From 662e45f0a69a8aab872ff0942a26e9d8d0aef0e9 Mon Sep 17 00:00:00 2001
From: d1vious <josehelps@gmail.com>
Date: Mon, 28 Mar 2022 11:42:43 -0400
Subject: [PATCH] updating docs

---
 docs/_data/navigation.yml                     |   8 +-
 docs/_pages/data_destruction.md               |   9 ++
 docs/_pages/detections.md                     |  56 ++++----
 docs/_pages/stories.md                        |  27 ++--
 ...spectre_and_meltdown_vulnerable_systems.md |   2 +-
 ...12-detect_new_login_attempts_to_routers.md |   2 +-
 ...9-15-no_windows_updates_in_a_time_frame.md |   2 +-
 ...9-email_attachments_with_lots_of_spaces.md |   2 +-
 ...s_scanning_for_vulnerable_jboss_servers.md |   2 +-
 ...cious_requests_to_exploit_jboss_servers.md |   2 +-
 .../2017-09-23-monitor_dns_for_brand_abuse.md |   2 +-
 ...-23-monitor_web_traffic_for_brand_abuse.md |   2 +-
 .../2017-11-27-detect_usb_device_insertion.md |   2 +-
 ...018-01-05-monitor_email_for_brand_abuse.md |   2 +-
 ...detect_spike_in_security_group_activity.md |   2 +-
 ...21-detect_spike_in_network_acl_activity.md |   2 +-
 ...6-01-detect_large_outbound_icmp_packets.md |   2 +-
 ...8-11-02-windows_hosts_file_modification.md |   2 +-
 .../2018-12-03-remote_wmi_command_attempt.md  |   2 +-
 .../_posts/2018-12-03-usn_journal_deletion.md |   2 +-
 .../2018-12-06-suspicious_java_classes.md     |   2 +-
 .../2018-12-14-file_with_samsam_extension.md  |   2 +-
 .../2018-12-14-samsam_test_file_write.md      |   2 +-
 ...ide_files_directories_via_registry_keys.md |   2 +-
 ..._servers_executing_suspicious_processes.md |   2 +-
 .../2019-04-25-suspicious_file_write.md       |   2 +-
 ...5-08-unusually_long_command_line_-_mltk.md |   2 +-
 ...9-10-11-prohibited_software_on_endpoint.md |   2 +-
 ...credential_dumping_through_lsass_access.md |   2 +-
 ...-03-detect_mimikatz_using_loaded_images.md |   2 +-
 ...6-access_lsass_memory_for_dump_creation.md |   2 +-
 ...9-12-06-create_remote_thread_into_lsass.md |   2 +-
 ...19-12-06-unsigned_image_loaded_by_lsass.md |   2 +-
 .../2019-12-10-creation_of_shadow_copy.md     |   2 +-
 ...-01-22-dns_query_length_outliers_-_mltk.md |   2 +-
 ...0-01-28-auto_admin_logon_registry_entry.md |   1 +
 ...onitor_registry_keys_for_print_monitors.md |   1 +
 ...gistry_keys_for_creating_shim_databases.md |   1 +
 docs/_posts/2020-01-28-sdclt_uac_bypass.md    |   7 +-
 .../2020-01-28-silentcleanup_uac_bypass.md    |   7 +-
 docs/_posts/2020-01-28-wsreset_uac_bypass.md  |   7 +-
 ...-03-creation_of_lsass_dump_with_taskmgr.md |   2 +-
 ...20-02-07-macos_-_re-opened_applications.md |   2 +-
 .../2020-02-20-gcp_gcr_container_uploaded.md  |   6 +-
 ...02-20-new_container_uploaded_to_aws_ecr.md |   6 +-
 .../2020-02-21-dump_lsass_via_comsvcs_dll.md  |   4 +-
 ...03-02-remote_registry_key_modifications.md |   2 +-
 ...20-03-16-child_processes_of_spoolsv_exe.md |   2 +-
 .../2020-03-16-detect_rare_executables.md     |   2 +-
 .../2020-03-16-process_execution_via_wmi.md   |   2 +-
 .../2020-03-16-script_execution_via_wmi.md    |   2 +-
 ...n_eks_kubernetes_cluster_scan_detection.md |   2 +-
 ...mazon_eks_kubernetes_pod_scan_detection.md |   2 +-
 ...0-first_time_seen_child_process_of_zoom.md |   2 +-
 ...interception_by_creation_of_program_exe.md |   2 +-
 ...2020-07-06-short_lived_windows_accounts.md |   2 +-
 .../2020-07-06-windows_event_log_cleared.md   |   2 +-
 ...20-07-07-remote_desktop_network_traffic.md |   2 +-
 ...-07-21-attempt_to_stop_security_service.md |   2 +-
 ..._to_phishing_sites_leveraging_evilginx2.md |  10 +-
 ...-detect_excessive_user_account_lockouts.md |   2 +-
 ...-21-detect_long_dns_txt_record_response.md |   2 +-
 .../2020-07-21-detect_outbound_smb_traffic.md |   2 +-
 ...1-detect_outlook_exe_writing_a_zip_file.md |   2 +-
 ...f_cmd_exe_to_launch_script_interpreters.md |   2 +-
 ...web_traffic_to_dynamic_domain_providers.md |   2 +-
 ...-21-detection_of_tools_built_by_nirsoft.md |   2 +-
 ...ce_modified_with_previously_unseen_user.md |   2 +-
 ...ritten_outside_of_the_outlook_directory.md |   2 +-
 ...1-first_time_seen_command_line_argument.md |   2 +-
 ...g_files_and_directories_with_attrib_exe.md |   2 +-
 ...7-21-overwriting_accessibility_binaries.md |   2 +-
 ...7-21-prohibited_network_traffic_allowed.md |   2 +-
 .../2020-07-21-protocol_or_port_mismatch.md   |   2 +-
 ...emote_desktop_process_running_on_system.md |   2 +-
 ...21-sc_exe_manipulating_windows_services.md |   2 +-
 ...uled_tasks_used_in_badrabbit_ransomware.md |   2 +-
 ...suspicious_changes_to_file_associations.md |   2 +-
 ...20-07-22-suspicious_email_-_uba_anomaly.md |   2 +-
 ...-suspicious_email_attachment_extensions.md |   2 +-
 .../2020-07-22-suspicious_reg_exe_process.md  |   2 +-
 ...ous_writes_to_system_volume_information.md |   2 +-
 docs/_posts/2020-07-22-tor_traffic.md         |   2 +-
 ...20-07-22-uncommon_processes_on_endpoint.md |   2 +-
 .../2020-07-22-unload_sysmon_filter_driver.md |   2 +-
 ...ct_windows_dns_sigred_via_splunk_stream.md |   2 +-
 ...ance_modified_by_previously_unseen_user.md |   2 +-
 .../_posts/2020-08-11-detect_arp_poisoning.md |   8 +-
 .../2020-08-11-detect_rogue_dhcp_server.md    |   8 +-
 ..._or_delete_windows_shares_using_net_exe.md |   2 +-
 ...ect_ipv6_network_infrastructure_threats.md |   8 +-
 ...20-10-28-detect_port_security_violation.md |   8 +-
 ...ect_software_download_to_network_device.md |   2 +-
 .../2020-10-28-detect_traffic_mirroring.md    |   2 +-
 .../2020-11-06-ryuk_test_files_detected.md    |   2 +-
 ...windows_connhost_exe_started_forcefully.md |   2 +-
 ...indows_security_account_manager_stopped.md |   2 +-
 ...2020-11-09-common_ransomware_extensions.md |   4 +-
 .../2020-11-09-common_ransomware_notes.md     |   4 +-
 .../2020-11-09-deleting_shadow_copies.md      |   2 +-
 ...xcessive_account_lockouts_from_endpoint.md |   2 +-
 ..._system_network_configuration_discovery.md |   2 +-
 ...rohibited_applications_spawning_cmd_exe.md |   4 +-
 ...8-disabling_remote_user_account_control.md |   7 +-
 ...cution_of_file_with_multiple_extensions.md |   2 +-
 ...on_of_file_with_spaces_before_extension.md |   2 +-
 .../2020-11-23-processes_created_by_netsh.md  |   2 +-
 ...installation_with_suspicious_parameters.md |   2 +-
 ...pulating_windows_services_registry_keys.md |   2 +-
 ...2-07-schtasks_used_for_forcing_a_reboot.md |   2 +-
 .../2020-12-08-shim_database_file_creation.md |   2 +-
 ...12-08-single_letter_process_on_endpoint.md |   2 +-
 ...processes_run_from_unexpected_locations.md |   2 +-
 .../2020-12-08-unusually_long_command_line.md |   2 +-
 ...burst_correlation_dll_and_network_event.md |   2 +-
 ...1-bcdedit_failure_recovery_modification.md |   2 +-
 ...cious_microsoft_workflow_compiler_usage.md |   2 +-
 .../2021-01-12-suspicious_msbuild_rename.md   |   2 +-
 .../2021-01-12-suspicious_msbuild_spawn.md    |   2 +-
 ...21-01-12-suspicious_mshta_child_process.md |   2 +-
 ..._connecting_to_dynamic_domain_providers.md |   2 +-
 ...cious_powershell_command-line_arguments.md |   2 +-
 ...20-detect_rundll32_inline_hta_execution.md |   4 +-
 .../2021-01-20-suspicious_mshta_spawn.md      |   2 +-
 ...021-01-22-wbadmin_delete_system_backups.md |   2 +-
 ...021-01-25-nltest_domain_trust_discovery.md |   2 +-
 ...-26-certutil_exe_certificate_extraction.md |   2 +-
 ...1-01-26-o365_excessive_sso_logon_errors.md |   3 +-
 .../_posts/2021-01-26-revil_registry_entry.md |   1 +
 ...ect_regsvr32_application_control_bypass.md |   2 +-
 .../_posts/2021-01-28-ntdsutil_export_ntds.md |   2 +-
 ...cious_regsvr32_register_suspicious_path.md |   2 +-
 ...21-02-01-dump_lsass_via_procdump_rename.md |   2 +-
 ...32_application_control_bypass_-_advpack.md |   4 +-
 ...2_application_control_bypass_-_setupapi.md |   4 +-
 ...2_application_control_bypass_-_syssetup.md |   4 +-
 .../2021-02-04-suspicious_rundll32_startw.md  |   4 +-
 ...9-suspicious_rundll32_dllregisterserver.md |   4 +-
 ...11-detect_html_help_spawn_child_process.md |   2 +-
 ...-02-12-detect_regasm_spawning_a_process.md |   2 +-
 ...02-12-detect_regsvcs_spawning_a_process.md |   2 +-
 .../2021-02-22-cobalt_strike_named_pipes.md   |   2 +-
 ...2-22-suspicious_curl_network_connection.md |   2 +-
 .../2021-02-22-suspicious_plistbuddy_usage.md |   2 +-
 ...uspicious_sqlite3_lsquarantine_behavior.md |   2 +-
 .../_posts/2021-03-01-fodhelper_uac_bypass.md |   8 +-
 .../2021-03-01-ryuk_wake_on_lan_command.md    |   2 +-
 ...us_scheduled_task_from_public_directory.md |   2 +-
 ...ed_messaging_service_spawning_a_process.md |   2 +-
 ...-02-windows_disableantispyware_registry.md |   3 +-
 docs/_posts/2021-03-03-w3wp_spawning_shell.md |   2 +-
 ...21-03-12-ransomware_notes_bulk_creation.md |   2 +-
 .../2021-03-12-resize_shadowstorage_volume.md |   2 +-
 ...3-16-high_process_termination_frequency.md |   2 +-
 ...16-windows_high_file_deletion_frequency.md |   2 +-
 .../2021-03-17-clop_common_exec_parameter.md  |   2 +-
 ...3-17-clop_ransomware_known_service_name.md |   2 +-
 ...021-03-23-certutil_with_decode_argument.md |   2 +-
 ...021-03-31-disabling_firewall_with_netsh.md |   2 +-
 .../2021-03-31-dsquery_domain_discovery.md    |   2 +-
 ...icious_powershell_executed_as_a_service.md |   2 +-
 ...4-12-excel_spawning_windows_script_host.md |   2 +-
 ...12-winword_spawning_windows_script_host.md |   2 +-
 ...fice_application_spawn_rundll32_process.md |   4 +-
 ...-office_document_creating_schedule_task.md |   2 +-
 ...14-office_document_executing_macro_code.md |   2 +-
 ...-15-dns_exfiltration_using_nslookup_app.md |   2 +-
 ..._remote_thread_to_known_windows_process.md |   2 +-
 ...ess_connecting_to_ip_check_web_services.md |   2 +-
 ...9-wermgr_process_create_executable_file.md |   2 +-
 ...ocess_spawned_cmd_or_powershell_process.md |   2 +-
 ...1-04-21-excessive_usage_of_nslookup_app.md |   2 +-
 ...ultiple_archive_files_http_post_traffic.md |   2 +-
 .../2021-04-22-anomalous_usage_of_7zip.md     |   2 +-
 ...e_product_spawning_rundll32_with_no_dll.md |   4 +-
 ...-04-22-plain_http_post_exfiltrated_data.md |   2 +-
 .../_posts/2021-04-22-winword_spawning_cmd.md |   2 +-
 ...-04-26-office_product_spawning_certutil.md |   2 +-
 ...021-04-26-office_product_spawning_mshta.md |   2 +-
 docs/_posts/2021-04-26-trickbot_named_pipe.md |   2 +-
 docs/_posts/2021-04-29-icacls_deny_command.md |   2 +-
 ...021-04-29-suspicious_driver_loaded_path.md |   2 +-
 docs/_posts/2021-04-29-xmrig_driver_loaded.md |   2 +-
 .../2021-05-04-deleting_of_net_users.md       |   2 +-
 .../2021-05-04-disabling_net_user_account.md  |   2 +-
 ...4-excessive_attempt_to_disable_services.md |   2 +-
 ...21-05-04-excessive_service_stop_attempt.md |   2 +-
 .../2021-05-04-excessive_usage_of_taskkill.md |   2 +-
 .../_posts/2021-05-04-icacls_grant_command.md |   2 +-
 ...21-05-04-process_kill_base_on_file_path.md |   2 +-
 ...2021-05-05-suspicious_process_file_path.md |   4 +-
 ...021-05-06-download_files_using_telegram.md |   2 +-
 .../2021-05-06-excessive_usage_of_net_app.md  |   2 +-
 ...s_or_script_creation_in_suspicious_path.md |   4 +-
 ...2021-05-07-excessive_usage_of_cacls_app.md |   2 +-
 .../2021-05-07-schtasks_run_task_on_demand.md |   2 +-
 ...2021-05-13-cmlua_or_cmstplua_uac_bypass.md |   2 +-
 docs/_posts/2021-05-13-slui_runas_elevated.md |   8 +-
 .../2021-05-13-slui_spawning_a_process.md     |   8 +-
 .../2021-05-18-services_escalate_exe.md       |   2 +-
 .../2021-05-20-cmd_echo_pipe_-_escalation.md  |   2 +-
 .../2021-05-21-winrm_spawning_a_process.md    |   2 +-
 ...6-secretdumps_offline_ntds_dumping_tool.md |   2 +-
 ...27-detect_sharphound_file_modifications.md |   2 +-
 .../2021-05-27-detect_sharphound_usage.md     |   2 +-
 ...etect_azurehound_command-line_arguments.md |   2 +-
 ...01-detect_azurehound_file_modifications.md |   2 +-
 ...etect_sharphound_command-line_arguments.md |   2 +-
 .../2021-06-02-conti_common_exec_parameter.md |   2 +-
 .../2021-06-02-modification_of_wallpaper.md   |   3 +-
 .../2021-06-02-revil_common_exec_parameter.md |   2 +-
 ...021-06-02-wbemprox_com_object_execution.md |   2 +-
 ...-04-known_services_killed_by_ransomware.md |   2 +-
 ...-excessive_number_of_taskhost_processes.md |   2 +-
 ...ear_unallocated_sector_using_cipher_app.md |   2 +-
 .../2021-06-10-disable_logs_using_wevtutil.md |   2 +-
 ...rmission_modification_using_takeown_app.md |   2 +-
 ...ent_automatic_repair_mode_using_bcdedit.md |   2 +-
 ...tect_wmi_event_subscription_persistence.md |   2 +-
 ...ecute_javascript_with_jscript_com_clsid.md |   2 +-
 ...ursive_delete_of_directory_in_batch_cmd.md |   2 +-
 ...w_file_and_printing_sharing_in_firewall.md |   2 +-
 ...-23-allow_network_discovery_in_firewall.md |   2 +-
 ...4-excessive_usage_of_sc_service_utility.md |   2 +-
 ...er_of_service_control_start_as_disabled.md |   2 +-
 ...1-print_spooler_adding_a_printer_driver.md |   2 +-
 ...-print_spooler_failed_to_load_a_plug-in.md |   2 +-
 .../2021-07-01-spoolsv_spawning_rundll32.md   |   4 +-
 ...07-01-spoolsv_suspicious_loaded_modules.md |   2 +-
 ...07-01-spoolsv_suspicious_process_access.md |   2 +-
 ...21-07-01-spoolsv_writing_a_dll_-_sysmon.md |   2 +-
 ...05-msmpeng_application_dll_side_loading.md |   2 +-
 ...-07-12-uac_bypass_mmc_load_unsigned_dll.md |   8 +-
 ...tance_created_by_previously_unseen_user.md |   2 +-
 ...a_spawning_rundll32_or_regsvr32_process.md |   4 +-
 ...-07-19-office_product_spawn_cmd_process.md |   2 +-
 ...-rundll32_createremotethread_in_browser.md |   2 +-
 ...rundll32_process_creating_exe_dll_files.md |   2 +-
 ...7-26-suspicious_icedid_rundll32_cmdline.md |   4 +-
 ...21-07-26-suspicious_rundll32_plugininit.md |   4 +-
 .../2021-07-27-chcp_command_execution.md      |   2 +-
 ...gsvr32_with_known_silent_switch_cmdline.md |   2 +-
 ...dll32_create_remote_thread_to_a_process.md |   2 +-
 .../2021-07-30-drop_icedid_license_dat.md     |   2 +-
 ...edid_exfiltrated_archived_file_creation.md |   2 +-
 ...fice_application_spawn_regsvr32_process.md |   2 +-
 ...2021-08-03-sqlite_module_in_temp_folder.md |   2 +-
 ...eate_remote_thread_in_shell_application.md |   2 +-
 .../2021-08-09-uninstall_app_using_msiexec.md |   2 +-
 docs/_posts/2021-08-11-fsutil_zeroing_file.md |   2 +-
 ...8-13-uac_bypass_with_colorui_com_object.md |   2 +-
 ...16-gsuite_drive_share_in_external_email.md |   2 +-
 ...8-16-gsuite_email_suspicious_attachment.md |   2 +-
 ...8-17-7zip_commandline_to_smb_share_path.md |   2 +-
 ...mail_with_attachment_to_external_domain.md |   2 +-
 docs/_posts/2021-08-18-esentutl_sam_copy.md   |   2 +-
 ...9-aws_ecr_container_upload_unknown_user.md |   2 +-
 ...mail_suspicious_subject_with_attachment.md |   2 +-
 ...ols_passing_authentication_in_cleartext.md |   2 +-
 ...1-08-20-github_commit_changes_in_master.md |   2 +-
 ...2021-08-23-getlocaluser_with_powershell.md |   2 +-
 ...twmiobject_user_account_with_powershell.md |   2 +-
 ...email_with_known_abuse_web_service_link.md |   2 +-
 ...8-23-gsuite_suspicious_shared_file_name.md |   2 +-
 ...4-domain_account_discovery_with_dsquery.md |   2 +-
 ...4-domain_account_discovery_with_net_app.md |   2 +-
 ...8-24-domain_account_discovery_with_wmic.md |   2 +-
 ...1-08-24-get-domaintrust_with_powershell.md |   2 +-
 .../2021-08-24-get_aduser_with_powershell.md  |   2 +-
 ...21-08-24-get_domainuser_with_powershell.md |   2 +-
 ...24-getwmiobject_ds_user_with_powershell.md |   2 +-
 ...-08-24-kubernetes_scanner_image_pulling.md |   2 +-
 ...1-08-25-domain_group_discovery_with_net.md |   2 +-
 ...-08-25-domain_group_discovery_with_wmic.md |   2 +-
 ...08-25-elevated_group_discovery_with_net.md |   2 +-
 ...8-25-elevated_group_discovery_with_wmic.md |   2 +-
 .../2021-08-25-getadgroup_with_powershell.md  |   2 +-
 ...21-08-25-getdomaingroup_with_powershell.md |   2 +-
 ...-25-getnettcpconnection_with_powershell.md |   2 +-
 ...5-getwmiobject_ds_group_with_powershell.md |   2 +-
 ...ultdomainpasswordpolicy_with_powershell.md |   2 +-
 ...resultantpasswordpolicy_with_powershell.md |   2 +-
 ...-08-26-get_domainpolicy_with_powershell.md |   2 +-
 ...8-26-password_policy_discovery_with_net.md |   2 +-
 ...reating_lnk_file_in_suspicious_location.md |   2 +-
 ...domain_controller_discovery_with_nltest.md |   2 +-
 ...-08-30-remote_system_discovery_with_net.md |   2 +-
 ...31-remote_system_discovery_with_dsquery.md |   2 +-
 ...1-domain_controller_discovery_with_wmic.md |   2 +-
 ...-01-domain_group_discovery_with_dsquery.md |   2 +-
 .../2021-09-01-github_commit_in_develop.md    |   2 +-
 .../2021-09-01-github_dependabot_alert.md     |   2 +-
 ...1-github_pull_request_from_unknown_user.md |   2 +-
 ...09-01-remote_system_discovery_with_wmic.md |   2 +-
 ...1-09-02-get-foresttrust_with_powershell.md |   2 +-
 ...cdedit_command_back_to_normal_mode_boot.md |   2 +-
 ...change_to_safe_mode_with_network_config.md |   2 +-
 ...021-09-07-getadcomputer_with_powershell.md |   2 +-
 ...09-07-getdomaincomputer_with_powershell.md |   2 +-
 ...-07-getdomaincontroller_with_powershell.md |   2 +-
 ...etwmiobject_ds_computer_with_powershell.md |   2 +-
 ...e_by_app_connect_and_create_adsi_object.md |   2 +-
 ...-system_information_discovery_detection.md |   2 +-
 ...l_loading_from_world_writable_directory.md |   2 +-
 ...eate_local_admin_accounts_using_net_exe.md |   2 +-
 .../2021-09-08-office_spawning_control.md     |   2 +-
 ...2021-09-08-rundll32_control_rundll_hunt.md |   4 +-
 ...control_rundll_world_writable_directory.md |   4 +-
 ...2021-09-09-extraction_of_registry_hives.md |   2 +-
 ...09-mshtml_module_load_in_office_product.md |   2 +-
 ...0-network_connection_discovery_with_arp.md |   2 +-
 ...0-network_connection_discovery_with_net.md |   2 +-
 ...twork_connection_discovery_with_netstat.md |   2 +-
 ...1-09-13-getcurrent_user_with_powershell.md |   2 +-
 ...-13-jscript_execution_using_cscript_app.md |   8 +-
 ...s_scripting_process_loading_ldap_module.md |   8 +-
 ...ms_scripting_process_loading_wmi_module.md |   8 +-
 ...-09-13-system_user_discovery_with_query.md |   2 +-
 ...09-13-system_user_discovery_with_whoami.md |   2 +-
 ...user_discovery_with_env_vars_powershell.md |   2 +-
 ...21-09-13-xsl_script_execution_with_wmic.md |   2 +-
 ...-cmdline_tool_not_executed_in_cmd_shell.md |   8 +-
 ...021-09-14-get_wmiobject_group_discovery.md |   2 +-
 .../2021-09-14-net_localgroup_discovery.md    |   2 +-
 ...-14-powershell_get_localgroup_discovery.md |   2 +-
 .../_posts/2021-09-14-wmic_group_discovery.md |   2 +-
 ...1-09-15-check_elevated_cmd_using_whoami.md |   2 +-
 ...21-09-16-account_discovery_with_net_app.md |   2 +-
 ...t_to_add_certificate_to_untrusted_store.md |   2 +-
 ...edential_dump_from_registry_via_reg_exe.md |   5 +-
 ...of_shadow_copy_with_wmic_and_powershell.md |   4 +-
 ...mping_via_copy_command_from_shadow_copy.md |   2 +-
 ...tial_dumping_via_symlink_to_shadow_copy.md |   2 +-
 .../2021-09-16-detect_html_help_renamed.md    |   4 +-
 ...16-detect_html_help_url_in_command_line.md |   4 +-
 ...ml_help_using_infotech_storage_handlers.md |   4 +-
 ...09-16-detect_mshta_inline_hta_execution.md |   2 +-
 .../_posts/2021-09-16-detect_mshta_renamed.md |   2 +-
 ...-09-16-detect_mshta_url_in_command_line.md |   2 +-
 ...9-16-detect_psexec_with_accepteula_flag.md |   2 +-
 .../_posts/2021-09-16-detect_renamed_7-zip.md |   2 +-
 .../2021-09-16-detect_renamed_psexec.md       |   2 +-
 .../2021-09-16-detect_renamed_rclone.md       |   2 +-
 .../2021-09-16-detect_renamed_winrar.md       |   2 +-
 .../2021-09-16-dump_lsass_via_procdump.md     |   2 +-
 ...-09-16-local_account_discovery_with_net.md |   2 +-
 ...09-16-local_account_discovery_with_wmic.md |   2 +-
 ...2021-09-16-office_product_spawning_wmic.md |   2 +-
 .../2021-09-16-processes_launching_netsh.md   |   2 +-
 ...ument_spawned_child_process_to_download.md |   2 +-
 ...ious_microsoft_workflow_compiler_rename.md |   2 +-
 ...mcos_rat_file_creation_in_remcos_folder.md |   2 +-
 ...1-09-27-change_default_file_association.md |   3 +-
 ...27-logon_script_event_trigger_execution.md |   2 +-
 ...-27-screensaver_event_trigger_execution.md |   3 +-
 ...9-28-print_processor_registry_autostart.md |   2 +-
 .../2021-09-29-verclsid_clsid_execution.md    |   2 +-
 ...01-vbscript_execution_using_wscript_app.md |   2 +-
 ...ld_suspicious_spawned_by_script_process.md |   2 +-
 ...32_silent_and_install_param_dll_loading.md |   3 +-
 ...5-malicious_inprocserver32_modification.md |   2 +-
 ...1-10-05-process_writing_dynamicwrapperx.md |   2 +-
 .../2021-10-05-rundll32_shimcache_flush.md    |   4 +-
 .../2021-10-05-suspicious_copy_on_system32.md |   2 +-
 .../2021-10-05-winhlp32_spawning_a_process.md |   2 +-
 ...ipt_or_cscript_suspicious_child_process.md |   2 +-
 .../2021-10-11-suspicious_wevtutil_usage.md   |   2 +-
 ...iceprincipalnames_discovery_with_setspn.md |   2 +-
 .../2021-10-18-disable_schedule_task.md       |   2 +-
 ...indows_curl_download_to_suspicious_path.md |   4 +-
 ...-wmic_noninteractive_app_uninstallation.md |   2 +-
 docs/_posts/2021-11-03-windows_adfind_exe.md  |   2 +-
 .../2021-11-04-attacker_tools_on_endpoint.md  |   2 +-
 ...ndows_curl_upload_to_remote_destination.md |   4 +-
 ...ows_service_creation_on_remote_endpoint.md |   2 +-
 ...s_service_initiation_on_remote_endpoint.md |   2 +-
 ...ocess_instantiation_via_winrm_and_winrs.md |   2 +-
 ...sk_creation_on_remote_endpoint_using_at.md |   2 +-
 ...uled_task_initiation_on_remote_endpoint.md |   2 +-
 ...chtasks_scheduling_job_on_remote_system.md |   2 +-
 .../2021-11-11-wmic_xsl_execution_via_url.md  |   2 +-
 ...21-11-12-csc_net_on_the_fly_compilation.md |   2 +-
 ...1-11-12-firewall_allowed_program_enable.md |   2 +-
 ...twork_discovery_using_route_windows_app.md |   2 +-
 ...12-remote_process_instantiation_via_wmi.md |   2 +-
 ...21-11-12-runas_execution_in_commandline.md |   2 +-
 ...12-windows_installutil_credential_theft.md |   2 +-
 ...12-windows_installutil_uninstall_option.md |   2 +-
 ...windows_installutil_url_in_command_line.md |   2 +-
 .../2021-11-15-windows_diskcryptor_usage.md   |   2 +-
 ...2021-11-17-windows_dism_remove_defender.md |   2 +-
 ...ile_written_in_administrative_smb_share.md |   1 +
 .../2021-11-18-loading_of_dynwrapx_module.md  |   2 +-
 ...info_gathering_using_dxdiag_application.md |   2 +-
 ...22-possible_browser_pass_view_parameter.md |   2 +-
 ...services_lolbas_execution_process_spawn.md |   2 +-
 ...-svchost_lolbas_execution_process_spawn.md |   2 +-
 ...ce_created_with_suspicious_service_path.md |   2 +-
 ...dows_service_created_within_public_path.md |   2 +-
 ...wmiprsve_lolbas_execution_process_spawn.md |   2 +-
 ...provhost_lolbas_execution_process_spawn.md |   2 +-
 ...1-23-mmc_lolbas_execution_process_spawn.md |   2 +-
 ...5-add_or_set_windows_defender_exclusion.md |   2 +-
 ...-11-29-detect_rclone_command-line_usage.md |   2 +-
 ...sible_lateral_movement_powershell_spawn.md |   2 +-
 ...-06-suspicious_linux_discovery_commands.md |   2 +-
 ...windows_raccine_scheduled_task_deletion.md |   2 +-
 ...-msi_module_loaded_by_non-system_binary.md |   2 +-
 ...-12-10-curl_download_and_bash_execution.md |   2 +-
 ...-12-11-wget_download_and_bash_execution.md |   2 +-
 ...load_injection_with_outbound_connection.md |   2 +-
 ...onnection_from_java_using_default_ports.md |   2 +-
 ...2021-12-13-windows_java_spawning_shells.md |   2 +-
 ..._add_files_in_known_crontab_directories.md |   2 +-
 ...-17-linux_at_allow_config_file_creation.md |   2 +-
 ...21-12-17-linux_at_application_execution.md |   2 +-
 ...1-12-17-linux_edit_cron_table_parameter.md |   2 +-
 ..._append_command_to_at_allow_config_file.md |   2 +-
 ..._cronjob_entry_on_existing_cronjob_file.md |   2 +-
 ...ssible_cronjob_modification_with_editor.md |   2 +-
 ...ux_file_creation_in_init_boot_directory.md |   8 +-
 ...inux_file_creation_in_profile_directory.md |   8 +-
 ...e_append_command_to_profile_config_file.md |   8 +-
 ...rvice_file_created_in_systemd_directory.md |   2 +-
 .../2021-12-20-linux_service_restarted.md     |   2 +-
 ...-12-20-linux_service_started_or_enabled.md |   2 +-
 .../2021-12-21-linux_add_user_account.md      |   2 +-
 ...1-12-21-linux_change_file_owner_to_root.md |   2 +-
 ...21-linux_nopasswd_entry_in_sudoers_file.md |   2 +-
 ...-12-21-linux_setuid_using_chmod_utility.md |   2 +-
 ...12-21-linux_setuid_using_setcap_utility.md |   2 +-
 ...21-12-21-linux_visudo_utility_execution.md |   2 +-
 ...file_created_in_kernel_driver_directory.md |   2 +-
 ...sert_kernel_module_using_insmod_utility.md |   2 +-
 ...ll_kernel_module_using_modprobe_utility.md |   2 +-
 ...2-22-linux_preload_hijack_library_calls.md |   8 +-
 ...ux_common_process_for_elevation_control.md |   2 +-
 ...1-12-23-linux_sudoers_tmp_file_creation.md |   2 +-
 .../2022-01-04-linux_sudo_or_su_execution.md  |   2 +-
 ...022-01-05-linux_doas_conf_file_creation.md |   2 +-
 .../2022-01-05-linux_doas_tool_execution.md   |   2 +-
 ...nux_possible_access_to_credential_files.md |   2 +-
 ...0-linux_possible_access_to_sudoers_file.md |   2 +-
 ...ess_or_modification_of_sshd_config_file.md |   2 +-
 ...11-linux_possible_ssh_key_file_creation.md |   2 +-
 ..._hunting_system_account_targeting_lsass.md |   2 +-
 ...dows_non-system_account_targeting_lsass.md |   2 +-
 ...tentially_malicious_code_on_commandline.md |   2 +-
 ...-cmd_carry_out_string_command_parameter.md |   3 +-
 ...lateral_movement_commandline_parameters.md |   2 +-
 ...cess_dns_query_known_abuse_web_services.md |   2 +-
 ...spicious_process_with_discord_dns_query.md |   2 +-
 ...dows_dotnet_binary_in_non_standard_path.md |   2 +-
 ...indows_installutil_in_non_standard_path.md |   2 +-
 ...ive_file_deletion_in_windefender_folder.md |   2 +-
 .../2022-01-20-ping_sleep_batch_command.md    |   2 +-
 .../2022-01-21-windows_nirsoft_advancedrun.md |   2 +-
 .../2022-01-24-windows_nirsoft_utilities.md   |   2 +-
 ...bound_traffic_by_firewall_rule_registry.md |   1 +
 ...1-26-allow_operation_with_consent_admin.md |   1 +
 ...022-01-26-disable_amsi_through_registry.md |   1 +
 ...-26-disable_defender_antivirus_registry.md |   1 +
 ...sable_defender_blockatfirstseen_feature.md |   1 +
 ...-disable_defender_enhanced_notification.md |   1 +
 ...1-26-disable_defender_mpengine_registry.md |   1 +
 ...01-26-disable_defender_spynet_reporting.md |   1 +
 ...defender_submit_samples_consent_feature.md |   1 +
 ...6-log4shell_cve-2021-44228_exploitation.md |   2 +-
 ...1-26-registry_keys_used_for_persistence.md |   1 +
 ...stry_keys_used_for_privilege_escalation.md |   1 +
 ...26-remcos_client_registry_install_entry.md |   2 +
 ...1-26-time_provider_persistence_registry.md |   1 +
 ...2022-01-27-disable_etw_through_registry.md |   1 +
 .../2022-01-27-disable_registry_tool.md       |   1 +
 ...ble_security_logs_using_minint_registry.md |   1 +
 .../2022-01-27-disable_show_hidden_files.md   |   1 +
 ...22-01-27-disable_uac_remote_restriction.md |   7 +-
 .../2022-01-27-disable_windows_app_hotkeys.md |   1 +
 ...-27-disable_windows_behavior_monitoring.md |   1 +
 ...-disable_windows_smartscreen_protection.md |   1 +
 .../2022-01-27-disabling_cmd_application.md   |   1 +
 .../2022-01-27-disabling_controlpanel.md      |   1 +
 ...-27-windows_possible_credential_dumping.md |   2 +-
 .../2022-01-28-disabling_defender_services.md |   1 +
 ...disabling_folderoptions_windows_feature.md |   1 +
 .../2022-01-28-disabling_norun_windows_app.md |   1 +
 ...-28-disabling_systemrestore_in_registry.md |  14 +-
 .../2022-01-28-disabling_task_manager.md      |   1 +
 ...2-01-28-enable_rdp_in_other_port_number.md |   1 +
 ...ble_wdigest_uselogoncredential_registry.md |   1 +
 .../2022-01-28-etw_registry_disabled.md       |   1 +
 docs/_posts/2022-01-28-eventvwr_uac_bypass.md |   7 +-
 ...8-hide_user_account_from_sign-in_screen.md |   1 +
 ...01-28-linux_pkexec_privilege_escalation.md |   2 +-
 ...tz_passtheticket_commandline_parameters.md |   2 +-
 ...22-02-01-rubeus_command_line_parameters.md |   2 +-
 .../2022-02-01-suspicious_rundll32_rename.md  |   4 +-
 ...nload_with_urlcache_and_split_arguments.md |   2 +-
 ...load_with_verifyctl_and_split_arguments.md |   2 +-
 docs/_posts/2022-02-03-o365_disable_mfa.md    |   3 +-
 ..._ticket_exports_through_winlogon_access.md |   2 +-
 ...dows_remote_assistance_spawning_process.md |   2 +-
 ...7-windows_schtasks_create_run_as_system.md |   2 +-
 ...022-02-08-rundll_loading_dll_by_ordinal.md |   4 +-
 .../2022-02-14-linux_dd_file_overwrite.md     |   2 +-
 ...2-15-windows_diskshadow_proxy_execution.md |   2 +-
 ...22-02-15-windows_rasautou_dll_execution.md |   2 +-
 ...-17-windows_disable_notification_center.md |   1 +
 ..._raw_access_to_master_boot_record_drive.md |   4 +-
 ...8-detect_regasm_with_network_connection.md |   2 +-
 ...-detect_regsvcs_with_network_connection.md |   2 +-
 .../2022-02-18-net_profiler_uac_bypass.md     |   8 +-
 ...-process_deleting_its_process_file_path.md |   2 +-
 docs/_posts/2022-02-18-rundll32_dnsquery.md   |   2 +-
 ...cution_policy_to_unrestricted_or_bypass.md |   2 +-
 ...heduled_task_deleted_or_created_via_cmd.md |   2 +-
 ...2-02-22-windows_wmi_process_call_create.md |   2 +-
 ...2-23-windows_event_for_service_disabled.md |   2 +-
 ...ndows_excessive_disabled_services_event.md |   2 +-
 ...dows_process_with_namedpipe_commandline.md |   2 +-
 ...s_service_creation_using_registry_entry.md |   1 +
 ...02-25-windows_disable_memory_crash_dump.md |   1 +
 ...le_without_extension_in_critical_folder.md |   2 +-
 ...ows_raw_access_to_disk_volume_partition.md |   3 +-
 ...ve_distinct_processes_from_windows_temp.md |   2 +-
 ...ow_compress_color_and_info_tip_registry.md |   2 +
 .../2022-03-08-suspicious_msbuild_path.md     | 134 ++++++++++++++++++
 ...isable_change_password_through_registry.md |   3 +-
 ...ck_workstation_feature_through_registry.md |   1 +
 ..._disable_logoff_button_through_registry.md |   1 +
 ...isable_shutdown_button_through_registry.md |   1 +
 ..._group_policy_features_through_registry.md |   1 +
 ..._notification_features_through_registry.md |   1 +
 ...t_regasm_with_no_command_line_arguments.md |   4 +-
 ..._regsvcs_with_no_command_line_arguments.md |   2 +-
 ..._no_command_line_arguments_with_network.md |   2 +-
 ..._no_command_line_arguments_with_network.md |   2 +-
 ..._no_command_line_arguments_with_network.md |   4 +-
 ...lhost_with_no_command_line_with_network.md |   2 +-
 ...cious_dllhost_no_command_line_arguments.md |   2 +-
 ...ious_gpupdate_no_command_line_arguments.md |   2 +-
 ...ious_rundll32_no_command_line_arguments.md |   4 +-
 ...hprotocolhost_no_command_line_arguments.md |   2 +-
 ...s_installutil_remote_network_connection.md |   2 +-
 ...stallutil_uninstall_option_with_network.md |   2 +-
 ...odify_acl_permission_to_files_or_folder.md | 109 ++++++++++++++
 ...try_by_a_non_critical_process_file_path.md | 119 ++++++++++++++++
 ...03-28-windows_terminating_lsass_process.md | 114 +++++++++++++++
 docs/_stories/caddy_wiper.md                  |  44 ++++++
 ...plantation_monitoring_and_investigation.md |   4 +-
 docs/_stories/darkside_ransomware.md          |   4 +-
 docs/_stories/data_destruction.md             |   7 +
 docs/_stories/double_zero_destructor.md       |  46 ++++++
 docs/_stories/fin7.md                         |   8 +-
 docs/_stories/icedid.md                       |   4 +-
 docs/_stories/linux_persistence_techniques.md |   8 +-
 docs/_stories/linux_privilege_escalation.md   |   8 +-
 docs/_stories/living_off_the_land.md          |   4 +-
 docs/_stories/remcos.md                       |   4 +-
 .../router_and_infrastructure_security.md     |   8 +-
 .../suspicious_windows_registry_activities.md |   4 +-
 .../windows_defense_evasion_tactics.md        |  24 ++--
 docs/_stories/windows_registry_abuse.md       |  99 +++++++++++++
 docs/_stories/xmrig.md                        |   2 +-
 564 files changed, 1441 insertions(+), 690 deletions(-)
 create mode 100644 docs/_pages/data_destruction.md
 create mode 100644 docs/_posts/2022-03-08-suspicious_msbuild_path.md
 create mode 100644 docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md
 create mode 100644 docs/_posts/2022-03-28-windows_deleted_registry_by_a_non_critical_process_file_path.md
 create mode 100644 docs/_posts/2022-03-28-windows_terminating_lsass_process.md
 create mode 100644 docs/_stories/caddy_wiper.md
 create mode 100644 docs/_stories/double_zero_destructor.md
 create mode 100644 docs/_stories/windows_registry_abuse.md

