fixing wrong data models

Lateral Movement analytic story

detections/endpoint/executable_file_written_in_administrative_smb_share.yml

@@ -4,8 +4,7 @@ version: 2
 date: '2021-11-18'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic identifies executable files (.exe or .dll) being
   written to Windows administrative SMB shares (Admin$, IPC$, C$). This represents
   suspicious behavior as its commonly used by tools like like PsExec/PaExec and others

detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-11-18'
 author: Mauricio Velazco, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the usage of the `Enter-PSSession`. This commandlet can be used to open
   an interactive session on a remote endpoint leveraging the WinRM protocol. Red Teams

detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-11-15'
 author: Mauricio Velazco, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the execution of PowerShell with arguments utilized to start a process
   on a remote endpoint by abusing the DCOM protocol. Specifically, this search looks

detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-11-16'
 author: Mauricio Velazco, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the execution of PowerShell with arguments utilized to start a process
   on a remote endpoint by abusing the WinRM protocol. Specifically, this search looks

detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-11-15'
 author: Mauricio Velazco, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
   to identify the execution of the `Invoke-WmiMethod` commandlet with arguments utilized
   to start a process on a remote endpoint by abusing WMI. Red Teams and adversaries

detections/endpoint/windows_service_created_with_suspicious_service_path.yml

@@ -4,8 +4,7 @@ version: 2
 date: '2021-11-22'
 author: Teoderick Contreras, Mauricio Velazco, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytc uses Windows Event Id 7045, `New Service Was Installed`,
   to identify the creation of a Windows Service where the service binary path path
   is located in a non-common Service folder in Windows. Red Teams and adversaries

detections/endpoint/windows_service_created_within_public_path.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-11-22'
 author: Mauricio Velazco, Splunk
 type: TTP
-datamodel:
-- Endpoint
+datamodel: []
 description: The following analytc uses Windows Event Id 7045, `New Service Was Installed`,
   to identify the creation of a Windows Service where the service binary path is located
   in public paths. This behavior could represent the installation of a malicious service.

detections/experimental/endpoint/randomly_generated_scheduled_task_name.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-11-29'
 author: Mauricio Velazco, Splunk
 type: Hunting
-datamodel:
-- Endpoint
+datamodel: []
 description: The following hunting analytic leverages Event ID 4698, `A scheduled
   task was created`, to identify the creation of a Scheduled Task with a suspicious,
   high entropy, Task Name. To achieve this, this analytic also leverages the `ut_shannon`

detections/experimental/endpoint/randomly_generated_windows_service_name.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-11-29'
 author: Mauricio Velazco, Splunk
 type: Hunting
-datamodel:
-- Endpoint
+datamodel: []
 description: The following hunting analytic leverages Event ID 7045, `A new service
   was installed in the system`, to identify the installation of a Windows Service
   with a suspicious, high entropy, Service Name. To achieve this, this analytic also

detections/experimental/endpoint/unusual_number_of_computer_service_tickets_requested.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-12-01'
 author: Mauricio Velazco, Splunk
 type: Hunting
-datamodel:
-- Endpoint
+datamodel: []
 description: 'The following hunting analytic leverages Event ID 4769, `A Kerberos
   service ticket was requested`, to identify an unusual number of computer service
   ticket requests from one source. When a domain joined endpoint connects to a remote

detections/experimental/endpoint/unusual_number_of_remote_endpoint_authentication_events.yml

@@ -4,8 +4,7 @@ version: 1
 date: '2021-12-01'
 author: Mauricio Velazco, Splunk
 type: Hunting
-datamodel:
-- Endpoint
+datamodel: []
 description: 'The following hunting analytic leverages Event ID 4624, `An account
   was successfully logged on`, to identify an unusual number of remote authentication
   attempts coming from one source. An endpoint authenticating to a large number of