
-  | | table CommandLine, Computer, EventCode, SubjectUserSid
-  | `windows_connhost_exe_force_flag`'
+  | table CommandLine, Computer, EventCode, SubjectUserSid
+  | `windows_connhost_exe_started_forcefully_filter`'
 known_false_positives: This process should not be ran forcefully, we have not see any false positives for this detection
 tags:
   mitre_attack_id:
     - T1059.003
   analytics_story:
-  - Ryuk Ransomware
+    - Ryuk Ransomware
   kill_chain_phases:
-  - Delivery
+    - Delivery
   cis20:
-  - CIS 8
+    - CIS 8
   nist:
-  - PR.PT
-  - DE.CM
+    - PR.PT
+    - DE.CM
   security_domain: endpoint
   asset_type: Endpoint
diff --git a/detections/endpoint/windows_disableantispyware_reg.yml b/detections/endpoint/windows_disableantispyware_reg.yml
index 40a4b57954..5cf387faaf 100644
--- a/detections/endpoint/windows_disableantispyware_reg.yml
+++ b/detections/endpoint/windows_disableantispyware_reg.yml
@@ -17,7 +17,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
   | `drop_dm_object_name(Registry)` 
   | `security_content_ctime(lastTime)`
   | `security_content_ctime(firstTime)` 
-  | `windows_disableantispyware_reg_filter`'
+  | `windows_disableantispyware_registry_filter`'
 known_false_positives: It is unusual to turn this feature on a Windows system since it is a default security control, although it is not rare for some policies to disable it. 
   Although no false positives have been identified, use the provided filter macro to tune the search.
 tags:
diff --git a/detections/endpoint/windows_security_account_manager_stopped.yml b/detections/endpoint/windows_security_account_manager_stopped.yml
index 5ff408d5c9..74a6fa6acd 100644
--- a/detections/endpoint/windows_security_account_manager_stopped.yml
+++ b/detections/endpoint/windows_security_account_manager_stopped.yml
@@ -4,7 +4,6 @@ version: 1
 date: '2020-11-06'
 description: The search looks for a Windows Security Account Manager (SAM) was stopped via command-line. 
   This is consistent with Ryuk infections across a fleet of endpoints. 
-  directory tree, which is consistent with Samsam propagation.
 how_to_implement: You must be ingesting data that records the process-system activity
   from your hosts to populate the Endpoint Processes data-model object. If you are
   using Sysmon, you will need a Splunk Universal Forwarder on each endpoint from which