diff --git a/docs/_data/navigation.yml b/docs/_data/navigation.yml
index 824899c46f..14d55ba418 100644
--- a/docs/_data/navigation.yml
+++ b/docs/_data/navigation.yml
@@ -70,12 +70,14 @@ detections:
         url: /detections/web/
   - title: "Product"
     children:
+      - title: "Splunk Enterprise"
+        url: /tags/#splunk-enterprise
+      - title: "Splunk Cloud"
+        url: /tags/#splunk-cloud
       - title: "Splunk Enterprise Security"
         url: /tags/#splunk-enterprise-security
       - title: "Splunk Behavioral Analytics"
         url: /tags/#splunk-behavioral-analytics
-      - title: "Splunk Security Analytics for AWS"
-        url: /tags/#splunk-security-analytics-for-aws
 stories:
   - title: "Use Case"
     children:
@@ -89,6 +91,8 @@ stories:
         url: /stories/best_practices/
       - title: Cloud Security
         url: /stories/cloud_security/
+      - title: Data Destruction
+        url: /stories/data_destruction/
       - title: Lateral Movement
         url: /stories/lateral_movement/
       - title: Malware
diff --git a/docs/_pages/data_destruction.md b/docs/_pages/data_destruction.md
new file mode 100644
index 0000000000..9eb6556f8b
--- /dev/null
+++ b/docs/_pages/data_destruction.md
@@ -0,0 +1,9 @@
+---
+title: Data Destruction
+layout: tag
+author_profile: false
+taxonomy: Data Destruction
+permalink: /detections/data_destruction/
+sidebar:
+  nav: "detections"
+---
\ No newline at end of file
diff --git a/docs/_pages/detections.md b/docs/_pages/detections.md
index 1d11e3769b..162c60ed8d 100644
--- a/docs/_pages/detections.md
+++ b/docs/_pages/detections.md
@@ -104,7 +104,7 @@ sidebar:
 | [Cloud Provisioning Activity From Previously Unseen Country](/cloud/cloud_provisioning_activity_from_previously_unseen_country/) | [Valid Accounts](/tags/#valid-accounts) | Anomaly |
 | [Cloud Provisioning Activity From Previously Unseen IP Address](/cloud/cloud_provisioning_activity_from_previously_unseen_ip_address/) | [Valid Accounts](/tags/#valid-accounts) | Anomaly |
 | [Cloud Provisioning Activity From Previously Unseen Region](/cloud/cloud_provisioning_activity_from_previously_unseen_region/) | [Valid Accounts](/tags/#valid-accounts) | Anomaly |
-| [Cmdline Tool Not Executed In CMD Shell](/endpoint/cmdline_tool_not_executed_in_cmd_shell/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript) | TTP |
+| [Cmdline Tool Not Executed In CMD Shell](/endpoint/cmdline_tool_not_executed_in_cmd_shell/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript/JScript](/tags/#javascript/jscript) | TTP |
 | [Cobalt Strike Named Pipes](/endpoint/cobalt_strike_named_pipes/) | [Process Injection](/tags/#process-injection) | TTP |
 | [Common Ransomware Extensions](/endpoint/common_ransomware_extensions/) | [Data Destruction](/tags/#data-destruction) | Hunting |
 | [Common Ransomware Notes](/endpoint/common_ransomware_notes/) | [Data Destruction](/tags/#data-destruction) | Hunting |
@@ -133,7 +133,7 @@ sidebar:
 | [Deleting Of Net Users](/endpoint/deleting_of_net_users/) | [Account Access Removal](/tags/#account-access-removal) | TTP |
 | [Deleting Shadow Copies](/endpoint/deleting_shadow_copies/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
 | [Detect API activity from users without MFA]() | None | Hunting |
-| [Detect ARP Poisoning](/network/detect_arp_poisoning/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP |
+| [Detect ARP Poisoning](/network/detect_arp_poisoning/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP |
 | [Detect AWS API Activities From Unapproved Accounts](/deprecated/detect_aws_api_activities_from_unapproved_accounts/) | [Cloud Accounts](/tags/#cloud-accounts) | Hunting |
 | [Detect AWS Console Login by New User]() | None | Hunting |
 | [Detect AWS Console Login by User from New City](/cloud/detect_aws_console_login_by_user_from_new_city/) | [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | Hunting |
@@ -159,7 +159,7 @@ sidebar:
 | [Detect HTML Help Spawn Child Process](/endpoint/detect_html_help_spawn_child_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | TTP |
 | [Detect HTML Help URL in Command Line](/endpoint/detect_html_help_url_in_command_line/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | TTP |
 | [Detect HTML Help Using InfoTech Storage Handlers](/endpoint/detect_html_help_using_infotech_storage_handlers/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Compiled HTML File](/tags/#compiled-html-file) | TTP |
-| [Detect IPv6 Network Infrastructure Threats](/network/detect_ipv6_network_infrastructure_threats/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP |
+| [Detect IPv6 Network Infrastructure Threats](/network/detect_ipv6_network_infrastructure_threats/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP |
 | [Detect Large Outbound ICMP Packets](/network/detect_large_outbound_icmp_packets/) | [Non-Application Layer Protocol](/tags/#non-application-layer-protocol) | TTP |
 | [Detect Long DNS TXT Record Response](/deprecated/detect_long_dns_txt_record_response/) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | TTP |
 | [Detect MSHTA Url in Command Line](/endpoint/detect_mshta_url_in_command_line/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta) | TTP |
@@ -175,7 +175,7 @@ sidebar:
 | [Detect Outbound SMB Traffic](/network/detect_outbound_smb_traffic/) | [File Transfer Protocols](/tags/#file-transfer-protocols), [Application Layer Protocol](/tags/#application-layer-protocol) | TTP |
 | [Detect Outlook exe writing a zip file](/endpoint/detect_outlook_exe_writing_a_zip_file/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP |
 | [Detect Path Interception By Creation Of program exe](/endpoint/detect_path_interception_by_creation_of_program_exe/) | [Path Interception by Unquoted Path](/tags/#path-interception-by-unquoted-path), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP |
-| [Detect Port Security Violation](/network/detect_port_security_violation/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP |
+| [Detect Port Security Violation](/network/detect_port_security_violation/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning) | TTP |
 | [Detect Prohibited Applications Spawning cmd exe](/endpoint/detect_prohibited_applications_spawning_cmd_exe/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell) | Hunting |
 | [Detect PsExec With accepteula Flag](/endpoint/detect_psexec_with_accepteula_flag/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | TTP |
 | [Detect RClone Command-Line Usage](/endpoint/detect_rclone_command-line_usage/) | [Automated Exfiltration](/tags/#automated-exfiltration) | TTP |
@@ -191,7 +191,7 @@ sidebar:
 | [Detect Renamed PSExec](/endpoint/detect_renamed_psexec/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | Hunting |
 | [Detect Renamed RClone](/endpoint/detect_renamed_rclone/) | [Automated Exfiltration](/tags/#automated-exfiltration) | Hunting |
 | [Detect Renamed WinRAR](/endpoint/detect_renamed_winrar/) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data) | Hunting |
-| [Detect Rogue DHCP Server](/network/detect_rogue_dhcp_server/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle) | TTP |
+| [Detect Rogue DHCP Server](/network/detect_rogue_dhcp_server/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle) | TTP |
 | [Detect Rundll32 Application Control Bypass - advpack](/endpoint/detect_rundll32_application_control_bypass_-_advpack/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
 | [Detect Rundll32 Application Control Bypass - setupapi](/endpoint/detect_rundll32_application_control_bypass_-_setupapi/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
 | [Detect Rundll32 Application Control Bypass - syssetup](/endpoint/detect_rundll32_application_control_bypass_-_syssetup/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Rundll32](/tags/#rundll32) | TTP |
@@ -242,7 +242,7 @@ sidebar:
 | [Disable Schedule Task](/endpoint/disable_schedule_task/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Disable Security Logs Using MiniNt Registry](/endpoint/disable_security_logs_using_minint_registry/) | [Modify Registry](/tags/#modify-registry) | TTP |
 | [Disable Show Hidden Files](/endpoint/disable_show_hidden_files/) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Hide Artifacts](/tags/#hide-artifacts), [Impair Defenses](/tags/#impair-defenses) | TTP |
-| [Disable UAC Remote Restriction](/endpoint/disable_uac_remote_restriction/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
+| [Disable UAC Remote Restriction](/endpoint/disable_uac_remote_restriction/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
 | [Disable Windows App Hotkeys](/endpoint/disable_windows_app_hotkeys/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Disable Windows Behavior Monitoring](/endpoint/disable_windows_behavior_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Disable Windows SmartScreen Protection](/endpoint/disable_windows_smartscreen_protection/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
@@ -255,8 +255,8 @@ sidebar:
 | [Disabling FolderOptions Windows Feature](/endpoint/disabling_folderoptions_windows_feature/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Disabling Net User Account](/endpoint/disabling_net_user_account/) | [Account Access Removal](/tags/#account-access-removal) | TTP |
 | [Disabling NoRun Windows App](/endpoint/disabling_norun_windows_app/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
-| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
-| [Disabling SystemRestore In Registry](/endpoint/disabling_systemrestore_in_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
+| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
+| [Disabling SystemRestore In Registry](/endpoint/disabling_systemrestore_in_registry/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery) | TTP |
 | [Disabling Task Manager](/endpoint/disabling_task_manager/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Domain Account Discovery With Net App](/endpoint/domain_account_discovery_with_net_app/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | TTP |
 | [Domain Account Discovery with Dsquery](/endpoint/domain_account_discovery_with_dsquery/) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery) | Hunting |
@@ -288,7 +288,7 @@ sidebar:
 | [Enable WDigest UseLogonCredential Registry](/endpoint/enable_wdigest_uselogoncredential_registry/) | [Modify Registry](/tags/#modify-registry), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Enumerate Users Local Group Using Telegram](/endpoint/enumerate_users_local_group_using_telegram/) | [Account Discovery](/tags/#account-discovery) | TTP |
 | [Esentutl SAM Copy](/endpoint/esentutl_sam_copy/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | Hunting |
-| [Eventvwr UAC Bypass](/endpoint/eventvwr_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
+| [Eventvwr UAC Bypass](/endpoint/eventvwr_uac_bypass/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
 | [Excel Spawning PowerShell](/endpoint/excel_spawning_powershell/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Excel Spawning Windows Script Host](/endpoint/excel_spawning_windows_script_host/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
 | [Excessive Attempt To Disable Services](/endpoint/excessive_attempt_to_disable_services/) | [Service Stop](/tags/#service-stop) | Anomaly |
@@ -317,12 +317,12 @@ sidebar:
 | [First Time Seen Child Process of Zoom](/endpoint/first_time_seen_child_process_of_zoom/) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | Anomaly |
 | [First Time Seen Running Windows Service](/endpoint/first_time_seen_running_windows_service/) | [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | Anomaly |
 | [First time seen command line argument](/deprecated/first_time_seen_command_line_argument/) | [PowerShell](/tags/#powershell), [Windows Command Shell](/tags/#windows-command-shell) | Hunting |
-| [FodHelper UAC Bypass](/endpoint/fodhelper_uac_bypass/) | [Modify Registry](/tags/#modify-registry), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
+| [FodHelper UAC Bypass](/endpoint/fodhelper_uac_bypass/) | [Modify Registry](/tags/#modify-registry), [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
 | [Fsutil Zeroing File](/endpoint/fsutil_zeroing_file/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP |
 | [GCP Detect accounts with high risk roles by project](/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project/) | [Valid Accounts](/tags/#valid-accounts) | Hunting |
 | [GCP Detect gcploit framework](/cloud/gcp_detect_gcploit_framework/) | [Valid Accounts](/tags/#valid-accounts) | TTP |
 | [GCP Detect high risk permissions by resource and account](/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account/) | [Valid Accounts](/tags/#valid-accounts) | Hunting |
-| [GCP GCR container uploaded](/deprecated/gcp_gcr_container_uploaded/) | [Implant Internal Image](/tags/#implant-internal-image) | Hunting |
+| [GCP GCR container uploaded](/deprecated/gcp_gcr_container_uploaded/) | [Implant Container Image](/tags/#implant-container-image) | Hunting |
 | [GCP Kubernetes cluster pod scan detection](/cloud/gcp_kubernetes_cluster_pod_scan_detection/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | Hunting |
 | [GCP Kubernetes cluster scan detection](/deprecated/gcp_kubernetes_cluster_scan_detection/) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | TTP |
 | [GPUpdate with no Command Line Arguments with Network](/endpoint/gpupdate_with_no_command_line_arguments_with_network/) | [Process Injection](/tags/#process-injection) | TTP |
@@ -392,7 +392,7 @@ sidebar:
 | [Impacket Lateral Movement Commandline Parameters](/endpoint/impacket_lateral_movement_commandline_parameters/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Windows Service](/tags/#windows-service) | TTP |
 | [Interactive Session on Remote Endpoint with PowerShell](/endpoint/interactive_session_on_remote_endpoint_with_powershell/) | [Remote Services](/tags/#remote-services), [Windows Remote Management](/tags/#windows-remote-management) | TTP |
 | [Java Class File download by Java User Agent](/endpoint/java_class_file_download_by_java_user_agent/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP |
-| [Jscript Execution Using Cscript App](/endpoint/jscript_execution_using_cscript_app/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript) | TTP |
+| [Jscript Execution Using Cscript App](/endpoint/jscript_execution_using_cscript_app/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript/JScript](/tags/#javascript/jscript) | TTP |
 | [Kerberoasting spn request with RC4 encryption](/endpoint/kerberoasting_spn_request_with_rc4_encryption/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Kerberoasting](/tags/#kerberoasting) | TTP |
 | [Kerberos Pre-Authentication Flag Disabled in UserAccountControl](/endpoint/kerberos_pre-authentication_flag_disabled_in_useraccountcontrol/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [AS-REP Roasting](/tags/#as-rep-roasting) | TTP |
 | [Kerberos Pre-Authentication Flag Disabled with PowerShell](/endpoint/kerberos_pre-authentication_flag_disabled_with_powershell/) | [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [AS-REP Roasting](/tags/#as-rep-roasting) | TTP |
@@ -431,8 +431,8 @@ sidebar:
 | [Linux Doas Tool Execution](/endpoint/linux_doas_tool_execution/) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | Anomaly |
 | [Linux Edit Cron Table Parameter](/endpoint/linux_edit_cron_table_parameter/) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job) | Hunting |
 | [Linux File Created In Kernel Driver Directory](/endpoint/linux_file_created_in_kernel_driver_directory/) | [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | Anomaly |
-| [Linux File Creation In Init Boot Directory](/endpoint/linux_file_creation_in_init_boot_directory/) | [RC Scripts](/tags/#rc-scripts), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts) | Anomaly |
-| [Linux File Creation In Profile Directory](/endpoint/linux_file_creation_in_profile_directory/) | [Unix Shell Configuration Modification](/tags/#unix-shell-configuration-modification), [Event Triggered Execution](/tags/#event-triggered-execution) | Anomaly |
+| [Linux File Creation In Init Boot Directory](/endpoint/linux_file_creation_in_init_boot_directory/) | [Rc.common](/tags/#rc.common), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts) | Anomaly |
+| [Linux File Creation In Profile Directory](/endpoint/linux_file_creation_in_profile_directory/) | [.bash_profile and .bashrc](/tags/#.bash_profile-and-.bashrc), [Event Triggered Execution](/tags/#event-triggered-execution) | Anomaly |
 | [Linux Insert Kernel Module Using Insmod Utility](/endpoint/linux_insert_kernel_module_using_insmod_utility/) | [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | Anomaly |
 | [Linux Install Kernel Module Using Modprobe Utility](/endpoint/linux_install_kernel_module_using_modprobe_utility/) | [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | Anomaly |
 | [Linux Java Spawning Shell](/endpoint/linux_java_spawning_shell/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP |
@@ -441,11 +441,11 @@ sidebar:
 | [Linux Possible Access To Credential Files](/endpoint/linux_possible_access_to_credential_files/) | [/etc/passwd and /etc/shadow](/tags/#/etc/passwd-and-/etc/shadow), [OS Credential Dumping](/tags/#os-credential-dumping) | Anomaly |
 | [Linux Possible Access To Sudoers File](/endpoint/linux_possible_access_to_sudoers_file/) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | Anomaly |
 | [Linux Possible Append Command To At Allow Config File](/endpoint/linux_possible_append_command_to_at_allow_config_file/) | [At (Linux)](/tags/#at-(linux)), [Scheduled Task/Job](/tags/#scheduled-task/job) | Anomaly |
-| [Linux Possible Append Command To Profile Config File](/endpoint/linux_possible_append_command_to_profile_config_file/) | [Unix Shell Configuration Modification](/tags/#unix-shell-configuration-modification), [Event Triggered Execution](/tags/#event-triggered-execution) | Anomaly |
+| [Linux Possible Append Command To Profile Config File](/endpoint/linux_possible_append_command_to_profile_config_file/) | [.bash_profile and .bashrc](/tags/#.bash_profile-and-.bashrc), [Event Triggered Execution](/tags/#event-triggered-execution) | Anomaly |
 | [Linux Possible Append Cronjob Entry on Existing Cronjob File](/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file/) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job) | Hunting |
 | [Linux Possible Cronjob Modification With Editor](/endpoint/linux_possible_cronjob_modification_with_editor/) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job) | Hunting |
 | [Linux Possible Ssh Key File Creation](/endpoint/linux_possible_ssh_key_file_creation/) | [SSH Authorized Keys](/tags/#ssh-authorized-keys), [Account Manipulation](/tags/#account-manipulation) | Anomaly |
-| [Linux Preload Hijack Library Calls](/endpoint/linux_preload_hijack_library_calls/) | [Dynamic Linker Hijacking](/tags/#dynamic-linker-hijacking), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP |
+| [Linux Preload Hijack Library Calls](/endpoint/linux_preload_hijack_library_calls/) | [LD_PRELOAD](/tags/#ld_preload), [Hijack Execution Flow](/tags/#hijack-execution-flow) | TTP |
 | [Linux Service File Created In Systemd Directory](/endpoint/linux_service_file_created_in_systemd_directory/) | [Systemd Timers](/tags/#systemd-timers), [Scheduled Task/Job](/tags/#scheduled-task/job) | Anomaly |
 | [Linux Service Restarted](/endpoint/linux_service_restarted/) | [Systemd Timers](/tags/#systemd-timers), [Scheduled Task/Job](/tags/#scheduled-task/job) | Anomaly |
 | [Linux Service Started Or Enabled](/endpoint/linux_service_started_or_enabled/) | [Systemd Timers](/tags/#systemd-timers), [Scheduled Task/Job](/tags/#scheduled-task/job) | Anomaly |
@@ -464,8 +464,8 @@ sidebar:
 | [Log4Shell JNDI Payload Injection with Outbound Connection](/web/log4shell_jndi_payload_injection_with_outbound_connection/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | Anomaly |
 | [Logon Script Event Trigger Execution](/endpoint/logon_script_event_trigger_execution/) | [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Logon Script (Windows)](/tags/#logon-script-(windows)) | TTP |
 | [MS Exchange Mailbox Replication service writing Active Server Pages](/endpoint/ms_exchange_mailbox_replication_service_writing_active_server_pages/) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP |
-| [MS Scripting Process Loading Ldap Module](/endpoint/ms_scripting_process_loading_ldap_module/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript) | Anomaly |
-| [MS Scripting Process Loading WMI Module](/endpoint/ms_scripting_process_loading_wmi_module/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript) | Anomaly |
+| [MS Scripting Process Loading Ldap Module](/endpoint/ms_scripting_process_loading_ldap_module/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript/JScript](/tags/#javascript/jscript) | Anomaly |
+| [MS Scripting Process Loading WMI Module](/endpoint/ms_scripting_process_loading_wmi_module/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript/JScript](/tags/#javascript/jscript) | Anomaly |
 | [MSBuild Suspicious Spawned By Script Process](/endpoint/msbuild_suspicious_spawned_by_script_process/) | [MSBuild](/tags/#msbuild), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution) | TTP |
 | [MSHTML Module Load in Office Product](/endpoint/mshtml_module_load_in_office_product/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment) | TTP |
 | [MSI Module Loaded by Non-System Binary](/endpoint/msi_module_loaded_by_non-system_binary/) | [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow) | Hunting |
@@ -480,7 +480,7 @@ sidebar:
 | [Mimikatz PassTheTicket CommandLine Parameters](/endpoint/mimikatz_passtheticket_commandline_parameters/) | [Use Alternate Authentication Material](/tags/#use-alternate-authentication-material), [Pass the Ticket](/tags/#pass-the-ticket) | TTP |
 | [Mmc LOLBAS Execution Process Spawn](/endpoint/mmc_lolbas_execution_process_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model) | TTP |
 | [Modification Of Wallpaper](/endpoint/modification_of_wallpaper/) | [Defacement](/tags/#defacement) | TTP |
-| [Modify ACL permission To Files Or Folder](/endpoint/modify_acl_permission_to_files_or_folder/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | TTP |
+| [Modify ACL permission To Files Or Folder](/endpoint/modify_acl_permission_to_files_or_folder/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification) | Anomaly |
 | [Monitor DNS For Brand Abuse]() | None | TTP |
 | [Monitor Email For Brand Abuse]() | None | TTP |
 | [Monitor Registry Keys for Print Monitors](/endpoint/monitor_registry_keys_for_print_monitors/) | [Port Monitors](/tags/#port-monitors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP |
@@ -494,14 +494,14 @@ sidebar:
 | [Multiple Users Failing To Authenticate From Host Using NTLM](/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly |
 | [Multiple Users Failing To Authenticate From Process](/endpoint/multiple_users_failing_to_authenticate_from_process/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly |
 | [Multiple Users Remotely Failing To Authenticate From Host](/endpoint/multiple_users_remotely_failing_to_authenticate_from_host/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly |
-| [NET Profiler UAC bypass](/endpoint/net_profiler_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
+| [NET Profiler UAC bypass](/endpoint/net_profiler_uac_bypass/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
 | [NLTest Domain Trust Discovery](/endpoint/nltest_domain_trust_discovery/) | [Domain Trust Discovery](/tags/#domain-trust-discovery) | TTP |
 | [Net Localgroup Discovery](/endpoint/net_localgroup_discovery/) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | Hunting |
 | [Network Connection Discovery With Arp](/endpoint/network_connection_discovery_with_arp/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | Hunting |
 | [Network Connection Discovery With Net](/endpoint/network_connection_discovery_with_net/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | Hunting |
 | [Network Connection Discovery With Netstat](/endpoint/network_connection_discovery_with_netstat/) | [System Network Connections Discovery](/tags/#system-network-connections-discovery) | Hunting |
 | [Network Discovery Using Route Windows App](/endpoint/network_discovery_using_route_windows_app/) | [System Network Configuration Discovery](/tags/#system-network-configuration-discovery), [Internet Connection Discovery](/tags/#internet-connection-discovery) | Hunting |
-| [New container uploaded to AWS ECR](/cloud/new_container_uploaded_to_aws_ecr/) | [Implant Internal Image](/tags/#implant-internal-image) | Hunting |
+| [New container uploaded to AWS ECR](/cloud/new_container_uploaded_to_aws_ecr/) | [Implant Container Image](/tags/#implant-container-image) | Hunting |
 | [Nishang PowershellTCPOneLine](/endpoint/nishang_powershelltcponeline/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | TTP |
 | [No Windows Updates in a time frame]() | None | Hunting |
 | [Non Chrome Process Accessing Chrome Default Dir](/endpoint/non_chrome_process_accessing_chrome_default_dir/) | [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers) | Anomaly |
@@ -632,8 +632,8 @@ sidebar:
 | [Ryuk Test Files Detected](/endpoint/ryuk_test_files_detected/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | TTP |
 | [Ryuk Wake on LAN Command](/endpoint/ryuk_wake_on_lan_command/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell) | TTP |
 | [SAM Database File Access Attempt](/endpoint/sam_database_file_access_attempt/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | Hunting |
-| [SLUI RunAs Elevated](/endpoint/slui_runas_elevated/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
-| [SLUI Spawning a Process](/endpoint/slui_spawning_a_process/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
+| [SLUI RunAs Elevated](/endpoint/slui_runas_elevated/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
+| [SLUI Spawning a Process](/endpoint/slui_spawning_a_process/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
 | [SMB Traffic Spike](/network/smb_traffic_spike/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services) | Anomaly |
 | [SMB Traffic Spike - MLTK](/network/smb_traffic_spike_-_mltk/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services) | Anomaly |
 | [SQL Injection with Long URLs](/web/sql_injection_with_long_urls/) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | TTP |
@@ -651,7 +651,7 @@ sidebar:
 | [Schtasks used for forcing a reboot](/endpoint/schtasks_used_for_forcing_a_reboot/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | TTP |
 | [Screensaver Event Trigger Execution](/endpoint/screensaver_event_trigger_execution/) | [Event Triggered Execution](/tags/#event-triggered-execution), [Screensaver](/tags/#screensaver) | TTP |
 | [Script Execution via WMI](/endpoint/script_execution_via_wmi/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP |
-| [Sdclt UAC Bypass](/endpoint/sdclt_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
+| [Sdclt UAC Bypass](/endpoint/sdclt_uac_bypass/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
 | [Sdelete Application Execution](/endpoint/sdelete_application_execution/) | [Data Destruction](/tags/#data-destruction), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP |
 | [SearchProtocolHost with no Command Line with Network](/endpoint/searchprotocolhost_with_no_command_line_with_network/) | [Process Injection](/tags/#process-injection) | TTP |
 | [SecretDumps Offline NTDS Dumping Tool](/endpoint/secretdumps_offline_ntds_dumping_tool/) | [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
@@ -664,7 +664,7 @@ sidebar:
 | [Shim Database Installation With Suspicious Parameters](/endpoint/shim_database_installation_with_suspicious_parameters/) | [Application Shimming](/tags/#application-shimming), [Event Triggered Execution](/tags/#event-triggered-execution) | TTP |
 | [Short Lived Scheduled Task](/endpoint/short_lived_scheduled_task/) | [Scheduled Task](/tags/#scheduled-task) | TTP |
 | [Short Lived Windows Accounts](/endpoint/short_lived_windows_accounts/) | [Local Account](/tags/#local-account), [Create Account](/tags/#create-account) | TTP |
-| [SilentCleanup UAC Bypass](/endpoint/silentcleanup_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
+| [SilentCleanup UAC Bypass](/endpoint/silentcleanup_uac_bypass/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
 | [Single Letter Process On Endpoint](/endpoint/single_letter_process_on_endpoint/) | [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file) | TTP |
 | [Spectre and Meltdown Vulnerable Systems]() | None | TTP |
 | [Spike in File Writes]() | None | Anomaly |
@@ -731,7 +731,7 @@ sidebar:
 | [TOR Traffic](/network/tor_traffic/) | [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols) | TTP |
 | [Time Provider Persistence Registry](/endpoint/time_provider_persistence_registry/) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution) | TTP |
 | [Trickbot Named Pipe](/endpoint/trickbot_named_pipe/) | [Process Injection](/tags/#process-injection) | TTP |
-| [UAC Bypass MMC Load Unsigned Dll](/endpoint/uac_bypass_mmc_load_unsigned_dll/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
+| [UAC Bypass MMC Load Unsigned Dll](/endpoint/uac_bypass_mmc_load_unsigned_dll/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
 | [UAC Bypass With Colorui COM Object](/endpoint/uac_bypass_with_colorui_com_object/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp) | TTP |
 | [USN Journal Deletion](/endpoint/usn_journal_deletion/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host) | TTP |
 | [Uncommon Processes On Endpoint](/deprecated/uncommon_processes_on_endpoint/) | [Malicious File](/tags/#malicious-file) | Hunting |
@@ -758,7 +758,7 @@ sidebar:
 | [WMI Recon Running Process Or Services](/endpoint/wmi_recon_running_process_or_services/) | [Gather Victim Host Information](/tags/#gather-victim-host-information) | TTP |
 | [WMI Temporary Event Subscription](/endpoint/wmi_temporary_event_subscription/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | TTP |
 | [WMIC XSL Execution via URL](/endpoint/wmic_xsl_execution_via_url/) | [XSL Script Processing](/tags/#xsl-script-processing) | TTP |
-| [WSReset UAC Bypass](/endpoint/wsreset_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
+| [WSReset UAC Bypass](/endpoint/wsreset_uac_bypass/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | TTP |
 | [Wbemprox COM Object Execution](/endpoint/wbemprox_com_object_execution/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp) | TTP |
 | [Web Fraud - Account Harvesting](/deprecated/web_fraud_-_account_harvesting/) | [Create Account](/tags/#create-account) | TTP |
 | [Web Fraud - Anomalous User Clickspeed](/deprecated/web_fraud_-_anomalous_user_clickspeed/) | [Valid Accounts](/tags/#valid-accounts) | Anomaly |
@@ -777,6 +777,7 @@ sidebar:
 | [Windows Curl Upload to Remote Destination](/endpoint/windows_curl_upload_to_remote_destination/) | [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | TTP |
 | [Windows DISM Remove Defender](/endpoint/windows_dism_remove_defender/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
 | [Windows Defender Exclusion Registry Entry](/endpoint/windows_defender_exclusion_registry_entry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | TTP |
+| [Windows Deleted Registry By A Non Critical Process File Path](/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path/) | [Modify Registry](/tags/#modify-registry) | Anomaly |
 | [Windows Disable Change Password Through Registry](/endpoint/windows_disable_change_password_through_registry/) | [Modify Registry](/tags/#modify-registry) | Anomaly |
 | [Windows Disable Lock Workstation Feature Through Registry](/endpoint/windows_disable_lock_workstation_feature_through_registry/) | [Modify Registry](/tags/#modify-registry) | Anomaly |
 | [Windows Disable LogOff Button Through Registry](/endpoint/windows_disable_logoff_button_through_registry/) | [Modify Registry](/tags/#modify-registry) | Anomaly |
@@ -822,6 +823,7 @@ sidebar:
 | [Windows Service Creation Using Registry Entry](/endpoint/windows_service_creation_using_registry_entry/) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness) | TTP |
 | [Windows Service Creation on Remote Endpoint](/endpoint/windows_service_creation_on_remote_endpoint/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | TTP |
 | [Windows Service Initiation on Remote Endpoint](/endpoint/windows_service_initiation_on_remote_endpoint/) | [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service) | TTP |
+| [Windows Terminating Lsass Process](/endpoint/windows_terminating_lsass_process/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | Anomaly |
 | [Windows Users Authenticate Using Explicit Credentials](/endpoint/windows_users_authenticate_using_explicit_credentials/) | [Password Spraying](/tags/#password-spraying), [Brute Force](/tags/#brute-force) | Anomaly |
 | [Windows WMI Process Call Create](/endpoint/windows_wmi_process_call_create/) | [Windows Management Instrumentation](/tags/#windows-management-instrumentation) | Hunting |
 | [Windows connhost exe started forcefully](/deprecated/windows_connhost_exe_started_forcefully/) | [Windows Command Shell](/tags/#windows-command-shell) | TTP |
diff --git a/docs/_pages/stories.md b/docs/_pages/stories.md
index 9f8755db0c..093dbb6abb 100644
--- a/docs/_pages/stories.md
+++ b/docs/_pages/stories.md
@@ -27,6 +27,7 @@ sidebar:
 | [Baron Samedit CVE-2021-3156](baron_samedit_cve-2021-3156) | [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Privilege Escalation](/tags/#privilege-escalation) |
 | [BlackMatter Ransomware](blackmatter_ransomware) | [Credentials in Registry](/tags/#credentials-in-registry), [Unsecured Credentials](/tags/#unsecured-credentials), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Defacement](/tags/#defacement), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Credential Access](/tags/#credential-access), [Impact](/tags/#impact) |
 | [Brand Monitoring]() | None | None |
+| [Caddy Wiper](caddy_wiper) | [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe) | [Impact](/tags/#impact) |
 | [Clop Ransomware](clop_ransomware) | [User Execution](/tags/#user-execution), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Data Destruction](/tags/#data-destruction), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [Cloud Cryptomining](cloud_cryptomining) | [Cloud Accounts](/tags/#cloud-accounts), [Valid Accounts](/tags/#valid-accounts), [Unused/Unsupported Cloud Regions](/tags/#unused/unsupported-cloud-regions) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [Cloud Federated Credential Abuse](cloud_federated_credential_abuse) | [Valid Accounts](/tags/#valid-accounts), [Cloud Account](/tags/#cloud-account), [Create Account](/tags/#create-account), [Modify Authentication Process](/tags/#modify-authentication-process), [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Event Triggered Execution](/tags/#event-triggered-execution) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
@@ -35,13 +36,13 @@ sidebar:
 | [Collection and Staging](collection_and_staging) | [Masquerading](/tags/#masquerading), [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [Email Collection](/tags/#email-collection), [Local Email Collection](/tags/#local-email-collection), [Remote Email Collection](/tags/#remote-email-collection) | [Collection](/tags/#collection), [Defense Evasion](/tags/#defense-evasion) |
 | [Command and Control](command_and_control) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [DNS](/tags/#dns), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Non-Application Layer Protocol](/tags/#non-application-layer-protocol), [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols), [Drive-by Compromise](/tags/#drive-by-compromise) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access) |
 | [Common Phishing Frameworks](common_phishing_frameworks) | [Spearphishing via Service](/tags/#spearphishing-via-service) | [Initial Access](/tags/#initial-access) |
-| [Container Implantation Monitoring and Investigation](container_implantation_monitoring_and_investigation) | [Implant Internal Image](/tags/#implant-internal-image) | [Persistence](/tags/#persistence) |
+| [Container Implantation Monitoring and Investigation](container_implantation_monitoring_and_investigation) | [Implant Container Image](/tags/#implant-container-image) | [Persistence](/tags/#persistence) |
 | [Credential Dumping](credential_dumping) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping), [Security Account Manager](/tags/#security-account-manager), [NTDS](/tags/#ntds), [Modify Registry](/tags/#modify-registry), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution) |
 | [DHS Report TA18-074A](dhs_report_ta18-074a) | [PowerShell](/tags/#powershell), [Windows Command Shell](/tags/#windows-command-shell), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job), [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file), [Modify Registry](/tags/#modify-registry), [File Transfer Protocols](/tags/#file-transfer-protocols), [Application Layer Protocol](/tags/#application-layer-protocol) | [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [DNS Amplification Attacks](dns_amplification_attacks) | [Network Denial of Service](/tags/#network-denial-of-service), [Reflection Amplification](/tags/#reflection-amplification) | [Impact](/tags/#impact) |
 | [DNS Hijacking](dns_hijacking) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [DNS](/tags/#dns), [Drive-by Compromise](/tags/#drive-by-compromise) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access) |
-| [DarkSide Ransomware](darkside_ransomware) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp), [Process Injection](/tags/#process-injection), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [LSASS Memory](/tags/#lsass-memory), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Automated Exfiltration](/tags/#automated-exfiltration), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
-| [Data Destruction](data_destruction) | [Data Destruction](/tags/#data-destruction), [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe) | [Impact](/tags/#impact) |
+| [DarkSide Ransomware](darkside_ransomware) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp), [Process Injection](/tags/#process-injection), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [LSASS Memory](/tags/#lsass-memory), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Automated Exfiltration](/tags/#automated-exfiltration), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
+| [Data Destruction](data_destruction) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Masquerading](/tags/#masquerading), [Data Destruction](/tags/#data-destruction), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Modify Registry](/tags/#modify-registry), [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [Data Exfiltration](data_exfiltration) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account), [Email Collection](/tags/#email-collection), [Email Forwarding Rule](/tags/#email-forwarding-rule), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Local Email Collection](/tags/#local-email-collection), [Phishing](/tags/#phishing), [Exfiltration Over C2 Channel](/tags/#exfiltration-over-c2-channel), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol) | [Collection](/tags/#collection), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access) |
 | [Data Protection](data_protection) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Drive-by Compromise](/tags/#drive-by-compromise) | [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access) |
 | [Deobfuscate-Decode Files or Information](deobfuscate-decode_files_or_information) | [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information) | [Defense Evasion](/tags/#defense-evasion) |
@@ -49,26 +50,27 @@ sidebar:
 | [Dev Sec Ops](dev_sec_ops) | [Malicious Image](/tags/#malicious-image), [User Execution](/tags/#user-execution), [Compromise Client Software Binary](/tags/#compromise-client-software-binary), [Trusted Relationship](/tags/#trusted-relationship), [Compromise Software Dependencies and Development Tools](/tags/#compromise-software-dependencies-and-development-tools), [Supply Chain Compromise](/tags/#supply-chain-compromise), [Exfiltration to Cloud Storage](/tags/#exfiltration-to-cloud-storage), [Exfiltration Over Web Service](/tags/#exfiltration-over-web-service), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Exploitation for Credential Access](/tags/#exploitation-for-credential-access), [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Credential Access](/tags/#credential-access), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) |
 | [Disabling Security Tools](disabling_security_tools) | [Install Root Certificate](/tags/#install-root-certificate), [Subvert Trust Controls](/tags/#subvert-trust-controls), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Modify Registry](/tags/#modify-registry) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [Domain Trust Discovery](domain_trust_discovery) | [Domain Trust Discovery](/tags/#domain-trust-discovery), [Remote System Discovery](/tags/#remote-system-discovery) | [Discovery](/tags/#discovery) |
+| [Double Zero Destructor](double_zero_destructor) | [Masquerading](/tags/#masquerading), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Modify Registry](/tags/#modify-registry), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [Dynamic DNS](dynamic_dns) | [Web Protocols](/tags/#web-protocols), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [Drive-by Compromise](/tags/#drive-by-compromise) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration), [Initial Access](/tags/#initial-access) |
 | [Emotet Malware  DHS Report TA18-201A ](emotet_malware__dhs_report_ta18-201a_) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing), [Software Deployment Tools](/tags/#software-deployment-tools), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services) | [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [F5 TMUI RCE CVE-2020-5902](f5_tmui_rce_cve-2020-5902) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
-| [FIN7](fin7) | [System Owner/User Discovery](/tags/#system-owner/user-discovery), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Visual Basic](/tags/#visual-basic), [Process Injection](/tags/#process-injection), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation), [XSL Script Processing](/tags/#xsl-script-processing) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
+| [FIN7](fin7) | [System Owner/User Discovery](/tags/#system-owner/user-discovery), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript/JScript](/tags/#javascript/jscript), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Visual Basic](/tags/#visual-basic), [Process Injection](/tags/#process-injection), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation), [XSL Script Processing](/tags/#xsl-script-processing) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [GCP Cross Account Activity](gcp_cross_account_activity) | [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [HAFNIUM Group](hafnium_group) | [LSASS Memory](/tags/#lsass-memory), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell), [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [OS Credential Dumping](/tags/#os-credential-dumping), [NTDS](/tags/#ntds), [Email Collection](/tags/#email-collection), [Remote Email Collection](/tags/#remote-email-collection) | [Collection](/tags/#collection), [Credential Access](/tags/#credential-access), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence) |
 | [Hermetic Wiper](hermetic_wiper) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Masquerading](/tags/#masquerading), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Data Destruction](/tags/#data-destruction), [Modify Registry](/tags/#modify-registry), [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [Hidden Cobra Malware](hidden_cobra_malware) | [PowerShell](/tags/#powershell), [Windows Command Shell](/tags/#windows-command-shell), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Network Share Connection Removal](/tags/#network-share-connection-removal), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services), [File Transfer Protocols](/tags/#file-transfer-protocols), [Application Layer Protocol](/tags/#application-layer-protocol), [DNS](/tags/#dns), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Lateral Movement](/tags/#lateral-movement) |
 | [Host Redirection](host_redirection) | [Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol](/tags/#exfiltration-over-unencrypted/obfuscated-non-c2-protocol), [DNS](/tags/#dns) | [Command And Control](/tags/#command-and-control), [Exfiltration](/tags/#exfiltration) |
-| [IcedID](icedid) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell), [Process Injection](/tags/#process-injection), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Modify Registry](/tags/#modify-registry), [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Regsvr32](/tags/#regsvr32), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data from Local System](/tags/#data-from-local-system), [Scheduled Task](/tags/#scheduled-task) | [Collection](/tags/#collection), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
+| [IcedID](icedid) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell), [Process Injection](/tags/#process-injection), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file), [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Modify Registry](/tags/#modify-registry), [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Regsvr32](/tags/#regsvr32), [Rundll32](/tags/#rundll32), [Scheduled Task/Job](/tags/#scheduled-task/job), [Data from Local System](/tags/#data-from-local-system), [Scheduled Task](/tags/#scheduled-task) | [Collection](/tags/#collection), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [Information Sabotage](information_sabotage) | [Transfer Data to Cloud Account](/tags/#transfer-data-to-cloud-account) | [Exfiltration](/tags/#exfiltration) |
 | [Ingress Tool Transfer](ingress_tool_transfer) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell), [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer) | [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence) |
 | [JBoss Vulnerability](jboss_vulnerability) | [System Information Discovery](/tags/#system-information-discovery) | [Discovery](/tags/#discovery) |
 | [Kubernetes Scanning Activity](kubernetes_scanning_activity) | [Cloud Service Discovery](/tags/#cloud-service-discovery) | [Discovery](/tags/#discovery) |
 | [Kubernetes Sensitive Object Access Activity]() | None | None |
 | [Kubernetes Sensitive Role Activity]() | None | None |
-| [Linux Persistence Techniques](linux_persistence_techniques) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [At (Linux)](/tags/#at-(linux)), [Linux and Mac File and Directory Permissions Modification](/tags/#linux-and-mac-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Setuid and Setgid](/tags/#setuid-and-setgid), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [RC Scripts](/tags/#rc-scripts), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Unix Shell Configuration Modification](/tags/#unix-shell-configuration-modification), [Event Triggered Execution](/tags/#event-triggered-execution), [SSH Authorized Keys](/tags/#ssh-authorized-keys), [Account Manipulation](/tags/#account-manipulation), [/etc/passwd and /etc/shadow](/tags/#/etc/passwd-and-/etc/shadow), [OS Credential Dumping](/tags/#os-credential-dumping), [Dynamic Linker Hijacking](/tags/#dynamic-linker-hijacking), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Systemd Timers](/tags/#systemd-timers) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
+| [Linux Persistence Techniques](linux_persistence_techniques) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [At (Linux)](/tags/#at-(linux)), [Linux and Mac File and Directory Permissions Modification](/tags/#linux-and-mac-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Setuid and Setgid](/tags/#setuid-and-setgid), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Rc.common](/tags/#rc.common), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [.bash_profile and .bashrc](/tags/#.bash_profile-and-.bashrc), [Event Triggered Execution](/tags/#event-triggered-execution), [SSH Authorized Keys](/tags/#ssh-authorized-keys), [Account Manipulation](/tags/#account-manipulation), [/etc/passwd and /etc/shadow](/tags/#/etc/passwd-and-/etc/shadow), [OS Credential Dumping](/tags/#os-credential-dumping), [LD_PRELOAD](/tags/#ld_preload), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Systemd Timers](/tags/#systemd-timers) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [Linux Post-Exploitation](linux_post-exploitation) | [Unix Shell](/tags/#unix-shell) | [Execution](/tags/#execution) |
-| [Linux Privilege Escalation](linux_privilege_escalation) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [At (Linux)](/tags/#at-(linux)), [Linux and Mac File and Directory Permissions Modification](/tags/#linux-and-mac-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Setuid and Setgid](/tags/#setuid-and-setgid), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [RC Scripts](/tags/#rc-scripts), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Unix Shell Configuration Modification](/tags/#unix-shell-configuration-modification), [Event Triggered Execution](/tags/#event-triggered-execution), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [SSH Authorized Keys](/tags/#ssh-authorized-keys), [Account Manipulation](/tags/#account-manipulation), [/etc/passwd and /etc/shadow](/tags/#/etc/passwd-and-/etc/shadow), [OS Credential Dumping](/tags/#os-credential-dumping), [Dynamic Linker Hijacking](/tags/#dynamic-linker-hijacking), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Systemd Timers](/tags/#systemd-timers) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
-| [Living Off The Land](living_off_the_land) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Control Panel](/tags/#control-panel), [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping), [Compiled HTML File](/tags/#compiled-html-file), [Mshta](/tags/#mshta), [Regsvcs/Regasm](/tags/#regsvcs/regasm), [Regsvr32](/tags/#regsvr32), [Rundll32](/tags/#rundll32), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [LSASS Memory](/tags/#lsass-memory), [Security Account Manager](/tags/#security-account-manager), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Unix Shell](/tags/#unix-shell), [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Process Injection](/tags/#process-injection), [Modify Registry](/tags/#modify-registry), [Scheduled Task/Job](/tags/#scheduled-task/job), [At (Windows)](/tags/#at-(windows)), [Scheduled Task](/tags/#scheduled-task), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service), [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild), [InstallUtil](/tags/#installutil) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
+| [Linux Privilege Escalation](linux_privilege_escalation) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job), [Local Account](/tags/#local-account), [Create Account](/tags/#create-account), [At (Linux)](/tags/#at-(linux)), [Linux and Mac File and Directory Permissions Modification](/tags/#linux-and-mac-file-and-directory-permissions-modification), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Setuid and Setgid](/tags/#setuid-and-setgid), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Rc.common](/tags/#rc.common), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [.bash_profile and .bashrc](/tags/#.bash_profile-and-.bashrc), [Event Triggered Execution](/tags/#event-triggered-execution), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [SSH Authorized Keys](/tags/#ssh-authorized-keys), [Account Manipulation](/tags/#account-manipulation), [/etc/passwd and /etc/shadow](/tags/#/etc/passwd-and-/etc/shadow), [OS Credential Dumping](/tags/#os-credential-dumping), [LD_PRELOAD](/tags/#ld_preload), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Systemd Timers](/tags/#systemd-timers) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
+| [Living Off The Land](living_off_the_land) | [BITS Jobs](/tags/#bits-jobs), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Control Panel](/tags/#control-panel), [NTDS](/tags/#ntds), [OS Credential Dumping](/tags/#os-credential-dumping), [Compiled HTML File](/tags/#compiled-html-file), [Mshta](/tags/#mshta), [Regsvcs/Regasm](/tags/#regsvcs/regasm), [Regsvr32](/tags/#regsvr32), [Rundll32](/tags/#rundll32), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [LSASS Memory](/tags/#lsass-memory), [Security Account Manager](/tags/#security-account-manager), [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Unix Shell](/tags/#unix-shell), [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Process Injection](/tags/#process-injection), [Modify Registry](/tags/#modify-registry), [Scheduled Task/Job](/tags/#scheduled-task/job), [At (Windows)](/tags/#at-(windows)), [Scheduled Task](/tags/#scheduled-task), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Windows Service](/tags/#windows-service), [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities), [MSBuild](/tags/#msbuild), [InstallUtil](/tags/#installutil) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [Log4Shell CVE-2021-44228](log4shell_cve-2021-44228) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell), [Windows Command Shell](/tags/#windows-command-shell), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Command And Control](/tags/#command-and-control), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access) |
 | [Malicious PowerShell](malicious_powershell) | [PowerShell](/tags/#powershell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [OS Credential Dumping](/tags/#os-credential-dumping), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Remote Management](/tags/#windows-remote-management), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Scheduled Task](/tags/#scheduled-task), [Windows Service](/tags/#windows-service), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [Process Injection](/tags/#process-injection), [Deobfuscate/Decode Files or Information](/tags/#deobfuscate/decode-files-or-information), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Impair Defenses](/tags/#impair-defenses) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
 | [Masquerading - Rename System Utilities](masquerading_-_rename_system_utilities) | [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Masquerading](/tags/#masquerading), [Rundll32](/tags/#rundll32), [Data Destruction](/tags/#data-destruction), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [MSBuild](/tags/#msbuild), [InstallUtil](/tags/#installutil) | [Defense Evasion](/tags/#defense-evasion), [Impact](/tags/#impact) |
@@ -89,9 +91,9 @@ sidebar:
 | [ProxyShell](proxyshell) | [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [PowerShell](/tags/#powershell) | [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) |
 | [Ransomware](ransomware) | [Scheduled Task](/tags/#scheduled-task), [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data), [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [File Deletion](/tags/#file-deletion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp), [Data Destruction](/tags/#data-destruction), [User Execution](/tags/#user-execution), [Automated Exfiltration](/tags/#automated-exfiltration), [Domain Account](/tags/#domain-account), [Local Groups](/tags/#local-groups), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Local Account](/tags/#local-account), [Account Discovery](/tags/#account-discovery), [Domain Groups](/tags/#domain-groups), [Permission Groups Discovery](/tags/#permission-groups-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Clear Windows Event Logs](/tags/#clear-windows-event-logs), [Service Stop](/tags/#service-stop), [Account Access Removal](/tags/#account-access-removal), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Visual Basic](/tags/#visual-basic), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Indicator Removal from Tools](/tags/#indicator-removal-from-tools), [Component Object Model Hijacking](/tags/#component-object-model-hijacking), [Event Triggered Execution](/tags/#event-triggered-execution), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Modify Registry](/tags/#modify-registry), [Scheduled Task/Job](/tags/#scheduled-task/job), [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities), [Msiexec](/tags/#msiexec), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [InstallUtil](/tags/#installutil), [Tool](/tags/#tool), [Server Software Component](/tags/#server-software-component), [Web Shell](/tags/#web-shell), [Exploit Public-Facing Application](/tags/#exploit-public-facing-application), [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services), [Application Layer Protocol](/tags/#application-layer-protocol), [Web Protocols](/tags/#web-protocols) | [Collection](/tags/#collection), [Command And Control](/tags/#command-and-control), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Exfiltration](/tags/#exfiltration), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance), [Resource Development](/tags/#resource-development) |
 | [Ransomware Cloud](ransomware_cloud) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) |
-| [Remcos](remcos) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript), [Process Injection](/tags/#process-injection), [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Regsvr32](/tags/#regsvr32), [Modify Registry](/tags/#modify-registry), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Component Object Model](/tags/#component-object-model), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Screen Capture](/tags/#screen-capture), [Visual Basic](/tags/#visual-basic), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | [Collection](/tags/#collection), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
+| [Remcos](remcos) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Masquerading](/tags/#masquerading), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript/JScript](/tags/#javascript/jscript), [Process Injection](/tags/#process-injection), [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Regsvr32](/tags/#regsvr32), [Modify Registry](/tags/#modify-registry), [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Component Object Model](/tags/#component-object-model), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Screen Capture](/tags/#screen-capture), [Visual Basic](/tags/#visual-basic), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Gather Victim Host Information](/tags/#gather-victim-host-information), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | [Collection](/tags/#collection), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
 | [Revil Ransomware](revil_ransomware) | [Disable or Modify Cloud Firewall](/tags/#disable-or-modify-cloud-firewall), [Impair Defenses](/tags/#impair-defenses), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Defacement](/tags/#defacement), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [User Execution](/tags/#user-execution), [Modify Registry](/tags/#modify-registry), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Impact](/tags/#impact), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
-| [Router and Infrastructure Security](router_and_infrastructure_security) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning), [TFTP Boot](/tags/#tftp-boot), [Pre-OS Boot](/tags/#pre-os-boot), [Automated Exfiltration](/tags/#automated-exfiltration), [Traffic Duplication](/tags/#traffic-duplication) | [Collection](/tags/#collection), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Exfiltration](/tags/#exfiltration), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) |
+| [Router and Infrastructure Security](router_and_infrastructure_security) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning), [TFTP Boot](/tags/#tftp-boot), [Pre-OS Boot](/tags/#pre-os-boot), [Automated Exfiltration](/tags/#automated-exfiltration), [Traffic Duplication](/tags/#traffic-duplication) | [Collection](/tags/#collection), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Exfiltration](/tags/#exfiltration), [Impact](/tags/#impact), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence) |
 | [Ryuk Ransomware](ryuk_ransomware) | [Windows Command Shell](/tags/#windows-command-shell), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Data Destruction](/tags/#data-destruction), [Domain Trust Discovery](/tags/#domain-trust-discovery), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Service Stop](/tags/#service-stop), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services) | [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [SQL Injection](sql_injection) | [Exploit Public-Facing Application](/tags/#exploit-public-facing-application) | [Initial Access](/tags/#initial-access) |
 | [SamSam Ransomware](samsam_ransomware) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Masquerading](/tags/#masquerading), [OS Credential Dumping](/tags/#os-credential-dumping), [Active Scanning](/tags/#active-scanning), [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file), [Data Destruction](/tags/#data-destruction), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution), [Data Encrypted for Impact](/tags/#data-encrypted-for-impact), [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [System Information Discovery](/tags/#system-information-discovery) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Reconnaissance](/tags/#reconnaissance) |
@@ -120,7 +122,7 @@ sidebar:
 | [Suspicious Regsvr32 Activity](suspicious_regsvr32_activity) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32), [Modify Registry](/tags/#modify-registry) | [Defense Evasion](/tags/#defense-evasion) |
 | [Suspicious Rundll32 Activity](suspicious_rundll32_activity) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Masquerading](/tags/#masquerading), [Rundll32](/tags/#rundll32), [Rename System Utilities](/tags/#rename-system-utilities), [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion) |
 | [Suspicious WMI Use](suspicious_wmi_use) | [Windows Management Instrumentation Event Subscription](/tags/#windows-management-instrumentation-event-subscription), [Event Triggered Execution](/tags/#event-triggered-execution), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [XSL Script Processing](/tags/#xsl-script-processing) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
-| [Suspicious Windows Registry Activities](suspicious_windows_registry_activities) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Change Default File Association](/tags/#change-default-file-association), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Port Monitors](/tags/#port-monitors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Application Shimming](/tags/#application-shimming), [Event Triggered Execution](/tags/#event-triggered-execution), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
+| [Suspicious Windows Registry Activities](suspicious_windows_registry_activities) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Change Default File Association](/tags/#change-default-file-association), [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Port Monitors](/tags/#port-monitors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Application Shimming](/tags/#application-shimming), [Event Triggered Execution](/tags/#event-triggered-execution), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [Suspicious Zoom Child Processes](suspicious_zoom_child_processes) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Windows Command Shell](/tags/#windows-command-shell), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation) | [Execution](/tags/#execution), [Privilege Escalation](/tags/#privilege-escalation) |
 | [Trickbot](trickbot) | [Domain Account](/tags/#domain-account), [Account Discovery](/tags/#account-discovery), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Process Injection](/tags/#process-injection), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta), [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment), [Scheduled Task/Job](/tags/#scheduled-task/job), [Rundll32](/tags/#rundll32), [Gather Victim Network Information](/tags/#gather-victim-network-information), [IP Addresses](/tags/#ip-addresses), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter) | [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Initial Access](/tags/#initial-access), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
 | [Trusted Developer Utilities Proxy Execution](trusted_developer_utilities_proxy_execution) | [Masquerading](/tags/#masquerading), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
@@ -131,12 +133,13 @@ sidebar:
 | [Web Fraud Detection](web_fraud_detection) | [Create Account](/tags/#create-account), [Valid Accounts](/tags/#valid-accounts) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [WhisperGate](whispergate) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [Data Destruction](/tags/#data-destruction), [Masquerading](/tags/#masquerading), [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Distributed Component Object Model](/tags/#distributed-component-object-model), [Windows Management Instrumentation](/tags/#windows-management-instrumentation), [Windows Service](/tags/#windows-service), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Virtualization/Sandbox Evasion](/tags/#virtualization/sandbox-evasion), [Time Based Evasion](/tags/#time-based-evasion), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Visual Basic](/tags/#visual-basic), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Rename System Utilities](/tags/#rename-system-utilities), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [InstallUtil](/tags/#installutil), [Tool](/tags/#tool), [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe), [Process Injection](/tags/#process-injection), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Resource Development](/tags/#resource-development) |
 | [Windows DNS SIGRed CVE-2020-1350](windows_dns_sigred_cve-2020-1350) | [Exploitation for Client Execution](/tags/#exploitation-for-client-execution) | [Execution](/tags/#execution) |
-| [Windows Defense Evasion Tactics](windows_defense_evasion_tactics) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Compile After Delivery](/tags/#compile-after-delivery), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Modify Registry](/tags/#modify-registry), [Hide Artifacts](/tags/#hide-artifacts), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Process Injection](/tags/#process-injection), [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | [Defense Evasion](/tags/#defense-evasion), [Privilege Escalation](/tags/#privilege-escalation) |
+| [Windows Defense Evasion Tactics](windows_defense_evasion_tactics) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Compile After Delivery](/tags/#compile-after-delivery), [Obfuscated Files or Information](/tags/#obfuscated-files-or-information), [Modify Registry](/tags/#modify-registry), [Hide Artifacts](/tags/#hide-artifacts), [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Process Injection](/tags/#process-injection), [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution) | [Defense Evasion](/tags/#defense-evasion), [Impact](/tags/#impact), [Privilege Escalation](/tags/#privilege-escalation) |
 | [Windows Discovery Techniques](windows_discovery_techniques) | [Permission Groups Discovery](/tags/#permission-groups-discovery), [Local Groups](/tags/#local-groups) | [Discovery](/tags/#discovery) |
 | [Windows File Extension and Association Abuse](windows_file_extension_and_association_abuse) | [Rename System Utilities](/tags/#rename-system-utilities), [Change Default File Association](/tags/#change-default-file-association), [Masquerading](/tags/#masquerading) | [Defense Evasion](/tags/#defense-evasion), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [Windows Log Manipulation](windows_log_manipulation) | [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion), [Impact](/tags/#impact) |
 | [Windows Persistence Techniques](windows_persistence_techniques) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Active Setup](/tags/#active-setup), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Change Default File Association](/tags/#change-default-file-association), [Event Triggered Execution](/tags/#event-triggered-execution), [Path Interception by Unquoted Path](/tags/#path-interception-by-unquoted-path), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Indicator Blocking](/tags/#indicator-blocking), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Impair Defenses](/tags/#impair-defenses), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Logon Script (Windows)](/tags/#logon-script-(windows)), [Port Monitors](/tags/#port-monitors), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Application Shimming](/tags/#application-shimming), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Scheduled Task/Job](/tags/#scheduled-task/job), [Scheduled Task](/tags/#scheduled-task), [Screensaver](/tags/#screensaver), [Time Providers](/tags/#time-providers), [Print Processors](/tags/#print-processors) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [Windows Privilege Escalation](windows_privilege_escalation) | [Malicious File](/tags/#malicious-file), [Active Setup](/tags/#active-setup), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Change Default File Association](/tags/#change-default-file-association), [Event Triggered Execution](/tags/#event-triggered-execution), [Indicator Blocking](/tags/#indicator-blocking), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Impair Defenses](/tags/#impair-defenses), [Steal or Forge Kerberos Tickets](/tags/#steal-or-forge-kerberos-tickets), [Kerberoasting](/tags/#kerberoasting), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts), [Logon Script (Windows)](/tags/#logon-script-(windows)), [DLL Side-Loading](/tags/#dll-side-loading), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Accessibility Features](/tags/#accessibility-features), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Access Token Manipulation](/tags/#access-token-manipulation), [Token Impersonation/Theft](/tags/#token-impersonation/theft), [Screensaver](/tags/#screensaver), [Time Providers](/tags/#time-providers), [Exploitation for Privilege Escalation](/tags/#exploitation-for-privilege-escalation), [Print Processors](/tags/#print-processors) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
+| [Windows Registry Abuse](windows_registry_abuse) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism), [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping), [Credentials in Registry](/tags/#credentials-in-registry), [Unsecured Credentials](/tags/#unsecured-credentials), [Change Default File Association](/tags/#change-default-file-association), [Event Triggered Execution](/tags/#event-triggered-execution), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Modify Registry](/tags/#modify-registry), [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Hide Artifacts](/tags/#hide-artifacts), [Bypass User Access Control](/tags/#bypass-user-access-control), [Inhibit System Recovery](/tags/#inhibit-system-recovery), [Indicator Blocking](/tags/#indicator-blocking), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Defacement](/tags/#defacement), [Port Monitors](/tags/#port-monitors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution), [Application Shimming](/tags/#application-shimming), [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Screensaver](/tags/#screensaver), [Time Providers](/tags/#time-providers), [Data Destruction](/tags/#data-destruction), [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness) | [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Impact](/tags/#impact), [Lateral Movement](/tags/#lateral-movement), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [Windows Service Abuse](windows_service_abuse) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness), [Hijack Execution Flow](/tags/#hijack-execution-flow), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process), [System Services](/tags/#system-services), [Service Execution](/tags/#service-execution) | [Defense Evasion](/tags/#defense-evasion), [Execution](/tags/#execution), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
 | [XMRig](xmrig) | [Match Legitimate Name or Location](/tags/#match-legitimate-name-or-location), [Masquerading](/tags/#masquerading), [OS Credential Dumping](/tags/#os-credential-dumping), [Active Scanning](/tags/#active-scanning), [Account Access Removal](/tags/#account-access-removal), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses), [Ingress Tool Transfer](/tags/#ingress-tool-transfer), [Account Discovery](/tags/#account-discovery), [Service Stop](/tags/#service-stop), [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Scheduled Task/Job](/tags/#scheduled-task/job), [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Command And Control](/tags/#command-and-control), [Credential Access](/tags/#credential-access), [Defense Evasion](/tags/#defense-evasion), [Discovery](/tags/#discovery), [Execution](/tags/#execution), [Impact](/tags/#impact), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation), [Reconnaissance](/tags/#reconnaissance) |
 | [sAMAccountName Spoofing and Domain Controller Impersonation](samaccountname_spoofing_and_domain_controller_impersonation) | [Valid Accounts](/tags/#valid-accounts), [Domain Accounts](/tags/#domain-accounts) | [Defense Evasion](/tags/#defense-evasion), [Initial Access](/tags/#initial-access), [Persistence](/tags/#persistence), [Privilege Escalation](/tags/#privilege-escalation) |
\ No newline at end of file
diff --git a/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md b/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md
index 13e88bfe68..d4f617dba0 100644
--- a/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md
+++ b/docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md
@@ -43,8 +43,8 @@ The search is used to detect systems that are still vulnerable to the Spectre an
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `spectre_and_meltdown_vulnerable_systems_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md
index 77db541995..e1fb79677e 100644
--- a/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md
+++ b/docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md
@@ -46,8 +46,8 @@ The search queries the authentication logs for assets that are categorized as ro
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_new_login_attempts_to_routers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md
index 8f3da14f0b..0da1540e29 100644
--- a/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md
+++ b/docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md
@@ -49,8 +49,8 @@ This search looks for Windows endpoints that have not generated an event indicat
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `no_windows_updates_in_a_time_frame_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md
index 309c3f1e42..9479c4d05c 100644
--- a/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md
+++ b/docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md
@@ -47,8 +47,8 @@ Attackers often use spaces as a means to obfuscate an attachment's file extensio
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `email_attachments_with_lots_of_spaces_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md
index a334f45f22..63e7b15f1e 100644
--- a/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md
+++ b/docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md
@@ -54,8 +54,8 @@ This search looks for specific GET or HEAD requests to web servers that are indi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_attackers_scanning_for_vulnerable_jboss_servers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md
index 0529aa15c5..0b4126e2fd 100644
--- a/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md
+++ b/docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md
@@ -46,8 +46,8 @@ This search is used to detect malicious HTTP requests crafted to exploit jmx-con
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_malicious_requests_to_exploit_jboss_servers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md
index c9b1c1a70d..6608e3da3e 100644
--- a/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md
+++ b/docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md
@@ -42,9 +42,9 @@ This search looks for DNS requests for faux domains similar to the domains that
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [brand_abuse_dns](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_dns.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `monitor_dns_for_brand_abuse_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md
index bcee7b8f25..512bead6ba 100644
--- a/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md
+++ b/docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md
@@ -45,8 +45,8 @@ This search looks for Web requests to faux domains similar to the one that you w
 #### Macros
 The SPL above uses the following Macros:
 * [brand_abuse_web](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_web.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `monitor_web_traffic_for_brand_abuse_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2017-11-27-detect_usb_device_insertion.md b/docs/_posts/2017-11-27-detect_usb_device_insertion.md
index d611b6f1e0..66100d64d2 100644
--- a/docs/_posts/2017-11-27-detect_usb_device_insertion.md
+++ b/docs/_posts/2017-11-27-detect_usb_device_insertion.md
@@ -42,8 +42,8 @@ The search is used to detect hosts that generate Windows Event ID 4663 for succe
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_usb_device_insertion_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md
index 1f5e7ffcb9..200cd86cb5 100644
--- a/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md
+++ b/docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md
@@ -49,8 +49,8 @@ This search looks for emails claiming to be sent from a domain similar to one th
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `monitor_email_for_brand_abuse_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md
index 16a2bb253f..9ff5b8b882 100644
--- a/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md
+++ b/docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md
@@ -68,8 +68,8 @@ This search will detect users creating spikes in API activity related to securit
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_group_api_calls](https://github.com/splunk/security_content/blob/develop/macros/security_group_api_calls.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
+* [security_group_api_calls](https://github.com/splunk/security_content/blob/develop/macros/security_group_api_calls.yml)
 
 Note that `detect_spike_in_security_group_activity_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md b/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md
index a237be6e55..21ea84053e 100644
--- a/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md
+++ b/docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md
@@ -65,8 +65,8 @@ This search will detect users creating spikes in API activity related to network
 
 #### Macros
 The SPL above uses the following Macros:
-* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 * [network_acl_events](https://github.com/splunk/security_content/blob/develop/macros/network_acl_events.yml)
+* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 Note that `detect_spike_in_network_acl_activity_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md
index 4975a74a3d..30c99ffe4c 100644
--- a/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md
+++ b/docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md
@@ -55,8 +55,8 @@ This search looks for outbound ICMP packets with a packet size larger than 1,000
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_large_outbound_icmp_packets_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2018-11-02-windows_hosts_file_modification.md b/docs/_posts/2018-11-02-windows_hosts_file_modification.md
index 692a542af3..bdb2f9216b 100644
--- a/docs/_posts/2018-11-02-windows_hosts_file_modification.md
+++ b/docs/_posts/2018-11-02-windows_hosts_file_modification.md
@@ -42,8 +42,8 @@ The search looks for modifications to the hosts file on all Windows endpoints ac
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_hosts_file_modification_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md
index e07ca41a84..756c6d6dc4 100644
--- a/docs/_posts/2018-12-03-remote_wmi_command_attempt.md
+++ b/docs/_posts/2018-12-03-remote_wmi_command_attempt.md
@@ -52,9 +52,9 @@ The following analytic identifies usage of `wmic.exe` spawning a local or remote
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `remote_wmi_command_attempt_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2018-12-03-usn_journal_deletion.md b/docs/_posts/2018-12-03-usn_journal_deletion.md
index 3677c317ec..2d0e35b332 100644
--- a/docs/_posts/2018-12-03-usn_journal_deletion.md
+++ b/docs/_posts/2018-12-03-usn_journal_deletion.md
@@ -53,8 +53,8 @@ The fsutil.exe application is a legitimate Windows utility used to perform tasks
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `usn_journal_deletion_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2018-12-06-suspicious_java_classes.md b/docs/_posts/2018-12-06-suspicious_java_classes.md
index b6a974b408..858b4ce181 100644
--- a/docs/_posts/2018-12-06-suspicious_java_classes.md
+++ b/docs/_posts/2018-12-06-suspicious_java_classes.md
@@ -45,8 +45,8 @@ This search looks for suspicious Java classes that are often used to exploit rem
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `suspicious_java_classes_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2018-12-14-file_with_samsam_extension.md b/docs/_posts/2018-12-14-file_with_samsam_extension.md
index 0014b6c7bc..5b753f1e80 100644
--- a/docs/_posts/2018-12-14-file_with_samsam_extension.md
+++ b/docs/_posts/2018-12-14-file_with_samsam_extension.md
@@ -44,8 +44,8 @@ The search looks for file writes with extensions consistent with a SamSam ransom
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `file_with_samsam_extension_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2018-12-14-samsam_test_file_write.md b/docs/_posts/2018-12-14-samsam_test_file_write.md
index aefe5b1492..2f04906b35 100644
--- a/docs/_posts/2018-12-14-samsam_test_file_write.md
+++ b/docs/_posts/2018-12-14-samsam_test_file_write.md
@@ -52,8 +52,8 @@ The search looks for a file named "test.txt" written to the windows system direc
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `samsam_test_file_write_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md b/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md
index ab92fd440f..3fb61e088b 100644
--- a/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md
+++ b/docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md
@@ -53,8 +53,8 @@ The search looks for command-line arguments used to hide a file or directory usi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `reg_exe_used_to_hide_files_directories_via_registry_keys_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md
index f356bb42e9..8e18df3e8c 100644
--- a/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md
+++ b/docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md
@@ -54,8 +54,8 @@ This search looks for suspicious processes on all systems labeled as web servers
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `web_servers_executing_suspicious_processes_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2019-04-25-suspicious_file_write.md b/docs/_posts/2019-04-25-suspicious_file_write.md
index c4afe23271..34cbe53f67 100644
--- a/docs/_posts/2019-04-25-suspicious_file_write.md
+++ b/docs/_posts/2019-04-25-suspicious_file_write.md
@@ -43,8 +43,8 @@ The search looks for files created with names that have been linked to malicious
 #### Macros
 The SPL above uses the following Macros:
 * [suspicious_writes](https://github.com/splunk/security_content/blob/develop/macros/suspicious_writes.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `suspicious_file_write_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md
index 1ee6c7a7e1..4b22a75b6d 100644
--- a/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md
+++ b/docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md
@@ -49,8 +49,8 @@ Command lines that are extremely long may be indicative of malicious activity on
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `unusually_long_command_line_-_mltk_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md b/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md
index 76a6a1aab2..1599f11bf1 100644
--- a/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md
+++ b/docs/_posts/2019-10-11-prohibited_software_on_endpoint.md
@@ -43,9 +43,9 @@ This search looks for applications on the endpoint that you have marked as prohi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [prohibited_softwares](https://github.com/splunk/security_content/blob/develop/macros/prohibited_softwares.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `prohibited_software_on_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md
index e44de96439..0d2ba41f6d 100644
--- a/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md
+++ b/docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md
@@ -56,8 +56,8 @@ This search looks for reading lsass memory consistent with credential dumping.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_credential_dumping_through_lsass_access_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md
index 33a0d490ea..9da1f773c1 100644
--- a/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md
+++ b/docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md
@@ -57,8 +57,8 @@ This search looks for reading loaded Images unique to credential dumping with Mi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_mimikatz_using_loaded_images_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md
index d0dd8213a1..e73fcf5db8 100644
--- a/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md
+++ b/docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md
@@ -56,8 +56,8 @@ Detect memory dumping of the LSASS process.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `access_lsass_memory_for_dump_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md
index e9bec5ab10..394187a142 100644
--- a/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md
+++ b/docs/_posts/2019-12-06-create_remote_thread_into_lsass.md
@@ -56,8 +56,8 @@ Detect remote thread creation into LSASS consistent with credential dumping.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `create_remote_thread_into_lsass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md
index 7aaa26ddda..d3a57d3f89 100644
--- a/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md
+++ b/docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md
@@ -51,8 +51,8 @@ This search detects loading of unsigned images by LSASS. Deprecated because too
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `unsigned_image_loaded_by_lsass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2019-12-10-creation_of_shadow_copy.md b/docs/_posts/2019-12-10-creation_of_shadow_copy.md
index ff88351c6f..b0d9f05e1d 100644
--- a/docs/_posts/2019-12-10-creation_of_shadow_copy.md
+++ b/docs/_posts/2019-12-10-creation_of_shadow_copy.md
@@ -57,8 +57,8 @@ Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `creation_of_shadow_copy_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md
index 44445649f8..bb74d725df 100644
--- a/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md
+++ b/docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md
@@ -66,8 +66,8 @@ This search allows you to identify DNS requests that are unusually large for the
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `dns_query_length_outliers_-_mltk_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md b/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md
index 71429e974f..e60d4c19b6 100644
--- a/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md
+++ b/docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md
@@ -82,6 +82,7 @@ unknown
 
 #### Associated Analytic story
 * [BlackMatter Ransomware](/stories/blackmatter_ransomware)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md b/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md
index d6e5d5d545..ea6b832ec0 100644
--- a/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md
+++ b/docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md
@@ -86,6 +86,7 @@ You will encounter noise from legitimate print-monitor registry entries.
 #### Associated Analytic story
 * [Suspicious Windows Registry Activities](/stories/suspicious_windows_registry_activities)
 * [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md b/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md
index 2a4486c619..7ae3c48e36 100644
--- a/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md
+++ b/docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md
@@ -84,6 +84,7 @@ There are many legitimate applications that leverage shim databases for compatib
 #### Associated Analytic story
 * [Suspicious Windows Registry Activities](/stories/suspicious_windows_registry_activities)
 * [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2020-01-28-sdclt_uac_bypass.md b/docs/_posts/2020-01-28-sdclt_uac_bypass.md
index 229d2c86a0..632314d784 100644
--- a/docs/_posts/2020-01-28-sdclt_uac_bypass.md
+++ b/docs/_posts/2020-01-28-sdclt_uac_bypass.md
@@ -1,6 +1,6 @@
 ---
 title: "Sdclt UAC Bypass"
-excerpt: "Bypass User Account Control
+excerpt: "Bypass User Access Control
 , Abuse Elevation Control Mechanism
 "
 categories:
@@ -9,7 +9,7 @@ last_modified_at: 2020-01-28
 toc: true
 toc_label: ""
 tags:
-  - Bypass User Account Control
+  - Bypass User Access Control
   - Abuse Elevation Control Mechanism
   - Defense Evasion
   - Privilege Escalation
@@ -42,7 +42,7 @@ This search is to detect a suspicious sdclt.exe registry modification. This tech
 
 | ID             | Technique        |  Tactic             |
 | -------------- | ---------------- |-------------------- |
-| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Defense Evasion, Privilege Escalation |
+| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Access Control | Defense Evasion, Privilege Escalation |
 
 | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
 
@@ -84,6 +84,7 @@ Limited to no false positives are expected.
 
 #### Associated Analytic story
 * [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md b/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md
index d8d8176aca..48a437c8e9 100644
--- a/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md
+++ b/docs/_posts/2020-01-28-silentcleanup_uac_bypass.md
@@ -1,6 +1,6 @@
 ---
 title: "SilentCleanup UAC Bypass"
-excerpt: "Bypass User Account Control
+excerpt: "Bypass User Access Control
 , Abuse Elevation Control Mechanism
 "
 categories:
@@ -9,7 +9,7 @@ last_modified_at: 2020-01-28
 toc: true
 toc_label: ""
 tags:
-  - Bypass User Account Control
+  - Bypass User Access Control
   - Abuse Elevation Control Mechanism
   - Defense Evasion
   - Privilege Escalation
@@ -42,7 +42,7 @@ This search is to detect a suspicious modification of registry that may related
 
 | ID             | Technique        |  Tactic             |
 | -------------- | ---------------- |-------------------- |
-| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Defense Evasion, Privilege Escalation |
+| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Access Control | Defense Evasion, Privilege Escalation |
 
 | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
 
@@ -84,6 +84,7 @@ unknown
 
 #### Associated Analytic story
 * [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2020-01-28-wsreset_uac_bypass.md b/docs/_posts/2020-01-28-wsreset_uac_bypass.md
index c32bea13d8..9c4fcc8082 100644
--- a/docs/_posts/2020-01-28-wsreset_uac_bypass.md
+++ b/docs/_posts/2020-01-28-wsreset_uac_bypass.md
@@ -1,6 +1,6 @@
 ---
 title: "WSReset UAC Bypass"
-excerpt: "Bypass User Account Control
+excerpt: "Bypass User Access Control
 , Abuse Elevation Control Mechanism
 "
 categories:
@@ -9,7 +9,7 @@ last_modified_at: 2020-01-28
 toc: true
 toc_label: ""
 tags:
-  - Bypass User Account Control
+  - Bypass User Access Control
   - Abuse Elevation Control Mechanism
   - Defense Evasion
   - Privilege Escalation
@@ -42,7 +42,7 @@ This search is to detect a suspicious modification of registry related to UAC by
 
 | ID             | Technique        |  Tactic             |
 | -------------- | ---------------- |-------------------- |
-| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Defense Evasion, Privilege Escalation |
+| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Access Control | Defense Evasion, Privilege Escalation |
 
 | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
 
@@ -85,6 +85,7 @@ unknown
 #### Associated Analytic story
 * [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
 * [Living Off The Land](/stories/living_off_the_land)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md
index b6edc36201..e6d790dbf7 100644
--- a/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md
+++ b/docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md
@@ -56,8 +56,8 @@ Detect the hands on keyboard behavior of Windows Task Manager creating a process
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `creation_of_lsass_dump_with_taskmgr_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md
index eecd5c170d..705c6826b7 100644
--- a/docs/_posts/2020-02-07-macos_-_re-opened_applications.md
+++ b/docs/_posts/2020-02-07-macos_-_re-opened_applications.md
@@ -44,8 +44,8 @@ This search looks for processes referencing the plist files that determine which
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `macos_-_re-opened_applications_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-02-20-gcp_gcr_container_uploaded.md b/docs/_posts/2020-02-20-gcp_gcr_container_uploaded.md
index 51aa7a1eef..93f9fc614f 100644
--- a/docs/_posts/2020-02-20-gcp_gcr_container_uploaded.md
+++ b/docs/_posts/2020-02-20-gcp_gcr_container_uploaded.md
@@ -1,6 +1,6 @@
 ---
 title: "GCP GCR container uploaded"
-excerpt: "Implant Internal Image
+excerpt: "Implant Container Image
 "
 categories:
   - Deprecated
@@ -8,7 +8,7 @@ last_modified_at: 2020-02-20
 toc: true
 toc_label: ""
 tags:
-  - Implant Internal Image
+  - Implant Container Image
   - Persistence
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -36,7 +36,7 @@ This search show information on uploaded containers including source user, accou
 
 | ID             | Technique        |  Tactic             |
 | -------------- | ---------------- |-------------------- |
-| [T1525](https://attack.mitre.org/techniques/T1525/) | Implant Internal Image | Persistence |
+| [T1525](https://attack.mitre.org/techniques/T1525/) | Implant Container Image | Persistence |
 
 #### Search
 
diff --git a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md
index 818ac61fdb..06fd0f58d2 100644
--- a/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md
+++ b/docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md
@@ -1,6 +1,6 @@
 ---
 title: "New container uploaded to AWS ECR"
-excerpt: "Implant Internal Image
+excerpt: "Implant Container Image
 "
 categories:
   - Cloud
@@ -8,7 +8,7 @@ last_modified_at: 2020-02-20
 toc: true
 toc_label: ""
 tags:
-  - Implant Internal Image
+  - Implant Container Image
   - Persistence
   - Splunk Enterprise
   - Splunk Enterprise Security
@@ -38,7 +38,7 @@ This searches show information on uploaded containers including source user, ima
 
 | ID             | Technique        |  Tactic             |
 | -------------- | ---------------- |-------------------- |
-| [T1525](https://attack.mitre.org/techniques/T1525/) | Implant Internal Image | Persistence |
+| [T1525](https://attack.mitre.org/techniques/T1525/) | Implant Container Image | Persistence |
 
 #### Search
 
diff --git a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md
index 9d6e30438a..abec47f5a3 100644
--- a/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md
+++ b/docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md
@@ -57,9 +57,9 @@ Detect the usage of comsvcs.dll for dumping the lsass process.
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 
 Note that `dump_lsass_via_comsvcs_dll_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-03-02-remote_registry_key_modifications.md b/docs/_posts/2020-03-02-remote_registry_key_modifications.md
index 60407739d1..74be46388f 100644
--- a/docs/_posts/2020-03-02-remote_registry_key_modifications.md
+++ b/docs/_posts/2020-03-02-remote_registry_key_modifications.md
@@ -41,8 +41,8 @@ This search monitors for remote modifications to registry keys.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `remote_registry_key_modifications_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md
index 84010add1e..37598bb9fc 100644
--- a/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md
+++ b/docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md
@@ -55,8 +55,8 @@ This search looks for child processes of spoolsv.exe. This activity is associate
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `child_processes_of_spoolsv_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-03-16-detect_rare_executables.md b/docs/_posts/2020-03-16-detect_rare_executables.md
index a049ab04bc..08da49276d 100644
--- a/docs/_posts/2020-03-16-detect_rare_executables.md
+++ b/docs/_posts/2020-03-16-detect_rare_executables.md
@@ -51,9 +51,9 @@ This search will return a table of rare processes, the names of the systems runn
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [filter_rare_process_allow_list](https://github.com/splunk/security_content/blob/develop/macros/filter_rare_process_allow_list.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `detect_rare_executables_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-03-16-process_execution_via_wmi.md b/docs/_posts/2020-03-16-process_execution_via_wmi.md
index 21e2aca51c..bec82ca78c 100644
--- a/docs/_posts/2020-03-16-process_execution_via_wmi.md
+++ b/docs/_posts/2020-03-16-process_execution_via_wmi.md
@@ -52,8 +52,8 @@ The following analytic identifies `WmiPrvSE.exe` spawning a process. This typica
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `process_execution_via_wmi_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-03-16-script_execution_via_wmi.md b/docs/_posts/2020-03-16-script_execution_via_wmi.md
index 261fc2113c..bd309124de 100644
--- a/docs/_posts/2020-03-16-script_execution_via_wmi.md
+++ b/docs/_posts/2020-03-16-script_execution_via_wmi.md
@@ -52,8 +52,8 @@ This search looks for scripts launched via WMI.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `script_execution_via_wmi_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md
index a92893c22e..759b36fe32 100644
--- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md
+++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md
@@ -53,8 +53,8 @@ This search provides information of unauthenticated requests via user agent, and
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `amazon_eks_kubernetes_cluster_scan_detection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md
index a974b99e47..c1ee12f9f6 100644
--- a/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md
+++ b/docs/_posts/2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md
@@ -53,8 +53,8 @@ This search provides detection information on unauthenticated requests against K
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [aws_cloudwatchlogs_eks](https://github.com/splunk/security_content/blob/develop/macros/aws_cloudwatchlogs_eks.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `amazon_eks_kubernetes_pod_scan_detection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md
index 7be87684a1..61770f67b7 100644
--- a/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md
+++ b/docs/_posts/2020-05-20-first_time_seen_child_process_of_zoom.md
@@ -56,9 +56,9 @@ This search looks for child processes spawned by zoom.exe or zoom.us that has no
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [previously_seen_zoom_child_processes_window](https://github.com/splunk/security_content/blob/develop/macros/previously_seen_zoom_child_processes_window.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `first_time_seen_child_process_of_zoom_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md
index 9f0ab55a0d..c59e9629e6 100644
--- a/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md
+++ b/docs/_posts/2020-07-03-detect_path_interception_by_creation_of_program_exe.md
@@ -68,8 +68,8 @@ The detection Detect Path Interception By Creation Of program exe is detecting t
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_path_interception_by_creation_of_program_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-06-short_lived_windows_accounts.md b/docs/_posts/2020-07-06-short_lived_windows_accounts.md
index 61bc46fad6..acfaf33ae1 100644
--- a/docs/_posts/2020-07-06-short_lived_windows_accounts.md
+++ b/docs/_posts/2020-07-06-short_lived_windows_accounts.md
@@ -60,8 +60,8 @@ This search detects accounts that were created and deleted in a short time perio
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `short_lived_windows_accounts_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-06-windows_event_log_cleared.md b/docs/_posts/2020-07-06-windows_event_log_cleared.md
index ab412329c3..320c1ac101 100644
--- a/docs/_posts/2020-07-06-windows_event_log_cleared.md
+++ b/docs/_posts/2020-07-06-windows_event_log_cleared.md
@@ -55,8 +55,8 @@ The following analytic utilizes Windows Security Event ID 1102 or System log eve
 
 #### Macros
 The SPL above uses the following Macros:
-* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
+* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_event_log_cleared_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md
index 09f82206e6..62cb27429a 100644
--- a/docs/_posts/2020-07-07-remote_desktop_network_traffic.md
+++ b/docs/_posts/2020-07-07-remote_desktop_network_traffic.md
@@ -59,8 +59,8 @@ This search looks for network traffic on TCP/3389, the default port used by remo
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `remote_desktop_network_traffic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md
index 913fe61a7e..2e95a9e912 100644
--- a/docs/_posts/2020-07-21-attempt_to_stop_security_service.md
+++ b/docs/_posts/2020-07-21-attempt_to_stop_security_service.md
@@ -59,9 +59,9 @@ This search looks for attempts to stop security-related services on the endpoint
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
 
 Note that `attempt_to_stop_security_service_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md
index 9d26a31b71..d5504b0ddb 100644
--- a/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md
+++ b/docs/_posts/2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md
@@ -63,14 +63,14 @@ This search looks for DNS requests for phishing domains that are leveraging Evil
 
 #### Macros
 The SPL above uses the following Macros:
-* [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml)
 * [evilginx_phishlets_amazon](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_amazon.yml)
+* [evilginx_phishlets_google](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_google.yml)
+* [evilginx_phishlets_outlook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_outlook.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml)
+* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml)
 * [evilginx_phishlets_0365](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_0365.yml)
 * [evilginx_phishlets_aws](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_aws.yml)
-* [evilginx_phishlets_facebook](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_facebook.yml)
-* [evilginx_phishlets_github](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_github.yml)
-* [evilginx_phishlets_google](https://github.com/splunk/security_content/blob/develop/macros/evilginx_phishlets_google.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `detect_dns_requests_to_phishing_sites_leveraging_evilginx2_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md
index f7f28ab6d9..f0df49e5bc 100644
--- a/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md
+++ b/docs/_posts/2020-07-21-detect_excessive_user_account_lockouts.md
@@ -65,8 +65,8 @@ This search detects user accounts that have been locked out a relatively high nu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_excessive_user_account_lockouts_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md b/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md
index 40a7662317..399dbeed62 100644
--- a/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md
+++ b/docs/_posts/2020-07-21-detect_long_dns_txt_record_response.md
@@ -56,8 +56,8 @@ This search is used to detect attempts to use DNS tunneling, by calculating the
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_long_dns_txt_record_response_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md
index 1fdb31776a..a677353711 100644
--- a/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md
+++ b/docs/_posts/2020-07-21-detect_outbound_smb_traffic.md
@@ -59,8 +59,8 @@ This search looks for outbound SMB connections made by hosts within your network
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_outbound_smb_traffic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md
index 64510a081a..338bc3d27c 100644
--- a/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md
+++ b/docs/_posts/2020-07-21-detect_outlook_exe_writing_a_zip_file.md
@@ -69,8 +69,8 @@ This search looks for execution of process `outlook.exe` where the process is wr
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_outlook_exe_writing_a_zip_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md
index d52dbb470d..832c645942 100644
--- a/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md
+++ b/docs/_posts/2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md
@@ -57,8 +57,8 @@ This search looks for the execution of the cscript.exe or wscript.exe processes,
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_use_of_cmd_exe_to_launch_script_interpreters_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md
index 2532f7466b..426f59b5dd 100644
--- a/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md
+++ b/docs/_posts/2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md
@@ -52,9 +52,9 @@ This search looks for web connections to dynamic DNS providers.
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [dynamic_dns_web_traffic](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_web_traffic.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `detect_web_traffic_to_dynamic_domain_providers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md
index 9905b1d349..bb3bbbeeb6 100644
--- a/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md
+++ b/docs/_posts/2020-07-21-detection_of_tools_built_by_nirsoft.md
@@ -55,8 +55,8 @@ This search looks for specific command-line arguments that may indicate the exec
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detection_of_tools_built_by_nirsoft_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md
index 0c4798507a..f10187e3b5 100644
--- a/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md
+++ b/docs/_posts/2020-07-21-ec2_instance_modified_with_previously_unseen_user.md
@@ -64,8 +64,8 @@ This search looks for EC2 instances being modified by users who have not previou
 
 #### Macros
 The SPL above uses the following Macros:
-* [ec2_modification_api_calls](https://github.com/splunk/security_content/blob/develop/macros/ec2_modification_api_calls.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [ec2_modification_api_calls](https://github.com/splunk/security_content/blob/develop/macros/ec2_modification_api_calls.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 Note that `ec2_instance_modified_with_previously_unseen_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md
index b0db0ed787..d76b1c60cb 100644
--- a/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md
+++ b/docs/_posts/2020-07-21-email_files_written_outside_of_the_outlook_directory.md
@@ -59,8 +59,8 @@ The search looks at the change-analysis data model and detects email files creat
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `email_files_written_outside_of_the_outlook_directory_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md b/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md
index 401259a350..129e207355 100644
--- a/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md
+++ b/docs/_posts/2020-07-21-first_time_seen_command_line_argument.md
@@ -68,8 +68,8 @@ This search looks for command-line arguments that use a `/c` parameter to execut
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `first_time_seen_command_line_argument_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md
index 4f1df7ade7..f738fba8f4 100644
--- a/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md
+++ b/docs/_posts/2020-07-21-hiding_files_and_directories_with_attrib_exe.md
@@ -57,8 +57,8 @@ Attackers leverage an existing Windows binary, attrib.exe, to mark specific as h
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `hiding_files_and_directories_with_attrib_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md
index 54184b6ed2..2046db7704 100644
--- a/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md
+++ b/docs/_posts/2020-07-21-overwriting_accessibility_binaries.md
@@ -59,8 +59,8 @@ Microsoft Windows contains accessibility features that can be launched with a ke
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `overwriting_accessibility_binaries_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md
index e61a4a521f..f97cbff58d 100644
--- a/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md
+++ b/docs/_posts/2020-07-21-prohibited_network_traffic_allowed.md
@@ -56,8 +56,8 @@ This search looks for network traffic defined by port and transport layer protoc
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `prohibited_network_traffic_allowed_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md
index 4135135727..521f8edaca 100644
--- a/docs/_posts/2020-07-21-protocol_or_port_mismatch.md
+++ b/docs/_posts/2020-07-21-protocol_or_port_mismatch.md
@@ -59,8 +59,8 @@ This search looks for network traffic on common ports where a higher layer proto
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `protocol_or_port_mismatch_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md
index 1912ab8e39..751b405676 100644
--- a/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md
+++ b/docs/_posts/2020-07-21-remote_desktop_process_running_on_system.md
@@ -59,8 +59,8 @@ This search looks for the remote desktop process mstsc.exe running on systems up
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `remote_desktop_process_running_on_system_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md
index cac51fb601..7c92fa2d01 100644
--- a/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md
+++ b/docs/_posts/2020-07-21-sc_exe_manipulating_windows_services.md
@@ -59,8 +59,8 @@ This search looks for arguments to sc.exe indicating the creation or modificatio
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `sc_exe_manipulating_windows_services_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md b/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md
index 1a574ac55e..e65b2935a8 100644
--- a/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md
+++ b/docs/_posts/2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md
@@ -55,8 +55,8 @@ This search looks for flags passed to schtasks.exe on the command-line that indi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `scheduled_tasks_used_in_badrabbit_ransomware_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md b/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md
index d806eb03eb..a88597c517 100644
--- a/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md
+++ b/docs/_posts/2020-07-22-suspicious_changes_to_file_associations.md
@@ -56,8 +56,8 @@ This search looks for changes to registry values that control Windows file assoc
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `suspicious_changes_to_file_associations_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md b/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md
index 5e325f0a4c..882a063af1 100644
--- a/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md
+++ b/docs/_posts/2020-07-22-suspicious_email_-_uba_anomaly.md
@@ -53,8 +53,8 @@ This detection looks for emails that are suspicious because of their sender, dom
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `suspicious_email_-_uba_anomaly_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md
index 4367b775d0..ec8af4e841 100644
--- a/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md
+++ b/docs/_posts/2020-07-22-suspicious_email_attachment_extensions.md
@@ -60,9 +60,9 @@ This search looks for emails that have attachments with suspicious file extensio
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [suspicious_email_attachments](https://github.com/splunk/security_content/blob/develop/macros/suspicious_email_attachments.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `suspicious_email_attachment_extensions_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md
index e581f47272..c4c4f6b66c 100644
--- a/docs/_posts/2020-07-22-suspicious_reg_exe_process.md
+++ b/docs/_posts/2020-07-22-suspicious_reg_exe_process.md
@@ -60,8 +60,8 @@ This search looks for reg.exe being launched from a command prompt not started b
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `suspicious_reg_exe_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md
index de2ae755ee..05a9959e0b 100644
--- a/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md
+++ b/docs/_posts/2020-07-22-suspicious_writes_to_system_volume_information.md
@@ -50,8 +50,8 @@ This search detects writes to the 'System Volume Information' folder by somethin
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `suspicious_writes_to_system_volume_information_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-22-tor_traffic.md b/docs/_posts/2020-07-22-tor_traffic.md
index 37da246a1a..f7a117683e 100644
--- a/docs/_posts/2020-07-22-tor_traffic.md
+++ b/docs/_posts/2020-07-22-tor_traffic.md
@@ -59,8 +59,8 @@ This search looks for network traffic identified as The Onion Router (TOR), a be
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `tor_traffic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md
index c9a2a1564a..5184281356 100644
--- a/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md
+++ b/docs/_posts/2020-07-22-uncommon_processes_on_endpoint.md
@@ -53,9 +53,9 @@ This search looks for applications on the endpoint that you have marked as uncom
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [uncommon_processes](https://github.com/splunk/security_content/blob/develop/macros/uncommon_processes.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `uncommon_processes_on_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md b/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md
index fbcfcc12d1..4efde74620 100644
--- a/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md
+++ b/docs/_posts/2020-07-22-unload_sysmon_filter_driver.md
@@ -58,8 +58,8 @@ Attackers often disable security tools to avoid detection. This search looks for
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `unload_sysmon_filter_driver_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md
index 6a5aa66c7c..67858fb07e 100644
--- a/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md
+++ b/docs/_posts/2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md
@@ -58,8 +58,8 @@ This search detects SIGRed via Splunk Stream.
 
 #### Macros
 The SPL above uses the following Macros:
-* [stream_tcp](https://github.com/splunk/security_content/blob/develop/macros/stream_tcp.yml)
 * [stream_dns](https://github.com/splunk/security_content/blob/develop/macros/stream_dns.yml)
+* [stream_tcp](https://github.com/splunk/security_content/blob/develop/macros/stream_tcp.yml)
 
 Note that `detect_windows_dns_sigred_via_splunk_stream_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md
index 261a7c6cee..4b312b0413 100644
--- a/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md
+++ b/docs/_posts/2020-07-29-cloud_instance_modified_by_previously_unseen_user.md
@@ -68,8 +68,8 @@ This search looks for cloud instances being modified by users who have not previ
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `cloud_instance_modified_by_previously_unseen_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-08-11-detect_arp_poisoning.md b/docs/_posts/2020-08-11-detect_arp_poisoning.md
index d09822c16d..9a7f5a8ed0 100644
--- a/docs/_posts/2020-08-11-detect_arp_poisoning.md
+++ b/docs/_posts/2020-08-11-detect_arp_poisoning.md
@@ -2,7 +2,7 @@
 title: "Detect ARP Poisoning"
 excerpt: "Hardware Additions
 , Network Denial of Service
-, Adversary-in-the-Middle
+, Man-in-the-Middle
 , ARP Cache Poisoning
 "
 categories:
@@ -13,7 +13,7 @@ toc_label: ""
 tags:
   - Hardware Additions
   - Network Denial of Service
-  - Adversary-in-the-Middle
+  - Man-in-the-Middle
   - ARP Cache Poisoning
   - Initial Access
   - Impact
@@ -53,7 +53,7 @@ By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organiza
 
 | [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact |
 
-| [T1557](https://attack.mitre.org/techniques/T1557/) | Adversary-in-the-Middle | Collection, Credential Access |
+| [T1557](https://attack.mitre.org/techniques/T1557/) | Man-in-the-Middle | Collection, Credential Access |
 
 | [T1557.002](https://attack.mitre.org/techniques/T1557/002/) | ARP Cache Poisoning | Collection, Credential Access |
 
@@ -70,8 +70,8 @@ By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organiza
 
 #### Macros
 The SPL above uses the following Macros:
-* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
 
 Note that `detect_arp_poisoning_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md
index 678ffae041..066ac1eac4 100644
--- a/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md
+++ b/docs/_posts/2020-08-11-detect_rogue_dhcp_server.md
@@ -2,7 +2,7 @@
 title: "Detect Rogue DHCP Server"
 excerpt: "Hardware Additions
 , Network Denial of Service
-, Adversary-in-the-Middle
+, Man-in-the-Middle
 "
 categories:
   - Network
@@ -12,7 +12,7 @@ toc_label: ""
 tags:
   - Hardware Additions
   - Network Denial of Service
-  - Adversary-in-the-Middle
+  - Man-in-the-Middle
   - Initial Access
   - Impact
   - Collection
@@ -49,7 +49,7 @@ By enabling DHCP Snooping as a Layer 2 Security measure on the organization's ne
 
 | [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact |
 
-| [T1557](https://attack.mitre.org/techniques/T1557/) | Adversary-in-the-Middle | Collection, Credential Access |
+| [T1557](https://attack.mitre.org/techniques/T1557/) | Man-in-the-Middle | Collection, Credential Access |
 
 #### Search
 
@@ -63,8 +63,8 @@ By enabling DHCP Snooping as a Layer 2 Security measure on the organization's ne
 
 #### Macros
 The SPL above uses the following Macros:
-* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
 
 Note that `detect_rogue_dhcp_server_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md
index a73dd7eae2..6425c8d6ac 100644
--- a/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md
+++ b/docs/_posts/2020-09-16-create_or_delete_windows_shares_using_net_exe.md
@@ -58,9 +58,9 @@ This search looks for the creation or deletion of hidden shares using net.exe.
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
 
 Note that `create_or_delete_windows_shares_using_net_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md
index f7ad277be7..b7d7308878 100644
--- a/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md
+++ b/docs/_posts/2020-10-28-detect_ipv6_network_infrastructure_threats.md
@@ -2,7 +2,7 @@
 title: "Detect IPv6 Network Infrastructure Threats"
 excerpt: "Hardware Additions
 , Network Denial of Service
-, Adversary-in-the-Middle
+, Man-in-the-Middle
 , ARP Cache Poisoning
 "
 categories:
@@ -13,7 +13,7 @@ toc_label: ""
 tags:
   - Hardware Additions
   - Network Denial of Service
-  - Adversary-in-the-Middle
+  - Man-in-the-Middle
   - ARP Cache Poisoning
   - Initial Access
   - Impact
@@ -53,7 +53,7 @@ By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organiz
 
 | [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact |
 
-| [T1557](https://attack.mitre.org/techniques/T1557/) | Adversary-in-the-Middle | Collection, Credential Access |
+| [T1557](https://attack.mitre.org/techniques/T1557/) | Man-in-the-Middle | Collection, Credential Access |
 
 | [T1557.002](https://attack.mitre.org/techniques/T1557/002/) | ARP Cache Poisoning | Collection, Credential Access |
 
@@ -72,8 +72,8 @@ By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organiz
 
 #### Macros
 The SPL above uses the following Macros:
-* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
 
 Note that `detect_ipv6_network_infrastructure_threats_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-10-28-detect_port_security_violation.md b/docs/_posts/2020-10-28-detect_port_security_violation.md
index ae5f12d539..7c4f89f113 100644
--- a/docs/_posts/2020-10-28-detect_port_security_violation.md
+++ b/docs/_posts/2020-10-28-detect_port_security_violation.md
@@ -2,7 +2,7 @@
 title: "Detect Port Security Violation"
 excerpt: "Hardware Additions
 , Network Denial of Service
-, Adversary-in-the-Middle
+, Man-in-the-Middle
 , ARP Cache Poisoning
 "
 categories:
@@ -13,7 +13,7 @@ toc_label: ""
 tags:
   - Hardware Additions
   - Network Denial of Service
-  - Adversary-in-the-Middle
+  - Man-in-the-Middle
   - ARP Cache Poisoning
   - Initial Access
   - Impact
@@ -53,7 +53,7 @@ By enabling Port Security on a Cisco switch you can restrict input to an interfa
 
 | [T1498](https://attack.mitre.org/techniques/T1498/) | Network Denial of Service | Impact |
 
-| [T1557](https://attack.mitre.org/techniques/T1557/) | Adversary-in-the-Middle | Collection, Credential Access |
+| [T1557](https://attack.mitre.org/techniques/T1557/) | Man-in-the-Middle | Collection, Credential Access |
 
 | [T1557.002](https://attack.mitre.org/techniques/T1557/002/) | ARP Cache Poisoning | Collection, Credential Access |
 
@@ -70,8 +70,8 @@ By enabling Port Security on a Cisco switch you can restrict input to an interfa
 
 #### Macros
 The SPL above uses the following Macros:
-* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
 
 Note that `detect_port_security_violation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md
index 38738b3f46..7dc5ae6fad 100644
--- a/docs/_posts/2020-10-28-detect_software_download_to_network_device.md
+++ b/docs/_posts/2020-10-28-detect_software_download_to_network_device.md
@@ -61,8 +61,8 @@ Adversaries may abuse netbooting to load an unauthorized network device operatin
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_software_download_to_network_device_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-10-28-detect_traffic_mirroring.md b/docs/_posts/2020-10-28-detect_traffic_mirroring.md
index ed7fbe2c97..9765cf0211 100644
--- a/docs/_posts/2020-10-28-detect_traffic_mirroring.md
+++ b/docs/_posts/2020-10-28-detect_traffic_mirroring.md
@@ -67,8 +67,8 @@ Adversaries may leverage traffic mirroring in order to automate data exfiltratio
 
 #### Macros
 The SPL above uses the following Macros:
-* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [cisco_networks](https://github.com/splunk/security_content/blob/develop/macros/cisco_networks.yml)
 
 Note that `detect_traffic_mirroring_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-11-06-ryuk_test_files_detected.md b/docs/_posts/2020-11-06-ryuk_test_files_detected.md
index e2b5bcf991..8c5111b361 100644
--- a/docs/_posts/2020-11-06-ryuk_test_files_detected.md
+++ b/docs/_posts/2020-11-06-ryuk_test_files_detected.md
@@ -51,8 +51,8 @@ The search looks for files that contain the key word *Ryuk* under any folder in
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `ryuk_test_files_detected_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md b/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md
index e0b308b035..a15f2d8b61 100644
--- a/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md
+++ b/docs/_posts/2020-11-06-windows_connhost_exe_started_forcefully.md
@@ -51,8 +51,8 @@ The search looks for the Console Window Host process (connhost.exe) executed usi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_connhost_exe_started_forcefully_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md
index 3e84dae4d9..be1438af10 100644
--- a/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md
+++ b/docs/_posts/2020-11-06-windows_security_account_manager_stopped.md
@@ -51,8 +51,8 @@ The search looks for a Windows Security Account Manager (SAM) was stopped via co
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_security_account_manager_stopped_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-11-09-common_ransomware_extensions.md b/docs/_posts/2020-11-09-common_ransomware_extensions.md
index 0de6f8b3cd..30ea6ab5c4 100644
--- a/docs/_posts/2020-11-09-common_ransomware_extensions.md
+++ b/docs/_posts/2020-11-09-common_ransomware_extensions.md
@@ -54,9 +54,9 @@ The search looks for file modifications with extensions commonly used by Ransomw
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [ransomware_extensions](https://github.com/splunk/security_content/blob/develop/macros/ransomware_extensions.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `common_ransomware_extensions_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-11-09-common_ransomware_notes.md b/docs/_posts/2020-11-09-common_ransomware_notes.md
index afa8f96d8a..bd483edde1 100644
--- a/docs/_posts/2020-11-09-common_ransomware_notes.md
+++ b/docs/_posts/2020-11-09-common_ransomware_notes.md
@@ -53,9 +53,9 @@ The search looks for files created with names matching those typically used in r
 
 #### Macros
 The SPL above uses the following Macros:
-* [ransomware_notes](https://github.com/splunk/security_content/blob/develop/macros/ransomware_notes.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [ransomware_notes](https://github.com/splunk/security_content/blob/develop/macros/ransomware_notes.yml)
 
 Note that `common_ransomware_notes_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-11-09-deleting_shadow_copies.md b/docs/_posts/2020-11-09-deleting_shadow_copies.md
index 930b4405c1..2f1056275c 100644
--- a/docs/_posts/2020-11-09-deleting_shadow_copies.md
+++ b/docs/_posts/2020-11-09-deleting_shadow_copies.md
@@ -52,8 +52,8 @@ The vssadmin.exe utility is used to interact with the Volume Shadow Copy Service
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `deleting_shadow_copies_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md
index 3a461a3d92..7deee3fa0c 100644
--- a/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md
+++ b/docs/_posts/2020-11-09-detect_excessive_account_lockouts_from_endpoint.md
@@ -65,8 +65,8 @@ This search identifies endpoints that have caused a relatively high number of ac
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_excessive_account_lockouts_from_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md
index 3f662f2a90..38ecb06fc6 100644
--- a/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md
+++ b/docs/_posts/2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md
@@ -56,9 +56,9 @@ This search looks for fast execution of processes used for system network config
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [system_network_configuration_discovery_tools](https://github.com/splunk/security_content/blob/develop/macros/system_network_configuration_discovery_tools.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `detect_processes_used_for_system_network_configuration_discovery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md
index 12ca845e21..7aa7803dd6 100644
--- a/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md
+++ b/docs/_posts/2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md
@@ -58,10 +58,10 @@ This search looks for executions of cmd.exe spawned by a process that is often a
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [prohibited_apps_launching_cmd](https://github.com/splunk/security_content/blob/develop/macros/prohibited_apps_launching_cmd.yml)
+* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_prohibited_applications_spawning_cmd_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-11-18-disabling_remote_user_account_control.md b/docs/_posts/2020-11-18-disabling_remote_user_account_control.md
index 1d29bcd717..8471f88db5 100644
--- a/docs/_posts/2020-11-18-disabling_remote_user_account_control.md
+++ b/docs/_posts/2020-11-18-disabling_remote_user_account_control.md
@@ -1,6 +1,6 @@
 ---
 title: "Disabling Remote User Account Control"
-excerpt: "Bypass User Account Control
+excerpt: "Bypass User Access Control
 , Abuse Elevation Control Mechanism
 "
 categories:
@@ -9,7 +9,7 @@ last_modified_at: 2020-11-18
 toc: true
 toc_label: ""
 tags:
-  - Bypass User Account Control
+  - Bypass User Access Control
   - Abuse Elevation Control Mechanism
   - Defense Evasion
   - Privilege Escalation
@@ -41,7 +41,7 @@ The search looks for modifications to registry keys that control the enforcement
 
 | ID             | Technique        |  Tactic             |
 | -------------- | ---------------- |-------------------- |
-| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Defense Evasion, Privilege Escalation |
+| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Access Control | Defense Evasion, Privilege Escalation |
 
 | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
 
@@ -80,6 +80,7 @@ This registry key may be modified via administrators to implement a change in sy
 * [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
 * [Suspicious Windows Registry Activities](/stories/suspicious_windows_registry_activities)
 * [Remcos](/stories/remcos)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md
index 12c2392339..c05567020a 100644
--- a/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md
+++ b/docs/_posts/2020-11-18-execution_of_file_with_multiple_extensions.md
@@ -57,8 +57,8 @@ This search looks for processes launched from files that have double extensions
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `execution_of_file_with_multiple_extensions_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md b/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md
index 256a09e976..422b1813c4 100644
--- a/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md
+++ b/docs/_posts/2020-11-19-execution_of_file_with_spaces_before_extension.md
@@ -52,8 +52,8 @@ This search looks for processes launched from files with at least five spaces in
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `execution_of_file_with_spaces_before_extension_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-11-23-processes_created_by_netsh.md b/docs/_posts/2020-11-23-processes_created_by_netsh.md
index 405d4bb774..f97988ef51 100644
--- a/docs/_posts/2020-11-23-processes_created_by_netsh.md
+++ b/docs/_posts/2020-11-23-processes_created_by_netsh.md
@@ -52,8 +52,8 @@ This search looks for processes launching netsh.exe to execute various commands
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `processes_created_by_netsh_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md
index d85334dab8..a90d33f481 100644
--- a/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md
+++ b/docs/_posts/2020-11-23-shim_database_installation_with_suspicious_parameters.md
@@ -59,8 +59,8 @@ This search detects the process execution and arguments required to silently cre
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `shim_database_installation_with_suspicious_parameters_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md
index 7024a166ca..0ff8ab0ace 100644
--- a/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md
+++ b/docs/_posts/2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md
@@ -61,8 +61,8 @@ The search looks for reg.exe modifying registry keys that define Windows service
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `reg_exe_manipulating_windows_services_registry_keys_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md
index 6c60273063..510d9456cf 100644
--- a/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md
+++ b/docs/_posts/2020-12-07-schtasks_used_for_forcing_a_reboot.md
@@ -61,8 +61,8 @@ This search looks for flags passed to schtasks.exe on the command-line that indi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `schtasks_used_for_forcing_a_reboot_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-12-08-shim_database_file_creation.md b/docs/_posts/2020-12-08-shim_database_file_creation.md
index 42aaca586d..5678f91033 100644
--- a/docs/_posts/2020-12-08-shim_database_file_creation.md
+++ b/docs/_posts/2020-12-08-shim_database_file_creation.md
@@ -58,8 +58,8 @@ This search looks for shim database files being written to default directories.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `shim_database_file_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md
index c0a50a59f6..fc0ae5be17 100644
--- a/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md
+++ b/docs/_posts/2020-12-08-single_letter_process_on_endpoint.md
@@ -60,8 +60,8 @@ This search looks for process names that consist only of a single letter.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `single_letter_process_on_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md
index 9cdbf4da70..7c2a1ab4c9 100644
--- a/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md
+++ b/docs/_posts/2020-12-08-system_processes_run_from_unexpected_locations.md
@@ -60,9 +60,9 @@ During triage, review the parallel processes - what process moved the native Win
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [is_windows_system_file](https://github.com/splunk/security_content/blob/develop/macros/is_windows_system_file.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `system_processes_run_from_unexpected_locations_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-12-08-unusually_long_command_line.md b/docs/_posts/2020-12-08-unusually_long_command_line.md
index 043ed8eb39..088fc53ca4 100644
--- a/docs/_posts/2020-12-08-unusually_long_command_line.md
+++ b/docs/_posts/2020-12-08-unusually_long_command_line.md
@@ -48,8 +48,8 @@ Command lines that are extremely long may be indicative of malicious activity on
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `unusually_long_command_line_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md
index 4bc37c2866..4f1c56a19e 100644
--- a/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md
+++ b/docs/_posts/2020-12-14-sunburst_correlation_dll_and_network_event.md
@@ -55,8 +55,8 @@ The malware sunburst will load the malicious dll by SolarWinds.BusinessLayerHost
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `sunburst_correlation_dll_and_network_event_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md
index 34be73c04b..73c572a94e 100644
--- a/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md
+++ b/docs/_posts/2020-12-21-bcdedit_failure_recovery_modification.md
@@ -52,8 +52,8 @@ This search looks for flags passed to bcdedit.exe modifications to the built-in
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `bcdedit_failure_recovery_modification_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md
index 99c5f10524..240eb8bef9 100644
--- a/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md
+++ b/docs/_posts/2021-01-12-suspicious_microsoft_workflow_compiler_usage.md
@@ -52,9 +52,9 @@ The following analytic identifies microsoft.workflow.compiler.exe usage. microso
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `suspicious_microsoft_workflow_compiler_usage_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_rename.md b/docs/_posts/2021-01-12-suspicious_msbuild_rename.md
index 1a125273e4..596cbc6d91 100644
--- a/docs/_posts/2021-01-12-suspicious_msbuild_rename.md
+++ b/docs/_posts/2021-01-12-suspicious_msbuild_rename.md
@@ -67,9 +67,9 @@ The following analytic identifies renamed instances of msbuild.exe executing. Ms
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml)
 
 Note that `suspicious_msbuild_rename_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md
index c58d094e4d..ad0ef12ee6 100644
--- a/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md
+++ b/docs/_posts/2021-01-12-suspicious_msbuild_spawn.md
@@ -57,9 +57,9 @@ The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavi
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml)
 
 Note that `suspicious_msbuild_spawn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md
index efeeecba3a..fc87220262 100644
--- a/docs/_posts/2021-01-12-suspicious_mshta_child_process.md
+++ b/docs/_posts/2021-01-12-suspicious_mshta_child_process.md
@@ -57,8 +57,8 @@ The following analytic identifies child processes spawning from  "mshta.exe". Th
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `suspicious_mshta_child_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md
index 692ddda2e3..20cf17db37 100644
--- a/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md
+++ b/docs/_posts/2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md
@@ -52,9 +52,9 @@ Malicious actors often abuse legitimate Dynamic DNS services to host malicious p
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [dynamic_dns_providers](https://github.com/splunk/security_content/blob/develop/macros/dynamic_dns_providers.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `detect_hosts_connecting_to_dynamic_domain_providers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md b/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md
index c79890e600..d256511eba 100644
--- a/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md
+++ b/docs/_posts/2021-01-19-suspicious_powershell_command-line_arguments.md
@@ -53,8 +53,8 @@ This search looks for PowerShell processes started with a base64 encoded command
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `suspicious_powershell_command-line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md
index fd4a73b817..a3851293a3 100644
--- a/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md
+++ b/docs/_posts/2021-01-20-detect_rundll32_inline_hta_execution.md
@@ -57,9 +57,9 @@ The following analytic identifies "rundll32.exe" execution with inline protocol
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 
 Note that `detect_rundll32_inline_hta_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md
index b604289530..eeeeebea6b 100644
--- a/docs/_posts/2021-01-20-suspicious_mshta_spawn.md
+++ b/docs/_posts/2021-01-20-suspicious_mshta_spawn.md
@@ -57,8 +57,8 @@ The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `suspicious_mshta_spawn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md
index 54f0b2be26..4258e9291b 100644
--- a/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md
+++ b/docs/_posts/2021-01-22-wbadmin_delete_system_backups.md
@@ -52,8 +52,8 @@ This search looks for flags passed to wbadmin.exe (Windows Backup Administrator
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `wbadmin_delete_system_backups_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md b/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md
index 9aa33b9703..2aa33bc234 100644
--- a/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md
+++ b/docs/_posts/2021-01-25-nltest_domain_trust_discovery.md
@@ -52,8 +52,8 @@ This search looks for the execution of `nltest.exe` with command-line arguments
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `nltest_domain_trust_discovery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md b/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md
index 3dc7597328..944ac55a7c 100644
--- a/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md
+++ b/docs/_posts/2021-01-26-certutil_exe_certificate_extraction.md
@@ -41,8 +41,8 @@ This search looks for arguments to certutil.exe indicating the manipulation or e
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `certutil_exe_certificate_extraction_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md b/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md
index bc467ee498..320a5db85a 100644
--- a/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md
+++ b/docs/_posts/2021-01-26-o365_excessive_sso_logon_errors.md
@@ -11,7 +11,6 @@ tags:
   - Modify Authentication Process
   - Credential Access
   - Defense Evasion
-  - Persistence
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
@@ -38,7 +37,7 @@ This search detects accounts with high number of Single Sign ON (SSO) logon erro
 
 | ID             | Technique        |  Tactic             |
 | -------------- | ---------------- |-------------------- |
-| [T1556](https://attack.mitre.org/techniques/T1556/) | Modify Authentication Process | Credential Access, Defense Evasion, Persistence |
+| [T1556](https://attack.mitre.org/techniques/T1556/) | Modify Authentication Process | Credential Access, Defense Evasion |
 
 #### Search
 
diff --git a/docs/_posts/2021-01-26-revil_registry_entry.md b/docs/_posts/2021-01-26-revil_registry_entry.md
index 162d5f574f..1ea719d826 100644
--- a/docs/_posts/2021-01-26-revil_registry_entry.md
+++ b/docs/_posts/2021-01-26-revil_registry_entry.md
@@ -79,6 +79,7 @@ unknown
 #### Associated Analytic story
 * [Ransomware](/stories/ransomware)
 * [Revil Ransomware](/stories/revil_ransomware)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md
index d3570a2c82..5d59f4e2b1 100644
--- a/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md
+++ b/docs/_posts/2021-01-28-detect_regsvr32_application_control_bypass.md
@@ -58,9 +58,9 @@ Upon investigating, look for network connections to remote destinations (interna
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_regsvr32_application_control_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md
index 23c55b3ae5..1febc59a41 100644
--- a/docs/_posts/2021-01-28-ntdsutil_export_ntds.md
+++ b/docs/_posts/2021-01-28-ntdsutil_export_ntds.md
@@ -59,8 +59,8 @@ This technique uses "Install from Media" (IFM), which will extract a copy of the
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `ntdsutil_export_ntds_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md
index c6860f31ae..b2785aeb28 100644
--- a/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md
+++ b/docs/_posts/2021-01-28-suspicious_regsvr32_register_suspicious_path.md
@@ -57,9 +57,9 @@ Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `suspicious_regsvr32_register_suspicious_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md
index db5c7ce67e..529bc8225b 100644
--- a/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md
+++ b/docs/_posts/2021-02-01-dump_lsass_via_procdump_rename.md
@@ -52,8 +52,8 @@ During triage, confirm this is procdump.exe executing. If it is the first time a
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `dump_lsass_via_procdump_rename_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md
index 9598127723..c577f16f21 100644
--- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md
+++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md
@@ -57,9 +57,9 @@ The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 
 Note that `detect_rundll32_application_control_bypass_-_advpack_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md
index 3368221a41..cf5e82806a 100644
--- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md
+++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md
@@ -57,9 +57,9 @@ The following analytic identifies rundll32.exe loading setupapi.dll and iesetupa
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 
 Note that `detect_rundll32_application_control_bypass_-_setupapi_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md
index c7b8c0dee1..8cde71b432 100644
--- a/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md
+++ b/docs/_posts/2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md
@@ -57,9 +57,9 @@ The following analytic identifies rundll32.exe loading syssetup.dll by calling t
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 
 Note that `detect_rundll32_application_control_bypass_-_syssetup_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md
index 14f902c897..fa0cb0d959 100644
--- a/docs/_posts/2021-02-04-suspicious_rundll32_startw.md
+++ b/docs/_posts/2021-02-04-suspicious_rundll32_startw.md
@@ -57,9 +57,9 @@ The following analytic identifies rundll32.exe executing a DLL function name, St
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 
 Note that `suspicious_rundll32_startw_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md
index cbe3a11548..09611c6d9d 100644
--- a/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md
+++ b/docs/_posts/2021-02-09-suspicious_rundll32_dllregisterserver.md
@@ -57,9 +57,9 @@ The following analytic identifies rundll32.exe using dllregisterserver on the co
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 
 Note that `suspicious_rundll32_dllregisterserver_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md
index a73dbe1d88..48405e58e9 100644
--- a/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md
+++ b/docs/_posts/2021-02-11-detect_html_help_spawn_child_process.md
@@ -57,8 +57,8 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_html_help_spawn_child_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md
index 8cfbd98344..f37b4adbbc 100644
--- a/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md
+++ b/docs/_posts/2021-02-12-detect_regasm_spawning_a_process.md
@@ -57,8 +57,8 @@ The following analytic identifies regasm.exe spawning a process. This particular
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_regasm_spawning_a_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md
index 0493e2c8a9..e4ddb97777 100644
--- a/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md
+++ b/docs/_posts/2021-02-12-detect_regsvcs_spawning_a_process.md
@@ -57,8 +57,8 @@ The following analytic identifies regsvcs.exe spawning a process. This particula
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_regsvcs_spawning_a_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md b/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md
index e8985ca025..020ff3b4ea 100644
--- a/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md
+++ b/docs/_posts/2021-02-22-cobalt_strike_named_pipes.md
@@ -53,8 +53,8 @@ Upon triage, review the process performing the named pipe. If it is explorer.exe
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `cobalt_strike_named_pipes_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md
index cd0e397e73..8facddf2ed 100644
--- a/docs/_posts/2021-02-22-suspicious_curl_network_connection.md
+++ b/docs/_posts/2021-02-22-suspicious_curl_network_connection.md
@@ -54,8 +54,8 @@ The following analytic identifies the use of a curl contacting suspicious remote
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `suspicious_curl_network_connection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md
index ba3fa96d95..5ec8c9e673 100644
--- a/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md
+++ b/docs/_posts/2021-02-22-suspicious_plistbuddy_usage.md
@@ -68,8 +68,8 @@ Upon triage, capture the property list file being written to disk and review for
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `suspicious_plistbuddy_usage_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md
index a316984b17..c61525dcab 100644
--- a/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md
+++ b/docs/_posts/2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md
@@ -54,8 +54,8 @@ The following analytic identifies the use of a SQLite3 querying the MacOS prefer
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `suspicious_sqlite3_lsquarantine_behavior_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md
index fb58a0306c..a1d0e2db93 100644
--- a/docs/_posts/2021-03-01-fodhelper_uac_bypass.md
+++ b/docs/_posts/2021-03-01-fodhelper_uac_bypass.md
@@ -1,7 +1,7 @@
 ---
 title: "FodHelper UAC Bypass"
 excerpt: "Modify Registry
-, Bypass User Account Control
+, Bypass User Access Control
 , Abuse Elevation Control Mechanism
 "
 categories:
@@ -11,7 +11,7 @@ toc: true
 toc_label: ""
 tags:
   - Modify Registry
-  - Bypass User Account Control
+  - Bypass User Access Control
   - Abuse Elevation Control Mechanism
   - Defense Evasion
   - Defense Evasion
@@ -51,7 +51,7 @@ Upon triage, fodhelper.exe will have a child process and read access will occur
 | -------------- | ---------------- |-------------------- |
 | [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
 
-| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Defense Evasion, Privilege Escalation |
+| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Access Control | Defense Evasion, Privilege Escalation |
 
 | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
 
@@ -68,8 +68,8 @@ Upon triage, fodhelper.exe will have a child process and read access will occur
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `fodhelper_uac_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md
index 2c47a8618a..999f6b99f6 100644
--- a/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md
+++ b/docs/_posts/2021-03-01-ryuk_wake_on_lan_command.md
@@ -57,8 +57,8 @@ This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `ryuk_wake_on_lan_command_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md
index f29aa141cc..0a076a3bfe 100644
--- a/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md
+++ b/docs/_posts/2021-03-01-suspicious_scheduled_task_from_public_directory.md
@@ -61,8 +61,8 @@ The following detection identifies Scheduled Tasks registering (creating a new t
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `suspicious_scheduled_task_from_public_directory_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md
index 990621fbe9..dace167cc1 100644
--- a/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md
+++ b/docs/_posts/2021-03-02-unified_messaging_service_spawning_a_process.md
@@ -53,8 +53,8 @@ This detection identifies Microsoft Exchange Server's Unified Messaging services
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `unified_messaging_service_spawning_a_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md
index c0f1a25a4e..3ad6603cdb 100644
--- a/docs/_posts/2021-03-02-windows_disableantispyware_registry.md
+++ b/docs/_posts/2021-03-02-windows_disableantispyware_registry.md
@@ -57,8 +57,8 @@ The search looks for the Registry Key DisableAntiSpyware set to disable. This is
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_disableantispyware_registry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
@@ -80,6 +80,7 @@ It is unusual to turn this feature off a Windows system since it is a default se
 #### Associated Analytic story
 * [Ryuk Ransomware](/stories/ryuk_ransomware)
 * [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2021-03-03-w3wp_spawning_shell.md b/docs/_posts/2021-03-03-w3wp_spawning_shell.md
index 0bb56d9659..9f86ceb92b 100644
--- a/docs/_posts/2021-03-03-w3wp_spawning_shell.md
+++ b/docs/_posts/2021-03-03-w3wp_spawning_shell.md
@@ -60,9 +60,9 @@ This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 
 Note that `w3wp_spawning_shell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md
index 9c3ee9d414..ff4eddc683 100644
--- a/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md
+++ b/docs/_posts/2021-03-12-ransomware_notes_bulk_creation.md
@@ -53,8 +53,8 @@ The following analytics identifies a big number of instance of ransomware notes
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `ransomware_notes_bulk_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md
index 51e6f95da6..13d352d9e9 100644
--- a/docs/_posts/2021-03-12-resize_shadowstorage_volume.md
+++ b/docs/_posts/2021-03-12-resize_shadowstorage_volume.md
@@ -52,8 +52,8 @@ The following analytics identifies the resizing of shadowstorage by ransomware m
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `resize_shadowstorage_volume_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-03-16-high_process_termination_frequency.md b/docs/_posts/2021-03-16-high_process_termination_frequency.md
index 1d460d0ba7..0bf0452af3 100644
--- a/docs/_posts/2021-03-16-high_process_termination_frequency.md
+++ b/docs/_posts/2021-03-16-high_process_termination_frequency.md
@@ -53,8 +53,8 @@ This analytics are designed to indentify a high frequency of process termination
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `high_process_termination_frequency_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md
index 585aeea63b..fcf7462fae 100644
--- a/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md
+++ b/docs/_posts/2021-03-16-windows_high_file_deletion_frequency.md
@@ -52,8 +52,8 @@ This search looks for high frequency of file deletion relative to process name a
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_high_file_deletion_frequency_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-03-17-clop_common_exec_parameter.md b/docs/_posts/2021-03-17-clop_common_exec_parameter.md
index a3d5ce5217..09bbaccb52 100644
--- a/docs/_posts/2021-03-17-clop_common_exec_parameter.md
+++ b/docs/_posts/2021-03-17-clop_common_exec_parameter.md
@@ -52,8 +52,8 @@ The following analytics are designed to identifies some CLOP ransomware variant
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `clop_common_exec_parameter_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md
index d82cc90cb6..bd2a769b06 100644
--- a/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md
+++ b/docs/_posts/2021-03-17-clop_ransomware_known_service_name.md
@@ -52,8 +52,8 @@ This detection is to identify the common service name created by the CLOP ransom
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `clop_ransomware_known_service_name_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-03-23-certutil_with_decode_argument.md b/docs/_posts/2021-03-23-certutil_with_decode_argument.md
index 7b282dcae4..e6535377a3 100644
--- a/docs/_posts/2021-03-23-certutil_with_decode_argument.md
+++ b/docs/_posts/2021-03-23-certutil_with_decode_argument.md
@@ -52,9 +52,9 @@ CertUtil.exe may be used to `encode` and `decode` a file, including PE and scrip
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `certutil_with_decode_argument_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md
index 632a4f9e48..d2e2fd6825 100644
--- a/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md
+++ b/docs/_posts/2021-03-31-disabling_firewall_with_netsh.md
@@ -57,9 +57,9 @@ This search is to identifies suspicious firewall disabling using netsh applicati
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `disabling_firewall_with_netsh_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-03-31-dsquery_domain_discovery.md b/docs/_posts/2021-03-31-dsquery_domain_discovery.md
index 53c1a92939..c48f410f07 100644
--- a/docs/_posts/2021-03-31-dsquery_domain_discovery.md
+++ b/docs/_posts/2021-03-31-dsquery_domain_discovery.md
@@ -57,8 +57,8 @@ In addition to trust discovery, review parallel processes for additional behavio
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `dsquery_domain_discovery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md
index 0cd8cb6116..c483f3472c 100644
--- a/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md
+++ b/docs/_posts/2021-04-07-malicious_powershell_executed_as_a_service.md
@@ -65,8 +65,8 @@ This detection is to identify the abuse the Windows SC.exe to execute malicious
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `malicious_powershell_executed_as_a_service_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md
index e4c73d9f42..1cf31f5861 100644
--- a/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md
+++ b/docs/_posts/2021-04-12-excel_spawning_windows_script_host.md
@@ -57,8 +57,8 @@ The following detection identifies Microsoft Excel spawning Windows Script Host
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `excel_spawning_windows_script_host_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md
index ac857ccb47..4edd8b431f 100644
--- a/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md
+++ b/docs/_posts/2021-04-12-winword_spawning_windows_script_host.md
@@ -57,8 +57,8 @@ The following detection identifies Microsoft Winword.exe spawning Windows Script
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `winword_spawning_windows_script_host_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md
index 785adc1070..e18393769b 100644
--- a/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md
+++ b/docs/_posts/2021-04-13-office_application_spawn_rundll32_process.md
@@ -57,9 +57,9 @@ this detection was designed to identifies suspicious spawned process of known MS
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 
 Note that `office_application_spawn_rundll32_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md
index a32de9c91b..a23d5d3d94 100644
--- a/docs/_posts/2021-04-14-office_document_creating_schedule_task.md
+++ b/docs/_posts/2021-04-14-office_document_creating_schedule_task.md
@@ -56,8 +56,8 @@ this search detects a potential malicious office document that create schedule t
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `office_document_creating_schedule_task_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-14-office_document_executing_macro_code.md b/docs/_posts/2021-04-14-office_document_executing_macro_code.md
index 3075c5889f..16e3dca623 100644
--- a/docs/_posts/2021-04-14-office_document_executing_macro_code.md
+++ b/docs/_posts/2021-04-14-office_document_executing_macro_code.md
@@ -56,8 +56,8 @@ this detection was designed to identifies suspicious office documents that using
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `office_document_executing_macro_code_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md
index 5d176a10b9..0fec0d49cb 100644
--- a/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md
+++ b/docs/_posts/2021-04-15-dns_exfiltration_using_nslookup_app.md
@@ -52,8 +52,8 @@ this search is to detect potential DNS exfiltration using nslookup application.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `dns_exfiltration_using_nslookup_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md
index 23e89d1c70..aae28729a9 100644
--- a/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md
+++ b/docs/_posts/2021-04-19-powershell_remote_thread_to_known_windows_process.md
@@ -52,8 +52,8 @@ this search is designed to detect suspicious powershell process that tries to in
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `powershell_remote_thread_to_known_windows_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md b/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md
index f51daca822..96e4125148 100644
--- a/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md
+++ b/docs/_posts/2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md
@@ -56,8 +56,8 @@ this search is designed to detect suspicious wermgr.exe process that tries to co
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `wermgr_process_connecting_to_ip_check_web_services_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md
index 316399c8bc..35e2e81617 100644
--- a/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md
+++ b/docs/_posts/2021-04-19-wermgr_process_create_executable_file.md
@@ -51,8 +51,8 @@ this search is designed to detect potential malicious wermgr.exe process that dr
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `wermgr_process_create_executable_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md
index cd6484e883..5326ccdd84 100644
--- a/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md
+++ b/docs/_posts/2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md
@@ -52,9 +52,9 @@ This search is designed to detect suspicious cmd and powershell process spawned
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 
 Note that `wermgr_process_spawned_cmd_or_powershell_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md b/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md
index d64f895540..284f7b9178 100644
--- a/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md
+++ b/docs/_posts/2021-04-21-excessive_usage_of_nslookup_app.md
@@ -56,8 +56,8 @@ This search is to detect potential DNS exfiltration using nslookup application.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `excessive_usage_of_nslookup_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md
index 73aecab177..931511530f 100644
--- a/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md
+++ b/docs/_posts/2021-04-21-multiple_archive_files_http_post_traffic.md
@@ -59,8 +59,8 @@ This search is designed to detect high frequency of archive files data exfiltrat
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `multiple_archive_files_http_post_traffic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md
index 7985fab248..c5514b2814 100644
--- a/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md
+++ b/docs/_posts/2021-04-22-anomalous_usage_of_7zip.md
@@ -57,8 +57,8 @@ The following detection identifies a 7z.exe spawned from `Rundll32.exe` or `Dllh
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `anomalous_usage_of_7zip_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md
index 7df19cfc40..e47506ee47 100644
--- a/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md
+++ b/docs/_posts/2021-04-22-office_product_spawning_rundll32_with_no_dll.md
@@ -57,9 +57,9 @@ The following detection identifies the latest behavior utilized by IcedID malwar
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 
 Note that `office_product_spawning_rundll32_with_no_dll_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md
index 9129a2ed60..e014478b55 100644
--- a/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md
+++ b/docs/_posts/2021-04-22-plain_http_post_exfiltrated_data.md
@@ -56,8 +56,8 @@ This search is to detect potential plain HTTP POST method data exfiltration. Thi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `plain_http_post_exfiltrated_data_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-22-winword_spawning_cmd.md b/docs/_posts/2021-04-22-winword_spawning_cmd.md
index f64391b9fd..d61832d219 100644
--- a/docs/_posts/2021-04-22-winword_spawning_cmd.md
+++ b/docs/_posts/2021-04-22-winword_spawning_cmd.md
@@ -57,9 +57,9 @@ The following detection identifies Microsoft Word spawning `cmd.exe`. Typically,
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `winword_spawning_cmd_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-26-office_product_spawning_certutil.md b/docs/_posts/2021-04-26-office_product_spawning_certutil.md
index d58b9d4149..f7d74c38fa 100644
--- a/docs/_posts/2021-04-26-office_product_spawning_certutil.md
+++ b/docs/_posts/2021-04-26-office_product_spawning_certutil.md
@@ -57,9 +57,9 @@ The following detection identifies the latest behavior utilized by different mal
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `office_product_spawning_certutil_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-26-office_product_spawning_mshta.md b/docs/_posts/2021-04-26-office_product_spawning_mshta.md
index ca62d39cd8..feea0f3cc5 100644
--- a/docs/_posts/2021-04-26-office_product_spawning_mshta.md
+++ b/docs/_posts/2021-04-26-office_product_spawning_mshta.md
@@ -57,8 +57,8 @@ The following detection identifies the latest behavior utilized by different mal
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `office_product_spawning_mshta_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-04-26-trickbot_named_pipe.md b/docs/_posts/2021-04-26-trickbot_named_pipe.md
index 36bdbfb2c2..d92aeb5ec3 100644
--- a/docs/_posts/2021-04-26-trickbot_named_pipe.md
+++ b/docs/_posts/2021-04-26-trickbot_named_pipe.md
@@ -52,8 +52,8 @@ this search is to detect potential trickbot infection through the create/connect
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `trickbot_named_pipe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-29-icacls_deny_command.md b/docs/_posts/2021-04-29-icacls_deny_command.md
index 944d1a7bce..a4d0ba8f79 100644
--- a/docs/_posts/2021-04-29-icacls_deny_command.md
+++ b/docs/_posts/2021-04-29-icacls_deny_command.md
@@ -52,8 +52,8 @@ This analytic identifies a potential adversary that changes the security permiss
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `icacls_deny_command_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md
index b01176f5b5..ef023967da 100644
--- a/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md
+++ b/docs/_posts/2021-04-29-suspicious_driver_loaded_path.md
@@ -58,8 +58,8 @@ This analytic will detect suspicious driver loaded paths. This technique is comm
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `suspicious_driver_loaded_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-04-29-xmrig_driver_loaded.md b/docs/_posts/2021-04-29-xmrig_driver_loaded.md
index 256ab3fced..fd557a4ba5 100644
--- a/docs/_posts/2021-04-29-xmrig_driver_loaded.md
+++ b/docs/_posts/2021-04-29-xmrig_driver_loaded.md
@@ -58,8 +58,8 @@ This analytic identifies XMRIG coinminer driver installation on the system. The
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `xmrig_driver_loaded_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-05-04-deleting_of_net_users.md b/docs/_posts/2021-05-04-deleting_of_net_users.md
index d660a41b2b..75ae915a4a 100644
--- a/docs/_posts/2021-05-04-deleting_of_net_users.md
+++ b/docs/_posts/2021-05-04-deleting_of_net_users.md
@@ -52,9 +52,9 @@ This analytic will detect a suspicious net.exe/net1.exe command-line to delete a
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
 
 Note that `deleting_of_net_users_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-05-04-disabling_net_user_account.md b/docs/_posts/2021-05-04-disabling_net_user_account.md
index fde3186372..7908240cd6 100644
--- a/docs/_posts/2021-05-04-disabling_net_user_account.md
+++ b/docs/_posts/2021-05-04-disabling_net_user_account.md
@@ -52,9 +52,9 @@ This analytic will identify a suspicious command-line that disables a user accou
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
 
 Note that `disabling_net_user_account_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md
index 1bba356f13..f82e3742d2 100644
--- a/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md
+++ b/docs/_posts/2021-05-04-excessive_attempt_to_disable_services.md
@@ -53,8 +53,8 @@ This analytic will identify suspicious series of command-line to disable several
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `excessive_attempt_to_disable_services_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md
index 3d6d98bdb7..644f3e9c7c 100644
--- a/docs/_posts/2021-05-04-excessive_service_stop_attempt.md
+++ b/docs/_posts/2021-05-04-excessive_service_stop_attempt.md
@@ -53,9 +53,9 @@ This analytic identifies suspicious series of attempt to kill multiple services
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
 
 Note that `excessive_service_stop_attempt_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md
index 2206321efd..5540e89014 100644
--- a/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md
+++ b/docs/_posts/2021-05-04-excessive_usage_of_taskkill.md
@@ -58,8 +58,8 @@ This analytic identifies excessive usage of `taskkill.exe` application. This app
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `excessive_usage_of_taskkill_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-05-04-icacls_grant_command.md b/docs/_posts/2021-05-04-icacls_grant_command.md
index f29015212f..72081dca00 100644
--- a/docs/_posts/2021-05-04-icacls_grant_command.md
+++ b/docs/_posts/2021-05-04-icacls_grant_command.md
@@ -52,8 +52,8 @@ This analytic identifies potential adversaries that modify the security permissi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `icacls_grant_command_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md
index 231e171b3b..883a1b5172 100644
--- a/docs/_posts/2021-05-04-process_kill_base_on_file_path.md
+++ b/docs/_posts/2021-05-04-process_kill_base_on_file_path.md
@@ -57,9 +57,9 @@ The following analytic identifies the use of `wmic.exe` using `delete` to remove
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `process_kill_base_on_file_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-05-05-suspicious_process_file_path.md b/docs/_posts/2021-05-05-suspicious_process_file_path.md
index 045aa20d17..8ce0bef73f 100644
--- a/docs/_posts/2021-05-05-suspicious_process_file_path.md
+++ b/docs/_posts/2021-05-05-suspicious_process_file_path.md
@@ -53,8 +53,8 @@ The following analytic will detect a suspicious process running in a file path w
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `suspicious_process_file_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
@@ -76,6 +76,8 @@ To successfully implement this search you need to be ingesting information on pr
 Administrators may allow execution of specific binaries in non-standard paths. Filter as needed.
 
 #### Associated Analytic story
+* [Data Destruction](/stories/data_destruction)
+* [Double Zero Destructor](/stories/double_zero_destructor)
 * [XMRig](/stories/xmrig)
 * [Remcos](/stories/remcos)
 * [WhisperGate](/stories/whispergate)
diff --git a/docs/_posts/2021-05-06-download_files_using_telegram.md b/docs/_posts/2021-05-06-download_files_using_telegram.md
index 6807d4fa96..906785bcff 100644
--- a/docs/_posts/2021-05-06-download_files_using_telegram.md
+++ b/docs/_posts/2021-05-06-download_files_using_telegram.md
@@ -51,8 +51,8 @@ The following analytic will identify a suspicious download by the Telegram appli
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `download_files_using_telegram_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md
index fb1bb577a2..193f137ebb 100644
--- a/docs/_posts/2021-05-06-excessive_usage_of_net_app.md
+++ b/docs/_posts/2021-05-06-excessive_usage_of_net_app.md
@@ -53,9 +53,9 @@ This analytic identifies excessive usage of `net.exe` or `net1.exe` within a buc
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
 
 Note that `excessive_usage_of_net_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md
index 97c12c8414..a0d0e04242 100644
--- a/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md
+++ b/docs/_posts/2021-05-06-executables_or_script_creation_in_suspicious_path.md
@@ -52,8 +52,8 @@ This analytic will identify suspicious executable or scripts (known file extensi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `executables_or_script_creation_in_suspicious_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
@@ -73,6 +73,8 @@ To successfully implement this search you need to be ingesting information on pr
 Administrators may allow creation of script or exe in the paths specified. Filter as needed.
 
 #### Associated Analytic story
+* [Double Zero Destructor](/stories/double_zero_destructor)
+* [Data Destruction](/stories/data_destruction)
 * [XMRig](/stories/xmrig)
 * [Remcos](/stories/remcos)
 * [WhisperGate](/stories/whispergate)
diff --git a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md
index 41ee4e0891..6841456a75 100644
--- a/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md
+++ b/docs/_posts/2021-05-07-excessive_usage_of_cacls_app.md
@@ -53,8 +53,8 @@ The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe` o
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `excessive_usage_of_cacls_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md
index d3a6b7ceef..314832b101 100644
--- a/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md
+++ b/docs/_posts/2021-05-07-schtasks_run_task_on_demand.md
@@ -54,8 +54,8 @@ This analytic identifies an on demand run of a Windows Schedule Task through she
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `schtasks_run_task_on_demand_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md
index a8e33958d5..f0da40e8b3 100644
--- a/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md
+++ b/docs/_posts/2021-05-13-cmlua_or_cmstplua_uac_bypass.md
@@ -56,8 +56,8 @@ This analytic detects a potential process using COM Object like CMLUA or CMSTPLU
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `cmlua_or_cmstplua_uac_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-05-13-slui_runas_elevated.md b/docs/_posts/2021-05-13-slui_runas_elevated.md
index 9faf6ec155..b71e74fe8e 100644
--- a/docs/_posts/2021-05-13-slui_runas_elevated.md
+++ b/docs/_posts/2021-05-13-slui_runas_elevated.md
@@ -1,6 +1,6 @@
 ---
 title: "SLUI RunAs Elevated"
-excerpt: "Bypass User Account Control
+excerpt: "Bypass User Access Control
 , Abuse Elevation Control Mechanism
 "
 categories:
@@ -9,7 +9,7 @@ last_modified_at: 2021-05-13
 toc: true
 toc_label: ""
 tags:
-  - Bypass User Account Control
+  - Bypass User Access Control
   - Abuse Elevation Control Mechanism
   - Defense Evasion
   - Privilege Escalation
@@ -42,7 +42,7 @@ The following analytic identifies the Microsoft Software Licensing User Interfac
 
 | ID             | Technique        |  Tactic             |
 | -------------- | ---------------- |-------------------- |
-| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Defense Evasion, Privilege Escalation |
+| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Access Control | Defense Evasion, Privilege Escalation |
 
 | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
 
@@ -59,8 +59,8 @@ The following analytic identifies the Microsoft Software Licensing User Interfac
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `slui_runas_elevated_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-05-13-slui_spawning_a_process.md b/docs/_posts/2021-05-13-slui_spawning_a_process.md
index 701f9cd90c..645af63652 100644
--- a/docs/_posts/2021-05-13-slui_spawning_a_process.md
+++ b/docs/_posts/2021-05-13-slui_spawning_a_process.md
@@ -1,6 +1,6 @@
 ---
 title: "SLUI Spawning a Process"
-excerpt: "Bypass User Account Control
+excerpt: "Bypass User Access Control
 , Abuse Elevation Control Mechanism
 "
 categories:
@@ -9,7 +9,7 @@ last_modified_at: 2021-05-13
 toc: true
 toc_label: ""
 tags:
-  - Bypass User Account Control
+  - Bypass User Access Control
   - Abuse Elevation Control Mechanism
   - Defense Evasion
   - Privilege Escalation
@@ -42,7 +42,7 @@ The following analytic identifies the Microsoft Software Licensing User Interfac
 
 | ID             | Technique        |  Tactic             |
 | -------------- | ---------------- |-------------------- |
-| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Defense Evasion, Privilege Escalation |
+| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Access Control | Defense Evasion, Privilege Escalation |
 
 | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
 
@@ -59,8 +59,8 @@ The following analytic identifies the Microsoft Software Licensing User Interfac
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `slui_spawning_a_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-05-18-services_escalate_exe.md b/docs/_posts/2021-05-18-services_escalate_exe.md
index dc92cf5968..a1a7a073a0 100644
--- a/docs/_posts/2021-05-18-services_escalate_exe.md
+++ b/docs/_posts/2021-05-18-services_escalate_exe.md
@@ -53,8 +53,8 @@ The following analytic identifies the use of `svc-exe` with Cobalt Strike. The b
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `services_escalate_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md
index 3da8742468..f6d692cf63 100644
--- a/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md
+++ b/docs/_posts/2021-05-20-cmd_echo_pipe_-_escalation.md
@@ -69,9 +69,9 @@ This analytic identifies a common behavior by Cobalt Strike and other frameworks
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `cmd_echo_pipe_-_escalation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-05-21-winrm_spawning_a_process.md b/docs/_posts/2021-05-21-winrm_spawning_a_process.md
index 134fa9d82d..d78dda8261 100644
--- a/docs/_posts/2021-05-21-winrm_spawning_a_process.md
+++ b/docs/_posts/2021-05-21-winrm_spawning_a_process.md
@@ -55,8 +55,8 @@ The following analytic identifies suspicious processes spawning from WinRM (wsmp
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `winrm_spawning_a_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md
index 902c784577..65108f5315 100644
--- a/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md
+++ b/docs/_posts/2021-05-26-secretdumps_offline_ntds_dumping_tool.md
@@ -57,8 +57,8 @@ This analytic detects a potential usage of secretsdump.py tool for dumping crede
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `secretdumps_offline_ntds_dumping_tool_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md
index bae3dbe879..559eab523b 100644
--- a/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md
+++ b/docs/_posts/2021-05-27-detect_sharphound_file_modifications.md
@@ -82,8 +82,8 @@ SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. Shar
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_sharphound_file_modifications_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-05-27-detect_sharphound_usage.md b/docs/_posts/2021-05-27-detect_sharphound_usage.md
index b858b58629..97ae5df9d1 100644
--- a/docs/_posts/2021-05-27-detect_sharphound_usage.md
+++ b/docs/_posts/2021-05-27-detect_sharphound_usage.md
@@ -82,8 +82,8 @@ The following analytic identifies SharpHound binary usage by using the original
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_sharphound_usage_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md
index 9c853627a5..28cdb08d63 100644
--- a/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md
+++ b/docs/_posts/2021-06-01-detect_azurehound_command-line_arguments.md
@@ -82,8 +82,8 @@ The following analytic identifies the common command-line argument used by Azure
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_azurehound_command-line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md
index 7d57da21cb..a2698fe478 100644
--- a/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md
+++ b/docs/_posts/2021-06-01-detect_azurehound_file_modifications.md
@@ -82,8 +82,8 @@ The following analytic is similar to SharpHound file modifications, but this ins
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_azurehound_file_modifications_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md
index cc0653c8df..d8ff006218 100644
--- a/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md
+++ b/docs/_posts/2021-06-01-detect_sharphound_command-line_arguments.md
@@ -82,8 +82,8 @@ The following analytic identifies common command-line arguments used by SharpHou
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_sharphound_command-line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-06-02-conti_common_exec_parameter.md b/docs/_posts/2021-06-02-conti_common_exec_parameter.md
index b1a90400fd..fd0c4017e1 100644
--- a/docs/_posts/2021-06-02-conti_common_exec_parameter.md
+++ b/docs/_posts/2021-06-02-conti_common_exec_parameter.md
@@ -52,8 +52,8 @@ This search detects the suspicious commandline argument of revil ransomware to e
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `conti_common_exec_parameter_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-06-02-modification_of_wallpaper.md b/docs/_posts/2021-06-02-modification_of_wallpaper.md
index 1365541197..cf64ed7f54 100644
--- a/docs/_posts/2021-06-02-modification_of_wallpaper.md
+++ b/docs/_posts/2021-06-02-modification_of_wallpaper.md
@@ -51,8 +51,8 @@ This analytic identifies suspicious modification of registry to deface or change
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `modification_of_wallpaper_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
@@ -78,6 +78,7 @@ To successfully implement this search, you need to be ingesting logs with the Im
 * [Ransomware](/stories/ransomware)
 * [Revil Ransomware](/stories/revil_ransomware)
 * [BlackMatter Ransomware](/stories/blackmatter_ransomware)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2021-06-02-revil_common_exec_parameter.md b/docs/_posts/2021-06-02-revil_common_exec_parameter.md
index 2f6e23d65a..81844e4880 100644
--- a/docs/_posts/2021-06-02-revil_common_exec_parameter.md
+++ b/docs/_posts/2021-06-02-revil_common_exec_parameter.md
@@ -52,8 +52,8 @@ This analytic identifies suspicious commandline parameter that are commonly used
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `revil_common_exec_parameter_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md
index a4e7741d26..1c3924df71 100644
--- a/docs/_posts/2021-06-02-wbemprox_com_object_execution.md
+++ b/docs/_posts/2021-06-02-wbemprox_com_object_execution.md
@@ -56,8 +56,8 @@ this search is designed to detect potential malicious process loading COM object
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `wbemprox_com_object_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md
index 4c2c14ec8b..77b0536e69 100644
--- a/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md
+++ b/docs/_posts/2021-06-04-known_services_killed_by_ransomware.md
@@ -51,8 +51,8 @@ This search detects a suspicioous termination of known services killed by ransom
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `known_services_killed_by_ransomware_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md
index 11bb005ab0..dd7853fe35 100644
--- a/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md
+++ b/docs/_posts/2021-06-07-excessive_number_of_taskhost_processes.md
@@ -57,8 +57,8 @@ This detection targets behaviors observed in post exploit kits like Meterpreter
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `excessive_number_of_taskhost_processes_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md
index b79070ac73..6d57e0db6a 100644
--- a/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md
+++ b/docs/_posts/2021-06-10-clear_unallocated_sector_using_cipher_app.md
@@ -57,8 +57,8 @@ this search is to detect execution of `cipher.exe` to clear the unallocated sect
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `clear_unallocated_sector_using_cipher_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md
index c8f60558e0..74ec57d5a9 100644
--- a/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md
+++ b/docs/_posts/2021-06-10-disable_logs_using_wevtutil.md
@@ -57,8 +57,8 @@ This search is to detect execution of wevtutil.exe to disable logs. This techniq
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `disable_logs_using_wevtutil_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md
index 43f1065166..02f5682ad3 100644
--- a/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md
+++ b/docs/_posts/2021-06-10-permission_modification_using_takeown_app.md
@@ -52,8 +52,8 @@ This search is to detect a modification of file or directory permission using ta
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `permission_modification_using_takeown_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md
index 3d15f8a8ef..192d6d5877 100644
--- a/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md
+++ b/docs/_posts/2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md
@@ -52,8 +52,8 @@ This search is to detect a suspicious bcdedit.exe execution to ignore all failur
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `prevent_automatic_repair_mode_using_bcdedit_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md
index 73f5a6d0a6..600a658427 100644
--- a/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md
+++ b/docs/_posts/2021-06-16-detect_wmi_event_subscription_persistence.md
@@ -62,8 +62,8 @@ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToCons
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_wmi_event_subscription_persistence_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md
index 99e7c98439..694c943508 100644
--- a/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md
+++ b/docs/_posts/2021-06-22-execute_javascript_with_jscript_com_clsid.md
@@ -57,8 +57,8 @@ This analytic will identify suspicious process of cscript.exe where it tries to
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `execute_javascript_with_jscript_com_clsid_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md
index fe8089df42..513a49098a 100644
--- a/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md
+++ b/docs/_posts/2021-06-22-recursive_delete_of_directory_in_batch_cmd.md
@@ -57,9 +57,9 @@ This search is to detect a suspicious commandline designed to delete files or di
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `recursive_delete_of_directory_in_batch_cmd_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md
index 1bdefb096f..9c0ba163a1 100644
--- a/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md
+++ b/docs/_posts/2021-06-23-allow_file_and_printing_sharing_in_firewall.md
@@ -57,9 +57,9 @@ This search is to detect a suspicious modification of firewall to allow file and
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `allow_file_and_printing_sharing_in_firewall_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md
index a1e053a2dc..cb31902181 100644
--- a/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md
+++ b/docs/_posts/2021-06-23-allow_network_discovery_in_firewall.md
@@ -57,9 +57,9 @@ This search is to detect a suspicious modification to the firewall to allow netw
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `allow_network_discovery_in_firewall_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md
index f7791092bc..3732a2a5d3 100644
--- a/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md
+++ b/docs/_posts/2021-06-24-excessive_usage_of_sc_service_utility.md
@@ -61,8 +61,8 @@ This search is to detect a suspicious excessive usage of sc.exe in a host machin
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `excessive_usage_of_sc_service_utility_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md
index e2c2037d60..87db3746eb 100644
--- a/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md
+++ b/docs/_posts/2021-06-25-excessive_number_of_service_control_start_as_disabled.md
@@ -58,8 +58,8 @@ This detection targets behaviors observed when threat actors have used sc.exe to
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `excessive_number_of_service_control_start_as_disabled_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md
index c7a634f250..5cf4cbe947 100644
--- a/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md
+++ b/docs/_posts/2021-07-01-print_spooler_adding_a_printer_driver.md
@@ -62,8 +62,8 @@ During triage, isolate the endpoint and review for source of exploitation. Captu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `print_spooler_adding_a_printer_driver_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md
index 7f4387b2b7..2ca1f5833f 100644
--- a/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md
+++ b/docs/_posts/2021-07-01-print_spooler_failed_to_load_a_plug-in.md
@@ -63,8 +63,8 @@ During triage, isolate the endpoint and review for source of exploitation. Captu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [printservice](https://github.com/splunk/security_content/blob/develop/macros/printservice.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `print_spooler_failed_to_load_a_plug-in_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md
index b5e814e929..c15e9c4a98 100644
--- a/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md
+++ b/docs/_posts/2021-07-01-spoolsv_spawning_rundll32.md
@@ -60,9 +60,9 @@ The following analytic identifies a suspicious child process, `rundll32.exe`, wi
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 
 Note that `spoolsv_spawning_rundll32_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md
index 2e9c0ee649..a87b089a42 100644
--- a/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md
+++ b/docs/_posts/2021-07-01-spoolsv_suspicious_loaded_modules.md
@@ -60,8 +60,8 @@ This search is to detect suspicious loading of dll in specific path relative to
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `spoolsv_suspicious_loaded_modules_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md
index bb05314bf1..5abbc2c5c4 100644
--- a/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md
+++ b/docs/_posts/2021-07-01-spoolsv_suspicious_process_access.md
@@ -52,8 +52,8 @@ This analytic identifies a suspicious behavior related to PrintNightmare, or CVE
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `spoolsv_suspicious_process_access_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md
index b040161cab..f6def1583a 100644
--- a/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md
+++ b/docs/_posts/2021-07-01-spoolsv_writing_a_dll_-_sysmon.md
@@ -59,8 +59,8 @@ The following analytic identifies a `.dll` being written by `spoolsv.exe`. This
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `spoolsv_writing_a_dll_-_sysmon_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md
index fb35d74468..e50081a5a7 100644
--- a/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md
+++ b/docs/_posts/2021-07-05-msmpeng_application_dll_side_loading.md
@@ -61,8 +61,8 @@ This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in no
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `msmpeng_application_dll_side_loading_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md
index b3c9ea04b5..b8b23a3232 100644
--- a/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md
+++ b/docs/_posts/2021-07-12-uac_bypass_mmc_load_unsigned_dll.md
@@ -1,6 +1,6 @@
 ---
 title: "UAC Bypass MMC Load Unsigned Dll"
-excerpt: "Bypass User Account Control
+excerpt: "Bypass User Access Control
 , Abuse Elevation Control Mechanism
 "
 categories:
@@ -9,7 +9,7 @@ last_modified_at: 2021-07-12
 toc: true
 toc_label: ""
 tags:
-  - Bypass User Account Control
+  - Bypass User Access Control
   - Abuse Elevation Control Mechanism
   - Defense Evasion
   - Privilege Escalation
@@ -42,7 +42,7 @@ This search is to detect a suspicious loaded unsigned dll by MMC.exe application
 
 | ID             | Technique        |  Tactic             |
 | -------------- | ---------------- |-------------------- |
-| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Defense Evasion, Privilege Escalation |
+| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Access Control | Defense Evasion, Privilege Escalation |
 
 | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
 
@@ -58,8 +58,8 @@ This search is to detect a suspicious loaded unsigned dll by MMC.exe application
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `uac_bypass_mmc_load_unsigned_dll_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md
index 7438decb2d..0b0aee6b1a 100644
--- a/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md
+++ b/docs/_posts/2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md
@@ -68,8 +68,8 @@ This search looks for cloud compute instances created by users who have not crea
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `cloud_compute_instance_created_by_previously_unseen_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md
index cd37155fef..e311ee7886 100644
--- a/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md
+++ b/docs/_posts/2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md
@@ -57,10 +57,10 @@ This search is to detect a suspicious mshta.exe process that spawn rundll32 or r
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 
 Note that `mshta_spawning_rundll32_or_regsvr32_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md
index 5ae22ad65e..480704bdc0 100644
--- a/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md
+++ b/docs/_posts/2021-07-19-office_product_spawn_cmd_process.md
@@ -57,9 +57,9 @@ this search is to detect a suspicious office product process that spawn cmd chil
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `office_product_spawn_cmd_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md
index 29e149415d..1cbbad7390 100644
--- a/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md
+++ b/docs/_posts/2021-07-26-rundll32_createremotethread_in_browser.md
@@ -52,8 +52,8 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `rundll32_createremotethread_in_browser_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md
index ff94b3dc3e..5a05574ce3 100644
--- a/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md
+++ b/docs/_posts/2021-07-26-rundll32_process_creating_exe_dll_files.md
@@ -56,8 +56,8 @@ This search is to detect a suspicious rundll32 process that drops executable (.e
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `rundll32_process_creating_exe_dll_files_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md
index bac9d98850..5628d1ab32 100644
--- a/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md
+++ b/docs/_posts/2021-07-26-suspicious_icedid_rundll32_cmdline.md
@@ -57,9 +57,9 @@ This search is to detect a suspicious rundll32.exe commandline to execute dll fi
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 
 Note that `suspicious_icedid_rundll32_cmdline_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md
index be42c08207..b8e332cdd4 100644
--- a/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md
+++ b/docs/_posts/2021-07-26-suspicious_rundll32_plugininit.md
@@ -57,9 +57,9 @@ This search is to detect a suspicious rundll32.exe process with plugininit param
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 
 Note that `suspicious_rundll32_plugininit_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-27-chcp_command_execution.md b/docs/_posts/2021-07-27-chcp_command_execution.md
index a70078c3a7..87cea135b1 100644
--- a/docs/_posts/2021-07-27-chcp_command_execution.md
+++ b/docs/_posts/2021-07-27-chcp_command_execution.md
@@ -52,8 +52,8 @@ This search is to detect execution of chcp.exe application. this utility is used
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `chcp_command_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md
index aae3d55fd1..565ff71e0a 100644
--- a/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md
+++ b/docs/_posts/2021-07-27-regsvr32_with_known_silent_switch_cmdline.md
@@ -59,9 +59,9 @@ The following analytic identifies Regsvr32.exe utilizing the silent switch to lo
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `regsvr32_with_known_silent_switch_cmdline_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md
index 8bed0ef8ce..33b4197ec5 100644
--- a/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md
+++ b/docs/_posts/2021-07-29-rundll32_create_remote_thread_to_a_process.md
@@ -52,8 +52,8 @@ This analytic identifies the suspicious Remote Thread execution of rundll32.exe
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `rundll32_create_remote_thread_to_a_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-30-drop_icedid_license_dat.md b/docs/_posts/2021-07-30-drop_icedid_license_dat.md
index f3aa909358..4efb30f381 100644
--- a/docs/_posts/2021-07-30-drop_icedid_license_dat.md
+++ b/docs/_posts/2021-07-30-drop_icedid_license_dat.md
@@ -56,8 +56,8 @@ This search is to detect dropping a suspicious file named as "license.dat" in %a
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `drop_icedid_license_dat_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md
index 73edb54ec4..4d43302a15 100644
--- a/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md
+++ b/docs/_posts/2021-07-30-icedid_exfiltrated_archived_file_creation.md
@@ -56,8 +56,8 @@ This search is to detect a suspicious file creation namely passff.tar and cookie
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `icedid_exfiltrated_archived_file_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md
index a39527934a..0f35e98a70 100644
--- a/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md
+++ b/docs/_posts/2021-07-30-office_application_spawn_regsvr32_process.md
@@ -57,9 +57,9 @@ this detection was designed to identifies suspicious spawned process of known MS
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `office_application_spawn_regsvr32_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md
index d4709062ea..7fa8d0df00 100644
--- a/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md
+++ b/docs/_posts/2021-08-03-sqlite_module_in_temp_folder.md
@@ -51,8 +51,8 @@ This search is to detect a suspicious file creation of sqlite3.dll in %temp% fol
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `sqlite_module_in_temp_folder_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md
index 57e51ae7aa..aaaadd9ba4 100644
--- a/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md
+++ b/docs/_posts/2021-08-04-create_remote_thread_in_shell_application.md
@@ -52,8 +52,8 @@ This search is to detect suspicious process injection in command shell. This tec
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `create_remote_thread_in_shell_application_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md
index 44592607d6..e642c62759 100644
--- a/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md
+++ b/docs/_posts/2021-08-09-uninstall_app_using_msiexec.md
@@ -57,8 +57,8 @@ This search is to detect a suspicious un-installation of application using msiex
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `uninstall_app_using_msiexec_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-11-fsutil_zeroing_file.md b/docs/_posts/2021-08-11-fsutil_zeroing_file.md
index b438c86f07..33cc19ae61 100644
--- a/docs/_posts/2021-08-11-fsutil_zeroing_file.md
+++ b/docs/_posts/2021-08-11-fsutil_zeroing_file.md
@@ -52,8 +52,8 @@ This search is to detect a suspicious fsutil process to zeroing a target file. T
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `fsutil_zeroing_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md
index b49979b3c1..0ce4aae004 100644
--- a/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md
+++ b/docs/_posts/2021-08-13-uac_bypass_with_colorui_com_object.md
@@ -56,8 +56,8 @@ This search is to detect a possible uac bypass using the colorui.dll COM Object.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `uac_bypass_with_colorui_com_object_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md b/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md
index e83e92c30e..5b96fcd6ff 100644
--- a/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md
+++ b/docs/_posts/2021-08-16-gsuite_drive_share_in_external_email.md
@@ -61,8 +61,8 @@ This search is to detect suspicious google drive or google docs files shared out
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [gsuite_drive](https://github.com/splunk/security_content/blob/develop/macros/gsuite_drive.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `gsuite_drive_share_in_external_email_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md b/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md
index abe4e80f08..c15386382d 100644
--- a/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md
+++ b/docs/_posts/2021-08-16-gsuite_email_suspicious_attachment.md
@@ -57,8 +57,8 @@ This search is to detect a suspicious attachment file extension in Gsuite email
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `gsuite_email_suspicious_attachment_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md
index 4460b9bbea..14fe986b1a 100644
--- a/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md
+++ b/docs/_posts/2021-08-17-7zip_commandline_to_smb_share_path.md
@@ -57,8 +57,8 @@ This search is to detect a suspicious 7z process with commandline pointing to SM
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `7zip_commandline_to_smb_share_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md b/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md
index 1b5e7f076a..dfa012c197 100644
--- a/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md
+++ b/docs/_posts/2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md
@@ -62,8 +62,8 @@ This search is to detect a suspicious outbound e-mail from internal email to ext
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `gsuite_outbound_email_with_attachment_to_external_domain_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-18-esentutl_sam_copy.md b/docs/_posts/2021-08-18-esentutl_sam_copy.md
index f0d4a0e5da..55827af158 100644
--- a/docs/_posts/2021-08-18-esentutl_sam_copy.md
+++ b/docs/_posts/2021-08-18-esentutl_sam_copy.md
@@ -57,8 +57,8 @@ The following analytic identifies the process - `esentutl.exe` - being used to c
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_esentutl](https://github.com/splunk/security_content/blob/develop/macros/process_esentutl.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_esentutl](https://github.com/splunk/security_content/blob/develop/macros/process_esentutl.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `esentutl_sam_copy_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md
index 718ae1d5ce..0286cde831 100644
--- a/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md
+++ b/docs/_posts/2021-08-19-aws_ecr_container_upload_unknown_user.md
@@ -59,8 +59,8 @@ This search looks for AWS CloudTrail events from AWS Elastic Container Service (
 
 #### Macros
 The SPL above uses the following Macros:
-* [aws_ecr_users](https://github.com/splunk/security_content/blob/develop/macros/aws_ecr_users.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [aws_ecr_users](https://github.com/splunk/security_content/blob/develop/macros/aws_ecr_users.yml)
 * [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
 
 Note that `aws_ecr_container_upload_unknown_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md b/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md
index 28df98f938..f92618a42f 100644
--- a/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md
+++ b/docs/_posts/2021-08-19-gsuite_email_suspicious_subject_with_attachment.md
@@ -60,8 +60,8 @@ This search is to detect a gsuite email contains suspicious subject having known
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `gsuite_email_suspicious_subject_with_attachment_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md
index f7af144dd3..ce4d6dc30e 100644
--- a/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md
+++ b/docs/_posts/2021-08-19-protocols_passing_authentication_in_cleartext.md
@@ -44,8 +44,8 @@ The following analytic identifies cleartext protocols at risk of leaking sensiti
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `protocols_passing_authentication_in_cleartext_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-20-github_commit_changes_in_master.md b/docs/_posts/2021-08-20-github_commit_changes_in_master.md
index bb61207dd1..a3c5ea8391 100644
--- a/docs/_posts/2021-08-20-github_commit_changes_in_master.md
+++ b/docs/_posts/2021-08-20-github_commit_changes_in_master.md
@@ -53,8 +53,8 @@ This search is to detect a pushed or commit to master or main branch. This is to
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `github_commit_changes_in_master_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md
index 87a0a53e5c..9ac2267323 100644
--- a/docs/_posts/2021-08-23-getlocaluser_with_powershell.md
+++ b/docs/_posts/2021-08-23-getlocaluser_with_powershell.md
@@ -57,8 +57,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `getlocaluser_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md
index 4e9a03ae6f..43103fca89 100644
--- a/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md
+++ b/docs/_posts/2021-08-23-getwmiobject_user_account_with_powershell.md
@@ -57,8 +57,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `getwmiobject_user_account_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md b/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md
index 14e416b243..f115ceee44 100644
--- a/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md
+++ b/docs/_posts/2021-08-23-gsuite_email_with_known_abuse_web_service_link.md
@@ -60,8 +60,8 @@ This analytics is to detect a gmail containing a link that are known to be abuse
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [gsuite_gmail](https://github.com/splunk/security_content/blob/develop/macros/gsuite_gmail.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `gsuite_email_with_known_abuse_web_service_link_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md b/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md
index 4f079e05eb..923f8f706e 100644
--- a/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md
+++ b/docs/_posts/2021-08-23-gsuite_suspicious_shared_file_name.md
@@ -61,8 +61,8 @@ This search is to detect a shared file in google drive with suspicious file name
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [gsuite_drive](https://github.com/splunk/security_content/blob/develop/macros/gsuite_drive.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `gsuite_suspicious_shared_file_name_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md
index 200b9a0b43..75050fd8fb 100644
--- a/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md
+++ b/docs/_posts/2021-08-24-domain_account_discovery_with_dsquery.md
@@ -57,8 +57,8 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `domain_account_discovery_with_dsquery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md
index f4039861da..40b242b92b 100644
--- a/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md
+++ b/docs/_posts/2021-08-24-domain_account_discovery_with_net_app.md
@@ -57,9 +57,9 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
 
 Note that `domain_account_discovery_with_net_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md
index bc94ed43f5..f0108d33eb 100644
--- a/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md
+++ b/docs/_posts/2021-08-24-domain_account_discovery_with_wmic.md
@@ -57,8 +57,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `domain_account_discovery_with_wmic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md
index f8bb924fc5..7c00e20a9b 100644
--- a/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md
+++ b/docs/_posts/2021-08-24-get-domaintrust_with_powershell.md
@@ -52,8 +52,8 @@ This analytic identifies Get-DomainTrust from PowerView in order to gather domai
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `get-domaintrust_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-24-get_aduser_with_powershell.md b/docs/_posts/2021-08-24-get_aduser_with_powershell.md
index 4902ce1faf..75204628e0 100644
--- a/docs/_posts/2021-08-24-get_aduser_with_powershell.md
+++ b/docs/_posts/2021-08-24-get_aduser_with_powershell.md
@@ -57,8 +57,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `get_aduser_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md
index e3a8c35ebe..9f5bedb4cd 100644
--- a/docs/_posts/2021-08-24-get_domainuser_with_powershell.md
+++ b/docs/_posts/2021-08-24-get_domainuser_with_powershell.md
@@ -57,8 +57,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `get_domainuser_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md
index 441c9b484e..5b73f172fe 100644
--- a/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md
+++ b/docs/_posts/2021-08-24-getwmiobject_ds_user_with_powershell.md
@@ -57,8 +57,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `getwmiobject_ds_user_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md
index a308c7ad19..c1e83f8440 100644
--- a/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md
+++ b/docs/_posts/2021-08-24-kubernetes_scanner_image_pulling.md
@@ -55,8 +55,8 @@ This search uses the Kubernetes logs from Splunk Connect from Kubernetes to dete
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [kube_objects_events](https://github.com/splunk/security_content/blob/develop/macros/kube_objects_events.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `kubernetes_scanner_image_pulling_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md
index 75d58e79dd..9103603b8b 100644
--- a/docs/_posts/2021-08-25-domain_group_discovery_with_net.md
+++ b/docs/_posts/2021-08-25-domain_group_discovery_with_net.md
@@ -57,8 +57,8 @@ This analytic looks for the execution of `net.exe` with command-line arguments u
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `domain_group_discovery_with_net_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md
index b7ba2c6750..7c739facb1 100644
--- a/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md
+++ b/docs/_posts/2021-08-25-domain_group_discovery_with_wmic.md
@@ -57,8 +57,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `domain_group_discovery_with_wmic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md
index f302935a35..a15fa86ee3 100644
--- a/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md
+++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_net.md
@@ -57,8 +57,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe`  with command-l
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `elevated_group_discovery_with_net_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md
index dfa3d7a1a7..28d5e52658 100644
--- a/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md
+++ b/docs/_posts/2021-08-25-elevated_group_discovery_with_wmic.md
@@ -57,8 +57,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `elevated_group_discovery_with_wmic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-25-getadgroup_with_powershell.md b/docs/_posts/2021-08-25-getadgroup_with_powershell.md
index fc660e0b61..95ac374478 100644
--- a/docs/_posts/2021-08-25-getadgroup_with_powershell.md
+++ b/docs/_posts/2021-08-25-getadgroup_with_powershell.md
@@ -57,8 +57,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `getadgroup_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md
index 133978adf3..4e1f3934e6 100644
--- a/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md
+++ b/docs/_posts/2021-08-25-getdomaingroup_with_powershell.md
@@ -57,8 +57,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `getdomaingroup_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md
index 89af756864..6f4f40f522 100644
--- a/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md
+++ b/docs/_posts/2021-08-25-getnettcpconnection_with_powershell.md
@@ -52,8 +52,8 @@ This analytic looks for the execution of `powershell.exe` with command-line util
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `getnettcpconnection_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md
index 2b018290fa..8aa03eeaf6 100644
--- a/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md
+++ b/docs/_posts/2021-08-25-getwmiobject_ds_group_with_powershell.md
@@ -57,8 +57,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `getwmiobject_ds_group_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md
index 4409899bbd..70523939c2 100644
--- a/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md
+++ b/docs/_posts/2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md
@@ -52,8 +52,8 @@ This analytic looks for the execution of `powershell.exe` executing the Get-ADDe
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `get_addefaultdomainpasswordpolicy_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md
index 325a8fe002..f01539bbeb 100644
--- a/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md
+++ b/docs/_posts/2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md
@@ -52,8 +52,8 @@ This analytic looks for the execution of `powershell.exe` executing the Get ADUs
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `get_aduserresultantpasswordpolicy_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md
index bee88d9cd2..e383879a58 100644
--- a/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md
+++ b/docs/_posts/2021-08-26-get_domainpolicy_with_powershell.md
@@ -52,8 +52,8 @@ This analytic looks for the execution of `powershell.exe` executing the `Get-Dom
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `get_domainpolicy_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md
index 79998c9c58..c8b1cad3c9 100644
--- a/docs/_posts/2021-08-26-password_policy_discovery_with_net.md
+++ b/docs/_posts/2021-08-26-password_policy_discovery_with_net.md
@@ -52,8 +52,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command li
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `password_policy_discovery_with_net_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md
index bcb93c7faa..c31d5cd91c 100644
--- a/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md
+++ b/docs/_posts/2021-08-26-process_creating_lnk_file_in_suspicious_location.md
@@ -64,8 +64,8 @@ This search looks for a process launching an `*.lnk` file under `C:\User*` or `*
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `process_creating_lnk_file_in_suspicious_location_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md
index 81b680c398..72eab83086 100644
--- a/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md
+++ b/docs/_posts/2021-08-30-domain_controller_discovery_with_nltest.md
@@ -52,8 +52,8 @@ This analytic looks for the execution of `nltest.exe` with command-line argument
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `domain_controller_discovery_with_nltest_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md
index 4e461dad75..a316838d3f 100644
--- a/docs/_posts/2021-08-30-remote_system_discovery_with_net.md
+++ b/docs/_posts/2021-08-30-remote_system_discovery_with_net.md
@@ -52,8 +52,8 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `remote_system_discovery_with_net_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md
index ac348f75b1..7c03722857 100644
--- a/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md
+++ b/docs/_posts/2021-08-31-remote_system_discovery_with_dsquery.md
@@ -52,8 +52,8 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `remote_system_discovery_with_dsquery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md
index 0a19282601..adaa83f477 100644
--- a/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md
+++ b/docs/_posts/2021-09-01-domain_controller_discovery_with_wmic.md
@@ -52,8 +52,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `domain_controller_discovery_with_wmic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md
index f68c15444b..95a5a9e908 100644
--- a/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md
+++ b/docs/_posts/2021-09-01-domain_group_discovery_with_dsquery.md
@@ -57,8 +57,8 @@ This analytic looks for the execution of `dsquery.exe` with command-line argumen
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `domain_group_discovery_with_dsquery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-01-github_commit_in_develop.md b/docs/_posts/2021-09-01-github_commit_in_develop.md
index c1d9289f34..7a67071e54 100644
--- a/docs/_posts/2021-09-01-github_commit_in_develop.md
+++ b/docs/_posts/2021-09-01-github_commit_in_develop.md
@@ -51,8 +51,8 @@ This search is to detect a pushed or commit to develop branch. This is to avoid
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `github_commit_in_develop_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-01-github_dependabot_alert.md b/docs/_posts/2021-09-01-github_dependabot_alert.md
index b2a1d869e0..067843877b 100644
--- a/docs/_posts/2021-09-01-github_dependabot_alert.md
+++ b/docs/_posts/2021-09-01-github_dependabot_alert.md
@@ -57,8 +57,8 @@ This search looks for Dependabot Alerts in Github logs.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `github_dependabot_alert_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md
index 9d68f6b235..808a8a2785 100644
--- a/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md
+++ b/docs/_posts/2021-09-01-github_pull_request_from_unknown_user.md
@@ -58,9 +58,9 @@ This search looks for Pull Request from unknown user.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [github_known_users](https://github.com/splunk/security_content/blob/develop/macros/github_known_users.yml)
 * [github](https://github.com/splunk/security_content/blob/develop/macros/github.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `github_pull_request_from_unknown_user_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md
index f02807f18c..c90f2b5695 100644
--- a/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md
+++ b/docs/_posts/2021-09-01-remote_system_discovery_with_wmic.md
@@ -52,8 +52,8 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `remote_system_discovery_with_wmic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md
index f193025325..0619c9bcc0 100644
--- a/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md
+++ b/docs/_posts/2021-09-02-get-foresttrust_with_powershell.md
@@ -52,8 +52,8 @@ This analytic identifies Get-ForestTrust from PowerSploit in order to gather dom
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `get-foresttrust_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md
index a6dc7c5ae1..95f4cf0697 100644
--- a/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md
+++ b/docs/_posts/2021-09-06-bcdedit_command_back_to_normal_mode_boot.md
@@ -52,8 +52,8 @@ This search is to detect a suspicious bcdedit commandline to configure the host
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `bcdedit_command_back_to_normal_mode_boot_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md
index 6450cb4920..164b89e95f 100644
--- a/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md
+++ b/docs/_posts/2021-09-06-change_to_safe_mode_with_network_config.md
@@ -52,8 +52,8 @@ This search is to detect a suspicious bcdedit commandline to configure the host
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `change_to_safe_mode_with_network_config_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md
index 262f573ad3..a0abc02190 100644
--- a/docs/_posts/2021-09-07-getadcomputer_with_powershell.md
+++ b/docs/_posts/2021-09-07-getadcomputer_with_powershell.md
@@ -52,8 +52,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `getadcomputer_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md
index 0be25a3ee4..7d21bc74ed 100644
--- a/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md
+++ b/docs/_posts/2021-09-07-getdomaincomputer_with_powershell.md
@@ -52,8 +52,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `getdomaincomputer_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md
index 286aa7e56b..c6fc1b5449 100644
--- a/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md
+++ b/docs/_posts/2021-09-07-getdomaincontroller_with_powershell.md
@@ -52,8 +52,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `getdomaincontroller_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md
index 836f811c00..45682b7129 100644
--- a/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md
+++ b/docs/_posts/2021-09-07-getwmiobject_ds_computer_with_powershell.md
@@ -52,8 +52,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `getwmiobject_ds_computer_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md
index be26063d31..e5280bff84 100644
--- a/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md
+++ b/docs/_posts/2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md
@@ -56,8 +56,8 @@ This analytic is to detect an application try to connect and create ADSI Object
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `schcache_change_by_app_connect_and_create_adsi_object_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-07-system_information_discovery_detection.md b/docs/_posts/2021-09-07-system_information_discovery_detection.md
index d1bd0c57d9..db4623806a 100644
--- a/docs/_posts/2021-09-07-system_information_discovery_detection.md
+++ b/docs/_posts/2021-09-07-system_information_discovery_detection.md
@@ -55,8 +55,8 @@ Detect system information discovery techniques used by attackers to understand c
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `system_information_discovery_detection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md
index f7e3717d39..2433fb3bb2 100644
--- a/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md
+++ b/docs/_posts/2021-09-08-control_loading_from_world_writable_directory.md
@@ -58,8 +58,8 @@ The following detection identifies control.exe loading either a .cpl or .inf fro
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `control_loading_from_world_writable_directory_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md
index db9d6bebe0..ba9f4ea719 100644
--- a/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md
+++ b/docs/_posts/2021-09-08-create_local_admin_accounts_using_net_exe.md
@@ -57,8 +57,8 @@ This search looks for the creation of local administrator accounts using net.exe
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `create_local_admin_accounts_using_net_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-08-office_spawning_control.md b/docs/_posts/2021-09-08-office_spawning_control.md
index a6cda175c7..dd30567f30 100644
--- a/docs/_posts/2021-09-08-office_spawning_control.md
+++ b/docs/_posts/2021-09-08-office_spawning_control.md
@@ -58,8 +58,8 @@ The following detection identifies control.exe spawning from an office product.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `office_spawning_control_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md
index 7ff3c47836..55683771d5 100644
--- a/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md
+++ b/docs/_posts/2021-09-08-rundll32_control_rundll_hunt.md
@@ -58,9 +58,9 @@ The following hunting detection identifies rundll32.exe with `control_rundll` wi
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 
 Note that `rundll32_control_rundll_hunt_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md
index 81e5750d8d..025c7aee1d 100644
--- a/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md
+++ b/docs/_posts/2021-09-08-rundll32_control_rundll_world_writable_directory.md
@@ -58,9 +58,9 @@ The following detection identifies rundll32.exe with `control_rundll` within the
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 
 Note that `rundll32_control_rundll_world_writable_directory_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-09-extraction_of_registry_hives.md b/docs/_posts/2021-09-09-extraction_of_registry_hives.md
index cc0f3fb132..d0160ea0aa 100644
--- a/docs/_posts/2021-09-09-extraction_of_registry_hives.md
+++ b/docs/_posts/2021-09-09-extraction_of_registry_hives.md
@@ -57,8 +57,8 @@ The following analytic identifies the use of `reg.exe` exporting Windows Registr
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `extraction_of_registry_hives_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md b/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md
index 9ae8ae4dc4..5bc750b8f5 100644
--- a/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md
+++ b/docs/_posts/2021-09-09-mshtml_module_load_in_office_product.md
@@ -58,8 +58,8 @@ The following detection identifies the module load of mshtml.dll into an Office
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `mshtml_module_load_in_office_product_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md
index 66aaad292d..350b04b463 100644
--- a/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md
+++ b/docs/_posts/2021-09-10-network_connection_discovery_with_arp.md
@@ -52,8 +52,8 @@ This analytic looks for the execution of `arp.exe` utilized to get a listing of
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `network_connection_discovery_with_arp_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md
index d80bc07f6a..cacbe5123e 100644
--- a/docs/_posts/2021-09-10-network_connection_discovery_with_net.md
+++ b/docs/_posts/2021-09-10-network_connection_discovery_with_net.md
@@ -52,8 +52,8 @@ This analytic looks for the execution of `net.exe` with command-line arguments u
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `network_connection_discovery_with_net_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md
index cdd50f112c..1f6cb63c1e 100644
--- a/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md
+++ b/docs/_posts/2021-09-10-network_connection_discovery_with_netstat.md
@@ -52,8 +52,8 @@ This analytic looks for the execution of `netstat.exe` with command-line argumen
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `network_connection_discovery_with_netstat_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md
index 7f0b4e026e..1eca1b1c8e 100644
--- a/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md
+++ b/docs/_posts/2021-09-13-getcurrent_user_with_powershell.md
@@ -52,8 +52,8 @@ This analytic looks for the execution of `powerhsell.exe` with command-line argu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `getcurrent_user_with_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md
index 38bb145871..ca18626fe8 100644
--- a/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md
+++ b/docs/_posts/2021-09-13-jscript_execution_using_cscript_app.md
@@ -1,7 +1,7 @@
 ---
 title: "Jscript Execution Using Cscript App"
 excerpt: "Command and Scripting Interpreter
-, JavaScript
+, JavaScript/JScript
 "
 categories:
   - Endpoint
@@ -10,7 +10,7 @@ toc: true
 toc_label: ""
 tags:
   - Command and Scripting Interpreter
-  - JavaScript
+  - JavaScript/JScript
   - Execution
   - Execution
   - Splunk Enterprise
@@ -42,7 +42,7 @@ This search is to detect a execution of jscript using cscript process. Commonly
 | -------------- | ---------------- |-------------------- |
 | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
 
-| [T1059.007](https://attack.mitre.org/techniques/T1059/007/) | JavaScript | Execution |
+| [T1059.007](https://attack.mitre.org/techniques/T1059/007/) | JavaScript/JScript | Execution |
 
 #### Search
 
@@ -57,8 +57,8 @@ This search is to detect a execution of jscript using cscript process. Commonly
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `jscript_execution_using_cscript_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md
index 87c84d1a97..1c5b8fdcd0 100644
--- a/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md
+++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_ldap_module.md
@@ -1,7 +1,7 @@
 ---
 title: "MS Scripting Process Loading Ldap Module"
 excerpt: "Command and Scripting Interpreter
-, JavaScript
+, JavaScript/JScript
 "
 categories:
   - Endpoint
@@ -10,7 +10,7 @@ toc: true
 toc_label: ""
 tags:
   - Command and Scripting Interpreter
-  - JavaScript
+  - JavaScript/JScript
   - Execution
   - Execution
   - Splunk Enterprise
@@ -42,7 +42,7 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o
 | -------------- | ---------------- |-------------------- |
 | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
 
-| [T1059.007](https://attack.mitre.org/techniques/T1059/007/) | JavaScript | Execution |
+| [T1059.007](https://attack.mitre.org/techniques/T1059/007/) | JavaScript/JScript | Execution |
 
 #### Search
 
@@ -56,8 +56,8 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `ms_scripting_process_loading_ldap_module_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md
index 77e09a0e83..73e33b675e 100644
--- a/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md
+++ b/docs/_posts/2021-09-13-ms_scripting_process_loading_wmi_module.md
@@ -1,7 +1,7 @@
 ---
 title: "MS Scripting Process Loading WMI Module"
 excerpt: "Command and Scripting Interpreter
-, JavaScript
+, JavaScript/JScript
 "
 categories:
   - Endpoint
@@ -10,7 +10,7 @@ toc: true
 toc_label: ""
 tags:
   - Command and Scripting Interpreter
-  - JavaScript
+  - JavaScript/JScript
   - Execution
   - Execution
   - Splunk Enterprise
@@ -42,7 +42,7 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o
 | -------------- | ---------------- |-------------------- |
 | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
 
-| [T1059.007](https://attack.mitre.org/techniques/T1059/007/) | JavaScript | Execution |
+| [T1059.007](https://attack.mitre.org/techniques/T1059/007/) | JavaScript/JScript | Execution |
 
 #### Search
 
@@ -56,8 +56,8 @@ This search is to detect a suspicious MS scripting process such as wscript.exe o
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `ms_scripting_process_loading_wmi_module_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_query.md b/docs/_posts/2021-09-13-system_user_discovery_with_query.md
index 3ca8d926e0..daaf74649d 100644
--- a/docs/_posts/2021-09-13-system_user_discovery_with_query.md
+++ b/docs/_posts/2021-09-13-system_user_discovery_with_query.md
@@ -52,8 +52,8 @@ This analytic looks for the execution of `query.exe` with command-line arguments
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `system_user_discovery_with_query_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md
index 82d8e67ae8..435da0de7c 100644
--- a/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md
+++ b/docs/_posts/2021-09-13-system_user_discovery_with_whoami.md
@@ -52,8 +52,8 @@ This analytic looks for the execution of `whoami.exe` without any arguments. Thi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `system_user_discovery_with_whoami_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md
index b72d4ff517..6557dc052a 100644
--- a/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md
+++ b/docs/_posts/2021-09-13-user_discovery_with_env_vars_powershell.md
@@ -52,8 +52,8 @@ This analytic looks for the execution of `powershell.exe` with command-line argu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `user_discovery_with_env_vars_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md
index dd2aba13e3..dd07b50de9 100644
--- a/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md
+++ b/docs/_posts/2021-09-13-xsl_script_execution_with_wmic.md
@@ -52,9 +52,9 @@ This search is to detect a suspicious wmic.exe process or renamed wmic process t
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `xsl_script_execution_with_wmic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md
index f4db6c0335..e019f515a0 100644
--- a/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md
+++ b/docs/_posts/2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md
@@ -1,7 +1,7 @@
 ---
 title: "Cmdline Tool Not Executed In CMD Shell"
 excerpt: "Command and Scripting Interpreter
-, JavaScript
+, JavaScript/JScript
 "
 categories:
   - Endpoint
@@ -10,7 +10,7 @@ toc: true
 toc_label: ""
 tags:
   - Command and Scripting Interpreter
-  - JavaScript
+  - JavaScript/JScript
   - Execution
   - Execution
   - Splunk Enterprise
@@ -42,7 +42,7 @@ The following analytic identifies a non-standard parent process (not matching CM
 | -------------- | ---------------- |-------------------- |
 | [T1059](https://attack.mitre.org/techniques/T1059/) | Command and Scripting Interpreter | Execution |
 
-| [T1059.007](https://attack.mitre.org/techniques/T1059/007/) | JavaScript | Execution |
+| [T1059.007](https://attack.mitre.org/techniques/T1059/007/) | JavaScript/JScript | Execution |
 
 #### Search
 
@@ -57,8 +57,8 @@ The following analytic identifies a non-standard parent process (not matching CM
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `cmdline_tool_not_executed_in_cmd_shell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md
index 9f30914cbe..08b4d05a49 100644
--- a/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md
+++ b/docs/_posts/2021-09-14-get_wmiobject_group_discovery.md
@@ -57,8 +57,8 @@ The following hunting analytic identifies the use of `Get-WMIObject Win32_Group`
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `get_wmiobject_group_discovery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-14-net_localgroup_discovery.md b/docs/_posts/2021-09-14-net_localgroup_discovery.md
index 8099831fc0..43b4e3140f 100644
--- a/docs/_posts/2021-09-14-net_localgroup_discovery.md
+++ b/docs/_posts/2021-09-14-net_localgroup_discovery.md
@@ -57,8 +57,8 @@ The following hunting analytic will identify the use of localgroup discovery usi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `net_localgroup_discovery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md
index 42a4924419..65e64741ea 100644
--- a/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md
+++ b/docs/_posts/2021-09-14-powershell_get_localgroup_discovery.md
@@ -57,8 +57,8 @@ The following hunting analytic identifies the use of `get-localgroup` being used
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `powershell_get_localgroup_discovery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-14-wmic_group_discovery.md b/docs/_posts/2021-09-14-wmic_group_discovery.md
index 819b24538a..fff20f183c 100644
--- a/docs/_posts/2021-09-14-wmic_group_discovery.md
+++ b/docs/_posts/2021-09-14-wmic_group_discovery.md
@@ -59,8 +59,8 @@ During triage, review parallel processes and identify any further suspicious beh
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `wmic_group_discovery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md
index af97af64b5..41dceaa103 100644
--- a/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md
+++ b/docs/_posts/2021-09-15-check_elevated_cmd_using_whoami.md
@@ -52,8 +52,8 @@ This search is to detect a suspicious whoami execution to check if the cmd or sh
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `check_elevated_cmd_using_whoami_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-16-account_discovery_with_net_app.md b/docs/_posts/2021-09-16-account_discovery_with_net_app.md
index fdbe633a96..d9fa7aebb5 100644
--- a/docs/_posts/2021-09-16-account_discovery_with_net_app.md
+++ b/docs/_posts/2021-09-16-account_discovery_with_net_app.md
@@ -58,9 +58,9 @@ this search is to detect a potential account discovery series of command used by
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
 
 Note that `account_discovery_with_net_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md
index 2d608e4c58..0c98dfd33f 100644
--- a/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md
+++ b/docs/_posts/2021-09-16-attempt_to_add_certificate_to_untrusted_store.md
@@ -57,9 +57,9 @@ Attempt To Add Certificate To Untrusted Store
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `attempt_to_add_certificate_to_untrusted_store_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md
index c76efdcef3..699f16dfd4 100644
--- a/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md
+++ b/docs/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md
@@ -57,9 +57,9 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
-* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_reg](https://github.com/splunk/security_content/blob/develop/macros/process_reg.yml)
+* [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `attempted_credential_dump_from_registry_via_reg_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
@@ -88,6 +88,7 @@ None identified.
 #### Associated Analytic story
 * [Credential Dumping](/stories/credential_dumping)
 * [DarkSide Ransomware](/stories/darkside_ransomware)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md
index 2cd0e02b5a..073e6090c8 100644
--- a/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md
+++ b/docs/_posts/2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md
@@ -57,10 +57,10 @@ This search detects the use of wmic and Powershell to create a shadow copy.
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_powershell](https://github.com/splunk/security_content/blob/develop/macros/process_powershell.yml)
 
 Note that `creation_of_shadow_copy_with_wmic_and_powershell_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md
index d6ed0543ec..7d780733ed 100644
--- a/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md
+++ b/docs/_posts/2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md
@@ -57,9 +57,9 @@ This search detects credential dumping using copy command from a shadow copy.
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `credential_dumping_via_copy_command_from_shadow_copy_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md
index dbf72b44c2..ab081aca40 100644
--- a/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md
+++ b/docs/_posts/2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md
@@ -57,9 +57,9 @@ This search detects the creation of a symlink to a shadow copy.
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `credential_dumping_via_symlink_to_shadow_copy_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-16-detect_html_help_renamed.md b/docs/_posts/2021-09-16-detect_html_help_renamed.md
index 3708c2488b..6b9e02f389 100644
--- a/docs/_posts/2021-09-16-detect_html_help_renamed.md
+++ b/docs/_posts/2021-09-16-detect_html_help_renamed.md
@@ -57,9 +57,9 @@ The following analytic identifies a renamed instance of hh.exe (HTML Help) execu
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml)
 
 Note that `detect_html_help_renamed_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md
index d629c4cf11..ea879dc6b8 100644
--- a/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md
+++ b/docs/_posts/2021-09-16-detect_html_help_url_in_command_line.md
@@ -57,9 +57,9 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml)
 
 Note that `detect_html_help_url_in_command_line_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md
index 20567e0eb8..142e3fcc0e 100644
--- a/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md
+++ b/docs/_posts/2021-09-16-detect_html_help_using_infotech_storage_handlers.md
@@ -57,9 +57,9 @@ The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTM
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_hh](https://github.com/splunk/security_content/blob/develop/macros/process_hh.yml)
 
 Note that `detect_html_help_using_infotech_storage_handlers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md
index d566ef3ddc..b90ec4a4fe 100644
--- a/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md
+++ b/docs/_posts/2021-09-16-detect_mshta_inline_hta_execution.md
@@ -57,8 +57,8 @@ The following analytic identifies "mshta.exe" execution with inline protocol han
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_mshta_inline_hta_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-detect_mshta_renamed.md b/docs/_posts/2021-09-16-detect_mshta_renamed.md
index 84317e5c12..2f3e403aa0 100644
--- a/docs/_posts/2021-09-16-detect_mshta_renamed.md
+++ b/docs/_posts/2021-09-16-detect_mshta_renamed.md
@@ -57,8 +57,8 @@ The following analytic identifies renamed instances of mshta.exe executing. Msht
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_mshta_renamed_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md
index 7c90130fee..8448b40af3 100644
--- a/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md
+++ b/docs/_posts/2021-09-16-detect_mshta_url_in_command_line.md
@@ -57,8 +57,8 @@ This analytic identifies when Microsoft HTML Application Host (mshta.exe) utilit
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_mshta](https://github.com/splunk/security_content/blob/develop/macros/process_mshta.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_mshta_url_in_command_line_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
diff --git a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md
index 06e6c4a541..7b693004b2 100644
--- a/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md
+++ b/docs/_posts/2021-09-16-detect_psexec_with_accepteula_flag.md
@@ -57,9 +57,9 @@ This search looks for events where `PsExec.exe` is run with the `accepteula` fla
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_psexec](https://github.com/splunk/security_content/blob/develop/macros/process_psexec.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_psexec_with_accepteula_flag_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-16-detect_renamed_7-zip.md b/docs/_posts/2021-09-16-detect_renamed_7-zip.md
index 7a0384440c..323a4318bd 100644
--- a/docs/_posts/2021-09-16-detect_renamed_7-zip.md
+++ b/docs/_posts/2021-09-16-detect_renamed_7-zip.md
@@ -57,8 +57,8 @@ The following analytic identifies renamed 7-Zip usage using Sysmon. At this stag
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_renamed_7-zip_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-16-detect_renamed_psexec.md b/docs/_posts/2021-09-16-detect_renamed_psexec.md
index ff453ed1e9..bd1a57d7b6 100644
--- a/docs/_posts/2021-09-16-detect_renamed_psexec.md
+++ b/docs/_posts/2021-09-16-detect_renamed_psexec.md
@@ -57,9 +57,9 @@ The following analytic identifies renamed instances of `PsExec.exe` being utiliz
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_psexec](https://github.com/splunk/security_content/blob/develop/macros/process_psexec.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_renamed_psexec_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-16-detect_renamed_rclone.md b/docs/_posts/2021-09-16-detect_renamed_rclone.md
index c5eec05b17..89354884da 100644
--- a/docs/_posts/2021-09-16-detect_renamed_rclone.md
+++ b/docs/_posts/2021-09-16-detect_renamed_rclone.md
@@ -51,8 +51,8 @@ The following analytic identifies the usage of `rclone.exe`, renamed, being used
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_renamed_rclone_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-16-detect_renamed_winrar.md b/docs/_posts/2021-09-16-detect_renamed_winrar.md
index cc818d4d12..46e51fe226 100644
--- a/docs/_posts/2021-09-16-detect_renamed_winrar.md
+++ b/docs/_posts/2021-09-16-detect_renamed_winrar.md
@@ -57,8 +57,8 @@ The following analtyic identifies renamed instances of `WinRAR.exe`. In most cas
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_renamed_winrar_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md
index 290b26c167..2142ac1b10 100644
--- a/docs/_posts/2021-09-16-dump_lsass_via_procdump.md
+++ b/docs/_posts/2021-09-16-dump_lsass_via_procdump.md
@@ -58,9 +58,9 @@ During triage, confirm this is procdump.exe executing. If it is the first time a
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_procdump](https://github.com/splunk/security_content/blob/develop/macros/process_procdump.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `dump_lsass_via_procdump_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_net.md b/docs/_posts/2021-09-16-local_account_discovery_with_net.md
index 215aeaf797..8b50301451 100644
--- a/docs/_posts/2021-09-16-local_account_discovery_with_net.md
+++ b/docs/_posts/2021-09-16-local_account_discovery_with_net.md
@@ -57,9 +57,9 @@ This analytic looks for the execution of `net.exe` or `net1.exe` with command-li
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_net](https://github.com/splunk/security_content/blob/develop/macros/process_net.yml)
 
 Note that `local_account_discovery_with_net_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md
index 569b8dba8c..d2a59e31fb 100644
--- a/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md
+++ b/docs/_posts/2021-09-16-local_account_discovery_with_wmic.md
@@ -57,9 +57,9 @@ This analytic looks for the execution of `wmic.exe` with command-line arguments
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `local_account_discovery_with_wmic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-16-office_product_spawning_wmic.md b/docs/_posts/2021-09-16-office_product_spawning_wmic.md
index af12772d54..5f88575df7 100644
--- a/docs/_posts/2021-09-16-office_product_spawning_wmic.md
+++ b/docs/_posts/2021-09-16-office_product_spawning_wmic.md
@@ -57,9 +57,9 @@ The following detection identifies the latest behavior utilized by Ursnif malwar
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `office_product_spawning_wmic_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-16-processes_launching_netsh.md b/docs/_posts/2021-09-16-processes_launching_netsh.md
index 8b4469301f..d347ecac8a 100644
--- a/docs/_posts/2021-09-16-processes_launching_netsh.md
+++ b/docs/_posts/2021-09-16-processes_launching_netsh.md
@@ -57,9 +57,9 @@ This search looks for processes launching netsh.exe. Netsh is a command-line scr
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_netsh](https://github.com/splunk/security_content/blob/develop/macros/process_netsh.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `processes_launching_netsh_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md
index 7ee6b47c4f..c2f75255ab 100644
--- a/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md
+++ b/docs/_posts/2021-09-20-office_document_spawned_child_process_to_download.md
@@ -57,8 +57,8 @@ This search is to detect potential malicious office document executing lolbin ch
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `office_document_spawned_child_process_to_download_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md b/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md
index f225220998..5ed4183b49 100644
--- a/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md
+++ b/docs/_posts/2021-09-20-suspicious_microsoft_workflow_compiler_rename.md
@@ -62,9 +62,9 @@ The following analytic identifies a renamed instance of microsoft.workflow.compi
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_microsoftworkflowcompiler](https://github.com/splunk/security_content/blob/develop/macros/process_microsoftworkflowcompiler.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `suspicious_microsoft_workflow_compiler_rename_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md
index 7f4a00ec73..30585a9539 100644
--- a/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md
+++ b/docs/_posts/2021-09-21-remcos_rat_file_creation_in_remcos_folder.md
@@ -52,8 +52,8 @@ This search is to detect file creation in remcos folder in appdata which is the
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `remcos_rat_file_creation_in_remcos_folder_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-27-change_default_file_association.md b/docs/_posts/2021-09-27-change_default_file_association.md
index 7eeccc4f08..2cc942ccbf 100644
--- a/docs/_posts/2021-09-27-change_default_file_association.md
+++ b/docs/_posts/2021-09-27-change_default_file_association.md
@@ -59,8 +59,8 @@ This analytic is developed to detect suspicious registry modification to change
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `change_default_file_association_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
@@ -82,6 +82,7 @@ unknown
 #### Associated Analytic story
 * [Windows Persistence Techniques](/stories/windows_persistence_techniques)
 * [Windows Privilege Escalation](/stories/windows_privilege_escalation)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md b/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md
index a09415322d..d7c134887b 100644
--- a/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md
+++ b/docs/_posts/2021-09-27-logon_script_event_trigger_execution.md
@@ -59,8 +59,8 @@ This search is to detect a suspicious modification of registry entry to persist
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `logon_script_event_trigger_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md b/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md
index 453c63c8ee..572d207fbc 100644
--- a/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md
+++ b/docs/_posts/2021-09-27-screensaver_event_trigger_execution.md
@@ -59,8 +59,8 @@ This analytic is developed to detect possible event trigger execution through sc
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `screensaver_event_trigger_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
@@ -82,6 +82,7 @@ unknown
 #### Associated Analytic story
 * [Windows Persistence Techniques](/stories/windows_persistence_techniques)
 * [Windows Privilege Escalation](/stories/windows_privilege_escalation)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2021-09-28-print_processor_registry_autostart.md b/docs/_posts/2021-09-28-print_processor_registry_autostart.md
index fca646fc11..5a20384314 100644
--- a/docs/_posts/2021-09-28-print_processor_registry_autostart.md
+++ b/docs/_posts/2021-09-28-print_processor_registry_autostart.md
@@ -61,8 +61,8 @@ This analytic is to detect a suspicious modification or new registry entry regar
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `print_processor_registry_autostart_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-09-29-verclsid_clsid_execution.md b/docs/_posts/2021-09-29-verclsid_clsid_execution.md
index 8dc50727dc..1e94107b61 100644
--- a/docs/_posts/2021-09-29-verclsid_clsid_execution.md
+++ b/docs/_posts/2021-09-29-verclsid_clsid_execution.md
@@ -57,9 +57,9 @@ This analytic is to detect a possible abuse of verclsid to execute malicious fil
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_verclsid](https://github.com/splunk/security_content/blob/develop/macros/process_verclsid.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `verclsid_clsid_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md b/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md
index 2e26b51d1b..50cd249320 100644
--- a/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md
+++ b/docs/_posts/2021-10-01-vbscript_execution_using_wscript_app.md
@@ -57,8 +57,8 @@ This analytic is to detect a suspicious wscript commandline to execute vbscript.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `vbscript_execution_using_wscript_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md
index 1df4c79565..2f583e4071 100644
--- a/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md
+++ b/docs/_posts/2021-10-04-msbuild_suspicious_spawned_by_script_process.md
@@ -57,9 +57,9 @@ This analytic is to detect a suspicious child process of MSBuild spawned by Wind
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml)
 
 Note that `msbuild_suspicious_spawned_by_script_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md
index e462bf4e56..f7974ffe51 100644
--- a/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md
+++ b/docs/_posts/2021-10-04-regsvr32_silent_and_install_param_dll_loading.md
@@ -59,9 +59,9 @@ This analytic is to detect a loading of dll using regsvr32 application with sile
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_regsvr32](https://github.com/splunk/security_content/blob/develop/macros/process_regsvr32.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `regsvr32_silent_and_install_param_dll_loading_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
@@ -87,6 +87,7 @@ To successfully implement this search you need to be ingesting information on pr
 Other third part application may used this parameter but not so common in base windows environment.
 
 #### Associated Analytic story
+* [Data Destruction](/stories/data_destruction)
 * [Suspicious Regsvr32 Activity](/stories/suspicious_regsvr32_activity)
 * [Remcos](/stories/remcos)
 * [Hermetic Wiper](/stories/hermetic_wiper)
diff --git a/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md b/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md
index d66f2e7caa..ed96b313b2 100644
--- a/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md
+++ b/docs/_posts/2021-10-05-malicious_inprocserver32_modification.md
@@ -62,8 +62,8 @@ The following analytic identifies a process modifying the registry with a known
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `malicious_inprocserver32_modification_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md b/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md
index ef4e8f1ee3..1b9afc634a 100644
--- a/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md
+++ b/docs/_posts/2021-10-05-process_writing_dynamicwrapperx.md
@@ -62,8 +62,8 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `process_writing_dynamicwrapperx_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md
index 31104ce5a3..613c09d940 100644
--- a/docs/_posts/2021-10-05-rundll32_shimcache_flush.md
+++ b/docs/_posts/2021-10-05-rundll32_shimcache_flush.md
@@ -52,9 +52,9 @@ This analytic is to detect a suspicious rundll32 commandline to clear shim cache
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 
 Note that `rundll32_shimcache_flush_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-10-05-suspicious_copy_on_system32.md b/docs/_posts/2021-10-05-suspicious_copy_on_system32.md
index a02f7dd360..b6b609944a 100644
--- a/docs/_posts/2021-10-05-suspicious_copy_on_system32.md
+++ b/docs/_posts/2021-10-05-suspicious_copy_on_system32.md
@@ -57,9 +57,9 @@ This analytic is to detect a suspicious copy of file from systemroot folder of t
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_copy](https://github.com/splunk/security_content/blob/develop/macros/process_copy.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `suspicious_copy_on_system32_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md b/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md
index 7b44650cf8..c5be9a65da 100644
--- a/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md
+++ b/docs/_posts/2021-10-05-winhlp32_spawning_a_process.md
@@ -53,8 +53,8 @@ The following analytic identifies winhlp32.exe, found natively in `c:\windows\`,
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `winhlp32_spawning_a_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md b/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md
index 4ee26e1dcd..78bf5bc4b7 100644
--- a/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md
+++ b/docs/_posts/2021-10-06-wscript_or_cscript_suspicious_child_process.md
@@ -71,8 +71,8 @@ This analytic identifies a suspicious spawned process by WScript or CScript proc
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `wscript_or_cscript_suspicious_child_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md b/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md
index 759014c7e0..bc13ef81f4 100644
--- a/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md
+++ b/docs/_posts/2021-10-11-suspicious_wevtutil_usage.md
@@ -57,8 +57,8 @@ The wevtutil.exe application is the windows event log utility. This searches for
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `suspicious_wevtutil_usage_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md
index 3605a97c4b..ad1f6438e7 100644
--- a/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md
+++ b/docs/_posts/2021-10-14-serviceprincipalnames_discovery_with_setspn.md
@@ -59,9 +59,9 @@ During triage, review parallel processes for further suspicious activity.
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_setspn](https://github.com/splunk/security_content/blob/develop/macros/process_setspn.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `serviceprincipalnames_discovery_with_setspn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-10-18-disable_schedule_task.md b/docs/_posts/2021-10-18-disable_schedule_task.md
index 8e24e1c464..ec96c31e8e 100644
--- a/docs/_posts/2021-10-18-disable_schedule_task.md
+++ b/docs/_posts/2021-10-18-disable_schedule_task.md
@@ -57,8 +57,8 @@ This analytic is to detect a suspicious commandline to disable existing schedule
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `disable_schedule_task_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md
index c2a72b11ed..e823cf11e5 100644
--- a/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md
+++ b/docs/_posts/2021-10-19-windows_curl_download_to_suspicious_path.md
@@ -54,9 +54,9 @@ During triage, review parallel processes for further behavior. In addition, iden
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_curl_download_to_suspicious_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md b/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md
index e26bb74d62..21b9614936 100644
--- a/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md
+++ b/docs/_posts/2021-10-20-wmic_noninteractive_app_uninstallation.md
@@ -57,8 +57,8 @@ This analytic is to detect a suspicious wmic commandlined that uninstall applica
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `wmic_noninteractive_app_uninstallation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-03-windows_adfind_exe.md b/docs/_posts/2021-11-03-windows_adfind_exe.md
index 2172d48449..3b156ca908 100644
--- a/docs/_posts/2021-11-03-windows_adfind_exe.md
+++ b/docs/_posts/2021-11-03-windows_adfind_exe.md
@@ -52,8 +52,8 @@ This search looks for the execution of `adfind.exe` with command-line arguments
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_adfind_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md b/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md
index 94a49b9412..87cbc20554 100644
--- a/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md
+++ b/docs/_posts/2021-11-04-attacker_tools_on_endpoint.md
@@ -69,8 +69,8 @@ This search looks for execution of commonly used attacker tools on an endpoint.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `attacker_tools_on_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md
index 3fd652b65b..8b220090ca 100644
--- a/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md
+++ b/docs/_posts/2021-11-10-windows_curl_upload_to_remote_destination.md
@@ -56,9 +56,9 @@ Adversaries may use one of the three methods based on the remote destination and
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_curl](https://github.com/splunk/security_content/blob/develop/macros/process_curl.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_curl_upload_to_remote_destination_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md b/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md
index fcd2e80acb..79fd97d356 100644
--- a/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md
+++ b/docs/_posts/2021-11-10-windows_service_creation_on_remote_endpoint.md
@@ -59,8 +59,8 @@ This analytic looks for the execution of `sc.exe` with command-line arguments ut
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_service_creation_on_remote_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md b/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md
index b9aa422bfd..071172998f 100644
--- a/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md
+++ b/docs/_posts/2021-11-10-windows_service_initiation_on_remote_endpoint.md
@@ -59,8 +59,8 @@ This analytic looks for the execution of `sc.exe` with command-line arguments ut
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_service_initiation_on_remote_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md b/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md
index f19a90005b..b1ff7ee3c9 100644
--- a/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md
+++ b/docs/_posts/2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md
@@ -57,8 +57,8 @@ This analytic looks for the execution of `winrs.exe` with command-line arguments
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `remote_process_instantiation_via_winrm_and_winrs_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md b/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md
index a9a25d464a..2910c1514c 100644
--- a/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md
+++ b/docs/_posts/2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md
@@ -61,8 +61,8 @@ This analytic looks for the execution of `at.exe` with command-line arguments ut
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `scheduled_task_creation_on_remote_endpoint_using_at_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md b/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md
index 8addb2be9b..5456163418 100644
--- a/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md
+++ b/docs/_posts/2021-11-11-scheduled_task_initiation_on_remote_endpoint.md
@@ -61,8 +61,8 @@ This analytic looks for the execution of `schtasks.exe` with command-line argume
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `scheduled_task_initiation_on_remote_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md b/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md
index 8646bf2cf5..d08d6722fd 100644
--- a/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md
+++ b/docs/_posts/2021-11-11-schtasks_scheduling_job_on_remote_system.md
@@ -61,8 +61,8 @@ This analytic looks for the execution of `schtasks.exe` with command-line argume
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `schtasks_scheduling_job_on_remote_system_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md
index 38aade2146..2f11753b85 100644
--- a/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md
+++ b/docs/_posts/2021-11-11-wmic_xsl_execution_via_url.md
@@ -52,9 +52,9 @@ The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible St
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `wmic_xsl_execution_via_url_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md
index 2b8c2e1843..6d8b15cb49 100644
--- a/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md
+++ b/docs/_posts/2021-11-12-csc_net_on_the_fly_compilation.md
@@ -57,9 +57,9 @@ this analytic is to detect a suspicious compile before delivery approach of .net
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_csc](https://github.com/splunk/security_content/blob/develop/macros/process_csc.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `csc_net_on_the_fly_compilation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-12-firewall_allowed_program_enable.md b/docs/_posts/2021-11-12-firewall_allowed_program_enable.md
index d3c3996330..f4d641b14c 100644
--- a/docs/_posts/2021-11-12-firewall_allowed_program_enable.md
+++ b/docs/_posts/2021-11-12-firewall_allowed_program_enable.md
@@ -57,8 +57,8 @@ This analytic detects a potential suspicious modification of firewall rule allow
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `firewall_allowed_program_enable_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md
index 17678de486..0b378307ed 100644
--- a/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md
+++ b/docs/_posts/2021-11-12-network_discovery_using_route_windows_app.md
@@ -57,9 +57,9 @@ This analytic look for a spawned process of route.exe windows application. Adver
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_route](https://github.com/splunk/security_content/blob/develop/macros/process_route.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `network_discovery_using_route_windows_app_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md
index 10b4a986ee..9153f61363 100644
--- a/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md
+++ b/docs/_posts/2021-11-12-remote_process_instantiation_via_wmi.md
@@ -52,9 +52,9 @@ This analytic identifies wmic.exe being launched with parameters to spawn a proc
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `remote_process_instantiation_via_wmi_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-12-runas_execution_in_commandline.md b/docs/_posts/2021-11-12-runas_execution_in_commandline.md
index 02ff558b5a..f58f293924 100644
--- a/docs/_posts/2021-11-12-runas_execution_in_commandline.md
+++ b/docs/_posts/2021-11-12-runas_execution_in_commandline.md
@@ -59,9 +59,9 @@ This analytic look for a spawned runas.exe process with a administrator user opt
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_runas](https://github.com/splunk/security_content/blob/develop/macros/process_runas.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `runas_execution_in_commandline_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-12-windows_installutil_credential_theft.md b/docs/_posts/2021-11-12-windows_installutil_credential_theft.md
index 667e369fa6..5c1b1f473e 100644
--- a/docs/_posts/2021-11-12-windows_installutil_credential_theft.md
+++ b/docs/_posts/2021-11-12-windows_installutil_credential_theft.md
@@ -60,8 +60,8 @@ During triage review resulting network connections, file modifications, and para
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_installutil_credential_theft_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md
index 3845642efb..8239962fcf 100644
--- a/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md
+++ b/docs/_posts/2021-11-12-windows_installutil_uninstall_option.md
@@ -61,9 +61,9 @@ During triage review resulting network connections, file modifications, and para
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `windows_installutil_uninstall_option_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md
index 4772be895d..ddf92e92cd 100644
--- a/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md
+++ b/docs/_posts/2021-11-12-windows_installutil_url_in_command_line.md
@@ -60,9 +60,9 @@ During triage review resulting network connections, file modifications, and para
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `windows_installutil_url_in_command_line_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-15-windows_diskcryptor_usage.md b/docs/_posts/2021-11-15-windows_diskcryptor_usage.md
index 5b810dfe94..2e50a9a2bb 100644
--- a/docs/_posts/2021-11-15-windows_diskcryptor_usage.md
+++ b/docs/_posts/2021-11-15-windows_diskcryptor_usage.md
@@ -52,8 +52,8 @@ The following analytic identifies DiskCryptor  process name of dcrypt.exe or int
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_diskcryptor_usage_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-17-windows_dism_remove_defender.md b/docs/_posts/2021-11-17-windows_dism_remove_defender.md
index 84d432e2c4..90d1e1fb06 100644
--- a/docs/_posts/2021-11-17-windows_dism_remove_defender.md
+++ b/docs/_posts/2021-11-17-windows_dism_remove_defender.md
@@ -57,8 +57,8 @@ The following analytic identifies the use of the Windows Disk Image Utility, `di
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_dism_remove_defender_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md
index 55963a1110..79205f3608 100644
--- a/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md
+++ b/docs/_posts/2021-11-18-executable_file_written_in_administrative_smb_share.md
@@ -79,6 +79,7 @@ To successfully implement this search, you need to be ingesting Windows Security
 System Administrators may use looks like PsExec for troubleshooting or administrations tasks. However, this will typically come only from certain users and certain systems that can be added to an allow list.
 
 #### Associated Analytic story
+* [Data Destruction](/stories/data_destruction)
 * [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 * [Trickbot](/stories/trickbot)
 * [Hermetic Wiper](/stories/hermetic_wiper)
diff --git a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md
index 1412062c6b..863243fbbb 100644
--- a/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md
+++ b/docs/_posts/2021-11-18-loading_of_dynwrapx_module.md
@@ -58,8 +58,8 @@ DynamicWrapperX is an ActiveX component that can be used in a script to call Win
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `loading_of_dynwrapx_module_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md
index 0527982289..9ad8ac8609 100644
--- a/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md
+++ b/docs/_posts/2021-11-19-system_info_gathering_using_dxdiag_application.md
@@ -52,9 +52,9 @@ This analytic is to detect a suspicious dxdiag.exe process command-line executio
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_dxdiag](https://github.com/splunk/security_content/blob/develop/macros/process_dxdiag.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `system_info_gathering_using_dxdiag_application_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md
index 6b503e9ada..3746997bcb 100644
--- a/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md
+++ b/docs/_posts/2021-11-22-possible_browser_pass_view_parameter.md
@@ -57,8 +57,8 @@ This analytic will detect if a suspicious process contains a commandline paramet
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `possible_browser_pass_view_parameter_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md
index 3798452bc4..1a124e48ec 100644
--- a/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-22-services_lolbas_execution_process_spawn.md
@@ -59,8 +59,8 @@ The following analytic identifies `services.exe` spawning a LOLBAS execution pro
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `services_lolbas_execution_process_spawn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md
index 8ba87bdb66..62b2e95c7d 100644
--- a/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-22-svchost_lolbas_execution_process_spawn.md
@@ -61,8 +61,8 @@ The following analytic identifies `svchost.exe` spawning a LOLBAS execution proc
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `svchost_lolbas_execution_process_spawn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md
index 25a02762d9..b23417e0a1 100644
--- a/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md
+++ b/docs/_posts/2021-11-22-windows_service_created_with_suspicious_service_path.md
@@ -55,8 +55,8 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_service_created_with_suspicious_service_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md
index e1d1f7b305..0c7da8ab9c 100644
--- a/docs/_posts/2021-11-22-windows_service_created_within_public_path.md
+++ b/docs/_posts/2021-11-22-windows_service_created_within_public_path.md
@@ -57,8 +57,8 @@ The following analytc uses Windows Event Id 7045, `New Service Was Installed`, t
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_service_created_within_public_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md
index bee9fe8ccf..d2e85efd46 100644
--- a/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-22-wmiprsve_lolbas_execution_process_spawn.md
@@ -52,8 +52,8 @@ The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution pro
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `wmiprsve_lolbas_execution_process_spawn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md
index bdc2b8d64c..8a2bd4a172 100644
--- a/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md
@@ -57,8 +57,8 @@ The following analytic identifies `Wsmprovhost.exe` spawning a LOLBAS execution
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `wsmprovhost_lolbas_execution_process_spawn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md b/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md
index 29ef270dc9..beb1e33cc6 100644
--- a/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md
+++ b/docs/_posts/2021-11-23-mmc_lolbas_execution_process_spawn.md
@@ -57,8 +57,8 @@ The following analytic identifies `mmc.exe` spawning a LOLBAS execution process.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `mmc_lolbas_execution_process_spawn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md b/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md
index fe19ee8876..a4432cb9f4 100644
--- a/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md
+++ b/docs/_posts/2021-11-25-add_or_set_windows_defender_exclusion.md
@@ -57,8 +57,8 @@ This analytic will identify a suspicious process command-line related to Windows
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `add_or_set_windows_defender_exclusion_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md
index 607fa4ec17..ae6a3cef07 100644
--- a/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md
+++ b/docs/_posts/2021-11-29-detect_rclone_command-line_usage.md
@@ -52,9 +52,9 @@ This analytic identifies commonly used command-line arguments used by `rclone.ex
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_rclone](https://github.com/splunk/security_content/blob/develop/macros/process_rclone.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_rclone_command-line_usage_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md b/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md
index 6143761d87..686c095e61 100644
--- a/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md
+++ b/docs/_posts/2021-11-29-possible_lateral_movement_powershell_spawn.md
@@ -85,8 +85,8 @@ The following analytic assists with identifying a PowerShell process spawned as
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `possible_lateral_movement_powershell_spawn_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md b/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md
index 2d995f3691..b59bc0956f 100644
--- a/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md
+++ b/docs/_posts/2021-12-06-suspicious_linux_discovery_commands.md
@@ -57,8 +57,8 @@ The search logic specifically looks for high number of distinct commands run in
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `suspicious_linux_discovery_commands_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md b/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md
index 5078e0885f..9ff9a2c525 100644
--- a/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md
+++ b/docs/_posts/2021-12-07-windows_raccine_scheduled_task_deletion.md
@@ -52,8 +52,8 @@ The following analytic identifies the Raccine Rules Updater scheduled task being
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_raccine_scheduled_task_deletion_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md
index a154d93732..4777de146d 100644
--- a/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md
+++ b/docs/_posts/2021-12-08-msi_module_loaded_by_non-system_binary.md
@@ -65,8 +65,8 @@ In addition, `msi.dll` has been abused in DLL side-loading attacks by being load
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `msi_module_loaded_by_non-system_binary_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md
index 380285d4db..2bf310a926 100644
--- a/docs/_posts/2021-12-10-curl_download_and_bash_execution.md
+++ b/docs/_posts/2021-12-10-curl_download_and_bash_execution.md
@@ -54,8 +54,8 @@ The following analytic identifies the use of curl on Linux or MacOS attempting t
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `curl_download_and_bash_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md
index 6edd380484..b4bfb5d263 100644
--- a/docs/_posts/2021-12-11-wget_download_and_bash_execution.md
+++ b/docs/_posts/2021-12-11-wget_download_and_bash_execution.md
@@ -54,8 +54,8 @@ The following analytic identifies the use of wget on Linux or MacOS attempting t
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `wget_download_and_bash_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md
index 926d2be5e8..ced63b6312 100644
--- a/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md
+++ b/docs/_posts/2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md
@@ -64,8 +64,8 @@ CVE-2021-44228 Log4Shell payloads can be injected via various methods, but on of
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `log4shell_jndi_payload_injection_with_outbound_connection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md b/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md
index 64f9524f73..2f8040590f 100644
--- a/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md
+++ b/docs/_posts/2021-12-13-outbound_network_connection_from_java_using_default_ports.md
@@ -57,8 +57,8 @@ A required step while exploiting the CVE-2021-44228-Log4j vulnerability is that
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `outbound_network_connection_from_java_using_default_ports_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-13-windows_java_spawning_shells.md b/docs/_posts/2021-12-13-windows_java_spawning_shells.md
index 1dc3c805b0..9454cf32d5 100644
--- a/docs/_posts/2021-12-13-windows_java_spawning_shells.md
+++ b/docs/_posts/2021-12-13-windows_java_spawning_shells.md
@@ -55,9 +55,9 @@ The following analytic identifies the process name of java.exe and w3wp.exe spaw
 
 #### Macros
 The SPL above uses the following Macros:
-* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml)
 
 Note that `windows_java_spawning_shells_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md b/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md
index 11104a06e3..396953d638 100644
--- a/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md
+++ b/docs/_posts/2021-12-17-linux_add_files_in_known_crontab_directories.md
@@ -61,8 +61,8 @@ The following analytic identifies a suspicious file creation in known cron table
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_add_files_in_known_crontab_directories_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md b/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md
index 97bba054e3..0768f94dd2 100644
--- a/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md
+++ b/docs/_posts/2021-12-17-linux_at_allow_config_file_creation.md
@@ -61,8 +61,8 @@ The following analytic identifies a suspicious file creation of /etc/at.allow or
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_at_allow_config_file_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-17-linux_at_application_execution.md b/docs/_posts/2021-12-17-linux_at_application_execution.md
index 2fdbee4543..8bdee9e9e8 100644
--- a/docs/_posts/2021-12-17-linux_at_application_execution.md
+++ b/docs/_posts/2021-12-17-linux_at_application_execution.md
@@ -61,8 +61,8 @@ The following analytic identifies a suspicious process creation of At applicatio
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_at_application_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md b/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md
index 2f77a91aae..05f40abbcf 100644
--- a/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md
+++ b/docs/_posts/2021-12-17-linux_edit_cron_table_parameter.md
@@ -61,8 +61,8 @@ The following analytic identifies a suspicious cronjobs modification using cront
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_edit_cron_table_parameter_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-17-linux_possible_append_command_to_at_allow_config_file.md b/docs/_posts/2021-12-17-linux_possible_append_command_to_at_allow_config_file.md
index 3138b11829..c03c882540 100644
--- a/docs/_posts/2021-12-17-linux_possible_append_command_to_at_allow_config_file.md
+++ b/docs/_posts/2021-12-17-linux_possible_append_command_to_at_allow_config_file.md
@@ -61,8 +61,8 @@ This analytic looks for suspicious commandline that may use to append user entry
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_possible_append_command_to_at_allow_config_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md b/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md
index 8be54e459e..0e436ba06d 100644
--- a/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md
+++ b/docs/_posts/2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md
@@ -61,8 +61,8 @@ This analytic looks for possible suspicious commandline that may use to append a
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_possible_append_cronjob_entry_on_existing_cronjob_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md b/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md
index e9f30e54ff..99c89738b4 100644
--- a/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md
+++ b/docs/_posts/2021-12-17-linux_possible_cronjob_modification_with_editor.md
@@ -61,8 +61,8 @@ This analytic looks for possible modification of cronjobs file using editor. Thi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_possible_cronjob_modification_with_editor_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md b/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md
index 50568f876e..497257fc6d 100644
--- a/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md
+++ b/docs/_posts/2021-12-20-linux_file_creation_in_init_boot_directory.md
@@ -1,6 +1,6 @@
 ---
 title: "Linux File Creation In Init Boot Directory"
-excerpt: "RC Scripts
+excerpt: "Rc.common
 , Boot or Logon Initialization Scripts
 "
 categories:
@@ -9,7 +9,7 @@ last_modified_at: 2021-12-20
 toc: true
 toc_label: ""
 tags:
-  - RC Scripts
+  - Rc.common
   - Boot or Logon Initialization Scripts
   - Persistence
   - Privilege Escalation
@@ -42,7 +42,7 @@ This analytic looks for suspicious file creation on init system directories for
 
 | ID             | Technique        |  Tactic             |
 | -------------- | ---------------- |-------------------- |
-| [T1037.004](https://attack.mitre.org/techniques/T1037/004/) | RC Scripts | Persistence, Privilege Escalation |
+| [T1037.004](https://attack.mitre.org/techniques/T1037/004/) | Rc.common | Persistence, Privilege Escalation |
 
 | [T1037](https://attack.mitre.org/techniques/T1037/) | Boot or Logon Initialization Scripts | Persistence, Privilege Escalation |
 
@@ -59,8 +59,8 @@ This analytic looks for suspicious file creation on init system directories for
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_file_creation_in_init_boot_directory_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md b/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md
index e31030e3e6..197a65a4fb 100644
--- a/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md
+++ b/docs/_posts/2021-12-20-linux_file_creation_in_profile_directory.md
@@ -1,6 +1,6 @@
 ---
 title: "Linux File Creation In Profile Directory"
-excerpt: "Unix Shell Configuration Modification
+excerpt: ".bash_profile and .bashrc
 , Event Triggered Execution
 "
 categories:
@@ -9,7 +9,7 @@ last_modified_at: 2021-12-20
 toc: true
 toc_label: ""
 tags:
-  - Unix Shell Configuration Modification
+  - .bash_profile and .bashrc
   - Event Triggered Execution
   - Persistence
   - Privilege Escalation
@@ -42,7 +42,7 @@ This analytic looks for suspicious file creation in /etc/profile.d directory to
 
 | ID             | Technique        |  Tactic             |
 | -------------- | ---------------- |-------------------- |
-| [T1546.004](https://attack.mitre.org/techniques/T1546/004/) | Unix Shell Configuration Modification | Persistence, Privilege Escalation |
+| [T1546.004](https://attack.mitre.org/techniques/T1546/004/) | .bash_profile and .bashrc | Persistence, Privilege Escalation |
 
 | [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Persistence, Privilege Escalation |
 
@@ -59,8 +59,8 @@ This analytic looks for suspicious file creation in /etc/profile.d directory to
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_file_creation_in_profile_directory_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md b/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md
index cc4e5c784e..29a2a0cf91 100644
--- a/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md
+++ b/docs/_posts/2021-12-20-linux_possible_append_command_to_profile_config_file.md
@@ -1,6 +1,6 @@
 ---
 title: "Linux Possible Append Command To Profile Config File"
-excerpt: "Unix Shell Configuration Modification
+excerpt: ".bash_profile and .bashrc
 , Event Triggered Execution
 "
 categories:
@@ -9,7 +9,7 @@ last_modified_at: 2021-12-20
 toc: true
 toc_label: ""
 tags:
-  - Unix Shell Configuration Modification
+  - .bash_profile and .bashrc
   - Event Triggered Execution
   - Persistence
   - Privilege Escalation
@@ -42,7 +42,7 @@ This analytic looks for suspicious command-lines that can be possibly used to mo
 
 | ID             | Technique        |  Tactic             |
 | -------------- | ---------------- |-------------------- |
-| [T1546.004](https://attack.mitre.org/techniques/T1546/004/) | Unix Shell Configuration Modification | Persistence, Privilege Escalation |
+| [T1546.004](https://attack.mitre.org/techniques/T1546/004/) | .bash_profile and .bashrc | Persistence, Privilege Escalation |
 
 | [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Persistence, Privilege Escalation |
 
@@ -59,8 +59,8 @@ This analytic looks for suspicious command-lines that can be possibly used to mo
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_possible_append_command_to_profile_config_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md b/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md
index f11c7e8c67..8d0094265a 100644
--- a/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md
+++ b/docs/_posts/2021-12-20-linux_service_file_created_in_systemd_directory.md
@@ -61,8 +61,8 @@ This analytic looks for suspicious file creation in systemd timer directory in l
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_service_file_created_in_systemd_directory_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-20-linux_service_restarted.md b/docs/_posts/2021-12-20-linux_service_restarted.md
index eee0bc61fc..336a689686 100644
--- a/docs/_posts/2021-12-20-linux_service_restarted.md
+++ b/docs/_posts/2021-12-20-linux_service_restarted.md
@@ -61,8 +61,8 @@ This analytic looks for restarted or re-enable services in linux platform. This
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_service_restarted_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-20-linux_service_started_or_enabled.md b/docs/_posts/2021-12-20-linux_service_started_or_enabled.md
index 88118dec91..5d0386a187 100644
--- a/docs/_posts/2021-12-20-linux_service_started_or_enabled.md
+++ b/docs/_posts/2021-12-20-linux_service_started_or_enabled.md
@@ -61,8 +61,8 @@ This analytic looks for created or enable services in linux platform. This techn
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_service_started_or_enabled_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-21-linux_add_user_account.md b/docs/_posts/2021-12-21-linux_add_user_account.md
index d83ff36bf1..b98844bdf8 100644
--- a/docs/_posts/2021-12-21-linux_add_user_account.md
+++ b/docs/_posts/2021-12-21-linux_add_user_account.md
@@ -57,8 +57,8 @@ This analytic looks for commands to create user accounts on the linux platform.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_add_user_account_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md b/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md
index 7b1c8e08de..a983067e56 100644
--- a/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md
+++ b/docs/_posts/2021-12-21-linux_change_file_owner_to_root.md
@@ -57,8 +57,8 @@ This analytic looks for a commandline that change the file owner to root using c
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_change_file_owner_to_root_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md b/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md
index df7ee8affc..3086c912dd 100644
--- a/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md
+++ b/docs/_posts/2021-12-21-linux_nopasswd_entry_in_sudoers_file.md
@@ -59,8 +59,8 @@ This analytic is to look for suspicious command lines that may add entry to /etc
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_nopasswd_entry_in_sudoers_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md b/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md
index fdacc24010..95b60cbbba 100644
--- a/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md
+++ b/docs/_posts/2021-12-21-linux_setuid_using_chmod_utility.md
@@ -59,8 +59,8 @@ This analytic looks for suspicious chmod utility execution to enable SUID bit. T
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_setuid_using_chmod_utility_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md b/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md
index 5a61e301f7..15cb5ab657 100644
--- a/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md
+++ b/docs/_posts/2021-12-21-linux_setuid_using_setcap_utility.md
@@ -59,8 +59,8 @@ This analytic looks for suspicious setcap utility execution to enable SUID bit.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_setuid_using_setcap_utility_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-21-linux_visudo_utility_execution.md b/docs/_posts/2021-12-21-linux_visudo_utility_execution.md
index 5651a83a54..a3a4320b2b 100644
--- a/docs/_posts/2021-12-21-linux_visudo_utility_execution.md
+++ b/docs/_posts/2021-12-21-linux_visudo_utility_execution.md
@@ -59,8 +59,8 @@ This analytic is to looks for suspicious commandline that add entry to /etc/sudo
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_visudo_utility_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md b/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md
index ac0ce8567a..af1f7ee538 100644
--- a/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md
+++ b/docs/_posts/2021-12-22-linux_file_created_in_kernel_driver_directory.md
@@ -59,8 +59,8 @@ This analytic looks for suspicious file creation in kernel/driver directory in l
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_file_created_in_kernel_driver_directory_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md b/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md
index b8b9fe327f..001fac9590 100644
--- a/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md
+++ b/docs/_posts/2021-12-22-linux_insert_kernel_module_using_insmod_utility.md
@@ -59,8 +59,8 @@ This analytic looks for inserting of linux kernel module using insmod utility fu
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_insert_kernel_module_using_insmod_utility_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md b/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md
index 077b070e62..9403b3fc57 100644
--- a/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md
+++ b/docs/_posts/2021-12-22-linux_install_kernel_module_using_modprobe_utility.md
@@ -59,8 +59,8 @@ This analytic looks for possible installing a linux kernel module using modprobe
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_install_kernel_module_using_modprobe_utility_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md b/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md
index 9ead51a7a9..c4422be577 100644
--- a/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md
+++ b/docs/_posts/2021-12-22-linux_preload_hijack_library_calls.md
@@ -1,6 +1,6 @@
 ---
 title: "Linux Preload Hijack Library Calls"
-excerpt: "Dynamic Linker Hijacking
+excerpt: "LD_PRELOAD
 , Hijack Execution Flow
 "
 categories:
@@ -9,7 +9,7 @@ last_modified_at: 2021-12-22
 toc: true
 toc_label: ""
 tags:
-  - Dynamic Linker Hijacking
+  - LD_PRELOAD
   - Hijack Execution Flow
   - Defense Evasion
   - Persistence
@@ -44,7 +44,7 @@ This analytic is to detect a suspicious command that may hijack a library functi
 
 | ID             | Technique        |  Tactic             |
 | -------------- | ---------------- |-------------------- |
-| [T1574.006](https://attack.mitre.org/techniques/T1574/006/) | Dynamic Linker Hijacking | Defense Evasion, Persistence, Privilege Escalation |
+| [T1574.006](https://attack.mitre.org/techniques/T1574/006/) | LD_PRELOAD | Defense Evasion, Persistence, Privilege Escalation |
 
 | [T1574](https://attack.mitre.org/techniques/T1574/) | Hijack Execution Flow | Defense Evasion, Persistence, Privilege Escalation |
 
@@ -61,8 +61,8 @@ This analytic is to detect a suspicious command that may hijack a library functi
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_preload_hijack_library_calls_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md b/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md
index 45c8046cc6..e82f59c57d 100644
--- a/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md
+++ b/docs/_posts/2021-12-23-linux_common_process_for_elevation_control.md
@@ -59,8 +59,8 @@ This analytic is to look for possible elevation control access using a common kn
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_common_process_for_elevation_control_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md b/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md
index b777df2f57..f04a3f2c82 100644
--- a/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md
+++ b/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md
@@ -59,8 +59,8 @@ This analytic is to looks for file creation of sudoers.tmp file cause by editing
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_sudoers_tmp_file_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md b/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md
index fb99121ecd..ad2414c79c 100644
--- a/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md
+++ b/docs/_posts/2022-01-04-linux_sudo_or_su_execution.md
@@ -59,8 +59,8 @@ This analytic is to detect the execution of sudo or su command in linux operatin
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_sudo_or_su_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md b/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md
index 4bd04da89e..f0c2d0f586 100644
--- a/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md
+++ b/docs/_posts/2022-01-05-linux_doas_conf_file_creation.md
@@ -59,8 +59,8 @@ This analytic is to detect the creation of doas.conf file in linux host platform
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_doas_conf_file_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-01-05-linux_doas_tool_execution.md b/docs/_posts/2022-01-05-linux_doas_tool_execution.md
index c308cf5768..2278fe4300 100644
--- a/docs/_posts/2022-01-05-linux_doas_tool_execution.md
+++ b/docs/_posts/2022-01-05-linux_doas_tool_execution.md
@@ -59,8 +59,8 @@ This analytic is to detect the doas tool execution in linux host platform. This
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_doas_tool_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md b/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md
index b7a5e56af4..9e94096e36 100644
--- a/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md
+++ b/docs/_posts/2022-01-10-linux_possible_access_to_credential_files.md
@@ -57,8 +57,8 @@ This analytic is to detect a possible attempt to dump or access the content of /
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_possible_access_to_credential_files_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md b/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md
index a3d718e1cd..6dc0e8db7d 100644
--- a/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md
+++ b/docs/_posts/2022-01-10-linux_possible_access_to_sudoers_file.md
@@ -59,8 +59,8 @@ This analytic is to detect a possible access or modification of /etc/sudoers fil
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_possible_access_to_sudoers_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md b/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md
index 41b74f6697..09e84fb31e 100644
--- a/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md
+++ b/docs/_posts/2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md
@@ -57,8 +57,8 @@ This analytic is to look for suspicious process command-line that might be acces
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_possible_access_or_modification_of_sshd_config_file_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md b/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md
index 0f9d915cb7..2280d2334f 100644
--- a/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md
+++ b/docs/_posts/2022-01-11-linux_possible_ssh_key_file_creation.md
@@ -57,8 +57,8 @@ This analytic is to look for possible ssh key file creation on ~/.ssh/ folder. T
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_possible_ssh_key_file_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md
index 66943892c9..4238041cda 100644
--- a/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md
+++ b/docs/_posts/2022-01-12-windows_hunting_system_account_targeting_lsass.md
@@ -56,8 +56,8 @@ The following hunting analytic identifies all processes requesting access into L
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_hunting_system_account_targeting_lsass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md
index 4aa188380b..7573c5c7b3 100644
--- a/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md
+++ b/docs/_posts/2022-01-12-windows_non-system_account_targeting_lsass.md
@@ -56,8 +56,8 @@ The following analytic identifies non SYSTEM accounts requesting access to lsass
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_non-system_account_targeting_lsass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md b/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md
index a9db929c55..4fcea0718f 100644
--- a/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md
+++ b/docs/_posts/2022-01-14-potentially_malicious_code_on_commandline.md
@@ -58,9 +58,9 @@ The following analytic uses a pretrained machine learning text classifier to det
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [potentially_malicious_code_on_cmdline_tokenize_score](https://github.com/splunk/security_content/blob/develop/macros/potentially_malicious_code_on_cmdline_tokenize_score.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `potentially_malicious_code_on_commandline_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md
index d7185453b0..df4f23447b 100644
--- a/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md
+++ b/docs/_posts/2022-01-18-cmd_carry_out_string_command_parameter.md
@@ -58,9 +58,9 @@ The following analytic identifies command-line arguments where `cmd.exe /c` is u
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_cmd](https://github.com/splunk/security_content/blob/develop/macros/process_cmd.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `cmd_carry_out_string_command_parameter_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
@@ -84,6 +84,7 @@ To successfully implement this search you need to be ingesting information on pr
 False positives may be high based on legitimate scripted code in any environment. Filter as needed.
 
 #### Associated Analytic story
+* [Data Destruction](/stories/data_destruction)
 * [IcedID](/stories/icedid)
 * [Log4Shell CVE-2021-44228](/stories/log4shell_cve-2021-44228)
 * [WhisperGate](/stories/whispergate)
diff --git a/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md b/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md
index d1c5bac0e4..73eb640826 100644
--- a/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md
+++ b/docs/_posts/2022-01-18-impacket_lateral_movement_commandline_parameters.md
@@ -73,8 +73,8 @@ This analytic looks for the presence of suspicious commandline parameters typica
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `impacket_lateral_movement_commandline_parameters_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md
index a632288cc0..22ee013e23 100644
--- a/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md
+++ b/docs/_posts/2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md
@@ -56,8 +56,8 @@ This analytic detects a suspicious process making a DNS query via known, abused
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `suspicious_process_dns_query_known_abuse_web_services_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md b/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md
index 15514a149f..91a1350b8f 100644
--- a/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md
+++ b/docs/_posts/2022-01-19-suspicious_process_with_discord_dns_query.md
@@ -56,8 +56,8 @@ This analytic identifies a process making a DNS query to Discord, a well known i
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `suspicious_process_with_discord_dns_query_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md
index e8b0e3a9ab..020fdc26cb 100644
--- a/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md
+++ b/docs/_posts/2022-01-19-windows_dotnet_binary_in_non_standard_path.md
@@ -68,9 +68,9 @@ The following analytic identifies native .net binaries within the Windows operat
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [is_net_windows_file](https://github.com/splunk/security_content/blob/develop/macros/is_net_windows_file.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `windows_dotnet_binary_in_non_standard_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md
index ba08a69606..11738603cd 100644
--- a/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md
+++ b/docs/_posts/2022-01-19-windows_installutil_in_non_standard_path.md
@@ -67,9 +67,9 @@ The following analytic identifies the Windows binary InstallUtil.exe running fro
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `windows_installutil_in_non_standard_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md
index 7d39b30789..78e6aa9bbd 100644
--- a/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md
+++ b/docs/_posts/2022-01-20-excessive_file_deletion_in_windefender_folder.md
@@ -52,8 +52,8 @@ This analytic will identify excessive file deletion events in the Windows Defend
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `excessive_file_deletion_in_windefender_folder_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-01-20-ping_sleep_batch_command.md b/docs/_posts/2022-01-20-ping_sleep_batch_command.md
index 389940e407..8694ba347a 100644
--- a/docs/_posts/2022-01-20-ping_sleep_batch_command.md
+++ b/docs/_posts/2022-01-20-ping_sleep_batch_command.md
@@ -59,9 +59,9 @@ This analytic will identify the possible execution of ping sleep batch commands.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_ping](https://github.com/splunk/security_content/blob/develop/macros/process_ping.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `ping_sleep_batch_command_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md b/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md
index 94b3af79b8..a56359858e 100644
--- a/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md
+++ b/docs/_posts/2022-01-21-windows_nirsoft_advancedrun.md
@@ -52,8 +52,8 @@ The following analytic identifies the use of AdvancedRun.exe. AdvancedRun.exe ha
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_nirsoft_advancedrun_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md
index 6a4758ce32..cca52a8c8c 100644
--- a/docs/_posts/2022-01-24-windows_nirsoft_utilities.md
+++ b/docs/_posts/2022-01-24-windows_nirsoft_utilities.md
@@ -53,9 +53,9 @@ The following hunting analytic assists with identifying the proces execution of
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [is_nirsoft_software](https://github.com/splunk/security_content/blob/develop/macros/is_nirsoft_software.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_nirsoft_utilities_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md b/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md
index 10678fd5fa..10d6f22a3b 100644
--- a/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md
+++ b/docs/_posts/2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md
@@ -90,6 +90,7 @@ network admin may add/remove/modify public inbound firewall rule that may cause
 
 #### Associated Analytic story
 * [Prohibited Traffic Allowed or Protocol Mismatch](/stories/prohibited_traffic_allowed_or_protocol_mismatch)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md b/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md
index 6950ba1040..63e0095b91 100644
--- a/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md
+++ b/docs/_posts/2022-01-26-allow_operation_with_consent_admin.md
@@ -78,6 +78,7 @@ unknown
 
 #### Associated Analytic story
 * [Ransomware](/stories/ransomware)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-26-disable_amsi_through_registry.md b/docs/_posts/2022-01-26-disable_amsi_through_registry.md
index 67b7fd7cc9..dc5aa85b37 100644
--- a/docs/_posts/2022-01-26-disable_amsi_through_registry.md
+++ b/docs/_posts/2022-01-26-disable_amsi_through_registry.md
@@ -83,6 +83,7 @@ network operator may disable this feature of windows but not so common.
 
 #### Associated Analytic story
 * [Ransomware](/stories/ransomware)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md b/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md
index e64de17828..afcf0dd18e 100644
--- a/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md
+++ b/docs/_posts/2022-01-26-disable_defender_antivirus_registry.md
@@ -84,6 +84,7 @@ admin or user may choose to disable windows defender product
 
 #### Associated Analytic story
 * [IceID](/stories/iceid)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md b/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md
index 85c670fb1f..236dd647a6 100644
--- a/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md
+++ b/docs/_posts/2022-01-26-disable_defender_blockatfirstseen_feature.md
@@ -84,6 +84,7 @@ admin or user may choose to disable windows defender product
 
 #### Associated Analytic story
 * [IceID](/stories/iceid)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md b/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md
index bb510920a1..6f60420950 100644
--- a/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md
+++ b/docs/_posts/2022-01-26-disable_defender_enhanced_notification.md
@@ -84,6 +84,7 @@ user may choose to disable windows defender AV
 
 #### Associated Analytic story
 * [IceID](/stories/iceid)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md b/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md
index f40c4dd508..ff29d76e5f 100644
--- a/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md
+++ b/docs/_posts/2022-01-26-disable_defender_mpengine_registry.md
@@ -84,6 +84,7 @@ admin or user may choose to disable windows defender product
 
 #### Associated Analytic story
 * [IceID](/stories/iceid)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md b/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md
index bb795d1d01..9688a567d9 100644
--- a/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md
+++ b/docs/_posts/2022-01-26-disable_defender_spynet_reporting.md
@@ -84,6 +84,7 @@ admin or user may choose to disable windows defender product
 
 #### Associated Analytic story
 * [IceID](/stories/iceid)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md b/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md
index ee154c3d39..c843c2709a 100644
--- a/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md
+++ b/docs/_posts/2022-01-26-disable_defender_submit_samples_consent_feature.md
@@ -84,6 +84,7 @@ admin or user may choose to disable windows defender product
 
 #### Associated Analytic story
 * [IceID](/stories/iceid)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md b/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md
index 299ebcbad7..dda7d32860 100644
--- a/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md
+++ b/docs/_posts/2022-01-26-log4shell_cve-2021-44228_exploitation.md
@@ -64,8 +64,8 @@ This correlation find exploitation of Log4Shell CVE-2021-44228 against systems u
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `log4shell_cve-2021-44228_exploitation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md b/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md
index d00d29fab5..8dea353247 100644
--- a/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md
+++ b/docs/_posts/2022-01-26-registry_keys_used_for_persistence.md
@@ -92,6 +92,7 @@ There are many legitimate applications that must execute on system startup and w
 * [Emotet Malware  DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_)
 * [IcedID](/stories/icedid)
 * [Remcos](/stories/remcos)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md b/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md
index ba3ef8475c..3aaec0a78f 100644
--- a/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md
+++ b/docs/_posts/2022-01-26-registry_keys_used_for_privilege_escalation.md
@@ -85,6 +85,7 @@ There are many legitimate applications that must execute upon system startup and
 * [Windows Privilege Escalation](/stories/windows_privilege_escalation)
 * [Suspicious Windows Registry Activities](/stories/suspicious_windows_registry_activities)
 * [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md b/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md
index 4a8d905c1e..604df9a08c 100644
--- a/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md
+++ b/docs/_posts/2022-01-26-remcos_client_registry_install_entry.md
@@ -78,6 +78,7 @@ unknown
 
 #### Associated Analytic story
 * [Remcos](/stories/remcos)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
@@ -105,6 +106,7 @@ Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://githu
 Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
 
 
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_registry/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_registry/sysmon.log)
 * [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_panel_client/remcos_registry_entry.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/remcos/remcos_panel_client/remcos_registry_entry.log)
 
 
diff --git a/docs/_posts/2022-01-26-time_provider_persistence_registry.md b/docs/_posts/2022-01-26-time_provider_persistence_registry.md
index b1d9955f2a..c215f1c3b2 100644
--- a/docs/_posts/2022-01-26-time_provider_persistence_registry.md
+++ b/docs/_posts/2022-01-26-time_provider_persistence_registry.md
@@ -86,6 +86,7 @@ unknown
 #### Associated Analytic story
 * [Windows Persistence Techniques](/stories/windows_persistence_techniques)
 * [Windows Privilege Escalation](/stories/windows_privilege_escalation)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-27-disable_etw_through_registry.md b/docs/_posts/2022-01-27-disable_etw_through_registry.md
index c9b0820605..4b60d254b8 100644
--- a/docs/_posts/2022-01-27-disable_etw_through_registry.md
+++ b/docs/_posts/2022-01-27-disable_etw_through_registry.md
@@ -83,6 +83,7 @@ network operator may disable this feature of windows but not so common.
 
 #### Associated Analytic story
 * [Ransomware](/stories/ransomware)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-27-disable_registry_tool.md b/docs/_posts/2022-01-27-disable_registry_tool.md
index 8369371edc..3917533bc4 100644
--- a/docs/_posts/2022-01-27-disable_registry_tool.md
+++ b/docs/_posts/2022-01-27-disable_registry_tool.md
@@ -83,6 +83,7 @@ admin may disable this application for non technical user.
 
 #### Associated Analytic story
 * [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md b/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md
index 5a9ff41c88..be1ad9a5e9 100644
--- a/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md
+++ b/docs/_posts/2022-01-27-disable_security_logs_using_minint_registry.md
@@ -79,6 +79,7 @@ Unknown.
 
 #### Associated Analytic story
 * [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-27-disable_show_hidden_files.md b/docs/_posts/2022-01-27-disable_show_hidden_files.md
index fa79066bdd..41eb7f6efd 100644
--- a/docs/_posts/2022-01-27-disable_show_hidden_files.md
+++ b/docs/_posts/2022-01-27-disable_show_hidden_files.md
@@ -93,6 +93,7 @@ unknown
 
 #### Associated Analytic story
 * [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-27-disable_uac_remote_restriction.md b/docs/_posts/2022-01-27-disable_uac_remote_restriction.md
index 01d4809a05..08e2775be8 100644
--- a/docs/_posts/2022-01-27-disable_uac_remote_restriction.md
+++ b/docs/_posts/2022-01-27-disable_uac_remote_restriction.md
@@ -1,6 +1,6 @@
 ---
 title: "Disable UAC Remote Restriction"
-excerpt: "Bypass User Account Control
+excerpt: "Bypass User Access Control
 , Abuse Elevation Control Mechanism
 "
 categories:
@@ -9,7 +9,7 @@ last_modified_at: 2022-01-27
 toc: true
 toc_label: ""
 tags:
-  - Bypass User Account Control
+  - Bypass User Access Control
   - Abuse Elevation Control Mechanism
   - Defense Evasion
   - Privilege Escalation
@@ -42,7 +42,7 @@ This analytic is to detect a suspicious modification of registry to disable UAC
 
 | ID             | Technique        |  Tactic             |
 | -------------- | ---------------- |-------------------- |
-| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Defense Evasion, Privilege Escalation |
+| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Access Control | Defense Evasion, Privilege Escalation |
 
 | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
 
@@ -87,6 +87,7 @@ admin may set this policy for non-critical machine.
 #### Associated Analytic story
 * [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
 * [Suspicious Windows Registry Activities](/stories/suspicious_windows_registry_activities)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md b/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md
index 559d78c74a..db691b1f51 100644
--- a/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md
+++ b/docs/_posts/2022-01-27-disable_windows_app_hotkeys.md
@@ -82,6 +82,7 @@ unknown
 
 #### Associated Analytic story
 * [XMRig](/stories/xmrig)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md b/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md
index d438343514..d2430c1da0 100644
--- a/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md
+++ b/docs/_posts/2022-01-27-disable_windows_behavior_monitoring.md
@@ -85,6 +85,7 @@ admin or user may choose to disable this windows features.
 * [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
 * [Ransomware](/stories/ransomware)
 * [Revil Ransomware](/stories/revil_ransomware)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md b/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md
index 70809a2174..bf979f92f9 100644
--- a/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md
+++ b/docs/_posts/2022-01-27-disable_windows_smartscreen_protection.md
@@ -83,6 +83,7 @@ admin or user may choose to disable this windows features.
 
 #### Associated Analytic story
 * [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-27-disabling_cmd_application.md b/docs/_posts/2022-01-27-disabling_cmd_application.md
index 22d321eb00..e5777fb657 100644
--- a/docs/_posts/2022-01-27-disabling_cmd_application.md
+++ b/docs/_posts/2022-01-27-disabling_cmd_application.md
@@ -83,6 +83,7 @@ admin may disable this application for non technical user.
 
 #### Associated Analytic story
 * [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-27-disabling_controlpanel.md b/docs/_posts/2022-01-27-disabling_controlpanel.md
index b6ac48c0bd..54af15c294 100644
--- a/docs/_posts/2022-01-27-disabling_controlpanel.md
+++ b/docs/_posts/2022-01-27-disabling_controlpanel.md
@@ -83,6 +83,7 @@ admin may disable this application for non technical user.
 
 #### Associated Analytic story
 * [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md
index a828ae2d4b..c4d2949beb 100644
--- a/docs/_posts/2022-01-27-windows_possible_credential_dumping.md
+++ b/docs/_posts/2022-01-27-windows_possible_credential_dumping.md
@@ -60,8 +60,8 @@ The idea behind using ntdll.dll is to blend in by using native api of ntdll.dll.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_possible_credential_dumping_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-01-28-disabling_defender_services.md b/docs/_posts/2022-01-28-disabling_defender_services.md
index 4fefc165ea..3255a54b4a 100644
--- a/docs/_posts/2022-01-28-disabling_defender_services.md
+++ b/docs/_posts/2022-01-28-disabling_defender_services.md
@@ -84,6 +84,7 @@ admin or user may choose to disable windows defender product
 
 #### Associated Analytic story
 * [IceID](/stories/iceid)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md b/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md
index 7726b1545f..c5810de55a 100644
--- a/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md
+++ b/docs/_posts/2022-01-28-disabling_folderoptions_windows_feature.md
@@ -83,6 +83,7 @@ admin may disable this application for non technical user.
 
 #### Associated Analytic story
 * [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-28-disabling_norun_windows_app.md b/docs/_posts/2022-01-28-disabling_norun_windows_app.md
index 2f96520962..46ff94afef 100644
--- a/docs/_posts/2022-01-28-disabling_norun_windows_app.md
+++ b/docs/_posts/2022-01-28-disabling_norun_windows_app.md
@@ -83,6 +83,7 @@ admin may disable this application for non technical user.
 
 #### Associated Analytic story
 * [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md b/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md
index c9cefbf23b..8a0aca455b 100644
--- a/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md
+++ b/docs/_posts/2022-01-28-disabling_systemrestore_in_registry.md
@@ -1,7 +1,6 @@
 ---
 title: "Disabling SystemRestore In Registry"
-excerpt: "Disable or Modify Tools
-, Impair Defenses
+excerpt: "Inhibit System Recovery
 "
 categories:
   - Endpoint
@@ -9,10 +8,8 @@ last_modified_at: 2022-01-28
 toc: true
 toc_label: ""
 tags:
-  - Disable or Modify Tools
-  - Impair Defenses
-  - Defense Evasion
-  - Defense Evasion
+  - Inhibit System Recovery
+  - Impact
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
@@ -40,9 +37,7 @@ The following search identifies the modification of registry related in disablin
 
 | ID             | Technique        |  Tactic             |
 | -------------- | ---------------- |-------------------- |
-| [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion |
-
-| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+| [T1490](https://attack.mitre.org/techniques/T1490/) | Inhibit System Recovery | Impact |
 
 #### Search
 
@@ -83,6 +78,7 @@ in some cases admin can disable systemrestore on a machine.
 
 #### Associated Analytic story
 * [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-28-disabling_task_manager.md b/docs/_posts/2022-01-28-disabling_task_manager.md
index a7afa59992..6eb3572a71 100644
--- a/docs/_posts/2022-01-28-disabling_task_manager.md
+++ b/docs/_posts/2022-01-28-disabling_task_manager.md
@@ -83,6 +83,7 @@ admin may disable this application for non technical user.
 
 #### Associated Analytic story
 * [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md b/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md
index 0ca256659c..b2d5dc69ef 100644
--- a/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md
+++ b/docs/_posts/2022-01-28-enable_rdp_in_other_port_number.md
@@ -77,6 +77,7 @@ unknown
 
 #### Associated Analytic story
 * [Prohibited Traffic Allowed or Protocol Mismatch](/stories/prohibited_traffic_allowed_or_protocol_mismatch)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md b/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md
index 18b300eb77..1dc1ddd812 100644
--- a/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md
+++ b/docs/_posts/2022-01-28-enable_wdigest_uselogoncredential_registry.md
@@ -84,6 +84,7 @@ unknown
 
 #### Associated Analytic story
 * [Credential Dumping](/stories/credential_dumping)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-28-etw_registry_disabled.md b/docs/_posts/2022-01-28-etw_registry_disabled.md
index 9a4777a72c..ebb018a996 100644
--- a/docs/_posts/2022-01-28-etw_registry_disabled.md
+++ b/docs/_posts/2022-01-28-etw_registry_disabled.md
@@ -90,6 +90,7 @@ unknown
 #### Associated Analytic story
 * [Windows Persistence Techniques](/stories/windows_persistence_techniques)
 * [Windows Privilege Escalation](/stories/windows_privilege_escalation)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-28-eventvwr_uac_bypass.md b/docs/_posts/2022-01-28-eventvwr_uac_bypass.md
index 4fee0102ba..aecbc39419 100644
--- a/docs/_posts/2022-01-28-eventvwr_uac_bypass.md
+++ b/docs/_posts/2022-01-28-eventvwr_uac_bypass.md
@@ -1,6 +1,6 @@
 ---
 title: "Eventvwr UAC Bypass"
-excerpt: "Bypass User Account Control
+excerpt: "Bypass User Access Control
 , Abuse Elevation Control Mechanism
 "
 categories:
@@ -9,7 +9,7 @@ last_modified_at: 2022-01-28
 toc: true
 toc_label: ""
 tags:
-  - Bypass User Account Control
+  - Bypass User Access Control
   - Abuse Elevation Control Mechanism
   - Defense Evasion
   - Privilege Escalation
@@ -42,7 +42,7 @@ The following search identifies Eventvwr bypass by identifying the registry modi
 
 | ID             | Technique        |  Tactic             |
 | -------------- | ---------------- |-------------------- |
-| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Defense Evasion, Privilege Escalation |
+| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Access Control | Defense Evasion, Privilege Escalation |
 
 | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
 
@@ -87,6 +87,7 @@ Some false positives may be present and will need to be filtered.
 * [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
 * [IcedID](/stories/icedid)
 * [Living Off The Land](/stories/living_off_the_land)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md b/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md
index 39034e92ca..5a27d0ed23 100644
--- a/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md
+++ b/docs/_posts/2022-01-28-hide_user_account_from_sign-in_screen.md
@@ -82,6 +82,7 @@ Unknown. Filter as needed.
 
 #### Associated Analytic story
 * [XMRig](/stories/xmrig)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md b/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md
index c8195a363c..74e8659dd7 100644
--- a/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md
+++ b/docs/_posts/2022-01-28-linux_pkexec_privilege_escalation.md
@@ -54,8 +54,8 @@ The following analytic identifies `pkexec` spawning with no command-line argumen
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_pkexec_privilege_escalation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md b/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md
index 4b2506f5c8..57966ff0f2 100644
--- a/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md
+++ b/docs/_posts/2022-02-01-mimikatz_passtheticket_commandline_parameters.md
@@ -59,8 +59,8 @@ The following analytic looks for the use of Mimikatz command line parameters lev
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `mimikatz_passtheticket_commandline_parameters_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-01-rubeus_command_line_parameters.md b/docs/_posts/2022-02-01-rubeus_command_line_parameters.md
index 0a6dfe12bb..30bc73f391 100644
--- a/docs/_posts/2022-02-01-rubeus_command_line_parameters.md
+++ b/docs/_posts/2022-02-01-rubeus_command_line_parameters.md
@@ -74,8 +74,8 @@ Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily ad
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `rubeus_command_line_parameters_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-01-suspicious_rundll32_rename.md b/docs/_posts/2022-02-01-suspicious_rundll32_rename.md
index ce5dced718..178af8f1c0 100644
--- a/docs/_posts/2022-02-01-suspicious_rundll32_rename.md
+++ b/docs/_posts/2022-02-01-suspicious_rundll32_rename.md
@@ -67,9 +67,9 @@ The following hunting analytic identifies renamed instances of rundll32.exe exec
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 
 Note that `suspicious_rundll32_rename_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md
index 9716d7cc7f..1d939b900c 100644
--- a/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md
+++ b/docs/_posts/2022-02-03-certutil_download_with_urlcache_and_split_arguments.md
@@ -52,9 +52,9 @@ Certutil.exe may download a file from a remote destination using `-urlcache`. Th
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `certutil_download_with_urlcache_and_split_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md
index e566e86602..b226cf5e62 100644
--- a/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md
+++ b/docs/_posts/2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md
@@ -52,9 +52,9 @@ Certutil.exe may download a file from a remote destination using `-VerifyCtl`. T
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_certutil](https://github.com/splunk/security_content/blob/develop/macros/process_certutil.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `certutil_download_with_verifyctl_and_split_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-03-o365_disable_mfa.md b/docs/_posts/2022-02-03-o365_disable_mfa.md
index a24615fc8b..e5a25aa278 100644
--- a/docs/_posts/2022-02-03-o365_disable_mfa.md
+++ b/docs/_posts/2022-02-03-o365_disable_mfa.md
@@ -11,7 +11,6 @@ tags:
   - Modify Authentication Process
   - Credential Access
   - Defense Evasion
-  - Persistence
   - Splunk Enterprise
   - Splunk Enterprise Security
   - Splunk Cloud
@@ -38,7 +37,7 @@ This search detects when multi factor authentication has been disabled, what ent
 
 | ID             | Technique        |  Tactic             |
 | -------------- | ---------------- |-------------------- |
-| [T1556](https://attack.mitre.org/techniques/T1556/) | Modify Authentication Process | Credential Access, Defense Evasion, Persistence |
+| [T1556](https://attack.mitre.org/techniques/T1556/) | Modify Authentication Process | Credential Access, Defense Evasion |
 
 #### Search
 
diff --git a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md
index 2fa220e7d6..68b7fb00c8 100644
--- a/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md
+++ b/docs/_posts/2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md
@@ -58,8 +58,8 @@ The following analytic looks for a process accessing the winlogon.exe system pro
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `rubeus_kerberos_ticket_exports_through_winlogon_access_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md
index 41667fc862..bdfbb3f291 100644
--- a/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md
+++ b/docs/_posts/2022-02-07-windows_remote_assistance_spawning_process.md
@@ -53,9 +53,9 @@ The following analytic identifies the use of Microsoft Remote Assistance, msra.e
 
 #### Macros
 The SPL above uses the following Macros:
-* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [windows_shells](https://github.com/splunk/security_content/blob/develop/macros/windows_shells.yml)
 
 Note that `windows_remote_assistance_spawning_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md
index 51a9fffab9..3bf4262d31 100644
--- a/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md
+++ b/docs/_posts/2022-02-07-windows_schtasks_create_run_as_system.md
@@ -61,9 +61,9 @@ The following analytic identifies Schtasks.exe creating a new task to start and
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_schtasks](https://github.com/splunk/security_content/blob/develop/macros/process_schtasks.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `windows_schtasks_create_run_as_system_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md
index b34493f640..dc59cbaf8b 100644
--- a/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md
+++ b/docs/_posts/2022-02-08-rundll_loading_dll_by_ordinal.md
@@ -58,9 +58,9 @@ The following analytic identifies rundll32.exe loading an export function by ord
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 
 Note that `rundll_loading_dll_by_ordinal_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-14-linux_dd_file_overwrite.md b/docs/_posts/2022-02-14-linux_dd_file_overwrite.md
index eb1df7da2c..2edd194353 100644
--- a/docs/_posts/2022-02-14-linux_dd_file_overwrite.md
+++ b/docs/_posts/2022-02-14-linux_dd_file_overwrite.md
@@ -52,8 +52,8 @@ This analytic is to look for dd command to overwrite file. This technique was ab
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `linux_dd_file_overwrite_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md b/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md
index 201c662eb3..234edd25ae 100644
--- a/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md
+++ b/docs/_posts/2022-02-15-windows_diskshadow_proxy_execution.md
@@ -52,9 +52,9 @@ DiskShadow.exe is a Microsoft Signed binary present on Windows Server. It has a
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_diskshadow](https://github.com/splunk/security_content/blob/develop/macros/process_diskshadow.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `windows_diskshadow_proxy_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md b/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md
index 9e294d6006..bcc602b462 100644
--- a/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md
+++ b/docs/_posts/2022-02-15-windows_rasautou_dll_execution.md
@@ -64,8 +64,8 @@ The following analytic identifies the Windows Windows Remote Auto Dialer, rasaut
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_rasautou_dll_execution_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-17-windows_disable_notification_center.md b/docs/_posts/2022-02-17-windows_disable_notification_center.md
index c4424a81a2..3cd6939ef9 100644
--- a/docs/_posts/2022-02-17-windows_disable_notification_center.md
+++ b/docs/_posts/2022-02-17-windows_disable_notification_center.md
@@ -78,6 +78,7 @@ admin or user may choose to disable this windows features.
 
 #### Associated Analytic story
 * [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md
index 402941e829..3822d32b1c 100644
--- a/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md
+++ b/docs/_posts/2022-02-17-windows_raw_access_to_master_boot_record_drive.md
@@ -56,8 +56,8 @@ This analytic is to look for suspicious raw access read to drive where the maste
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_raw_access_to_master_boot_record_drive_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
@@ -79,6 +79,8 @@ To successfully implement this search, you need to be ingesting logs with the ra
 This event is really notable but we found minimal number of normal application from system32 folder like svchost.exe accessing it too. In this case we used 'system32' and 'syswow64' path as a filter for this detection.
 
 #### Associated Analytic story
+* [Data Destruction](/stories/data_destruction)
+* [Caddy Wiper](/stories/caddy_wiper)
 * [WhisperGate](/stories/whispergate)
 * [Hermetic Wiper](/stories/hermetic_wiper)
 
diff --git a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md
index efc3b81d21..c267c26069 100644
--- a/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md
+++ b/docs/_posts/2022-02-18-detect_regasm_with_network_connection.md
@@ -56,8 +56,8 @@ The following analytic identifies regasm.exe with a network connection to a publ
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_regasm_with_network_connection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md
index 234043c6e9..93657c118e 100644
--- a/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md
+++ b/docs/_posts/2022-02-18-detect_regsvcs_with_network_connection.md
@@ -56,8 +56,8 @@ The following analytic identifies Regsvcs.exe with a network connection to a pub
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `detect_regsvcs_with_network_connection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-18-net_profiler_uac_bypass.md b/docs/_posts/2022-02-18-net_profiler_uac_bypass.md
index 0a8285eb74..1e84587c5a 100644
--- a/docs/_posts/2022-02-18-net_profiler_uac_bypass.md
+++ b/docs/_posts/2022-02-18-net_profiler_uac_bypass.md
@@ -1,6 +1,6 @@
 ---
 title: "NET Profiler UAC bypass"
-excerpt: "Bypass User Account Control
+excerpt: "Bypass User Access Control
 , Abuse Elevation Control Mechanism
 "
 categories:
@@ -9,7 +9,7 @@ last_modified_at: 2022-02-18
 toc: true
 toc_label: ""
 tags:
-  - Bypass User Account Control
+  - Bypass User Access Control
   - Abuse Elevation Control Mechanism
   - Defense Evasion
   - Privilege Escalation
@@ -42,7 +42,7 @@ This search is to detect modification of registry to bypass UAC windows feature.
 
 | ID             | Technique        |  Tactic             |
 | -------------- | ---------------- |-------------------- |
-| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Account Control | Defense Evasion, Privilege Escalation |
+| [T1548.002](https://attack.mitre.org/techniques/T1548/002/) | Bypass User Access Control | Defense Evasion, Privilege Escalation |
 
 | [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
 
@@ -59,8 +59,8 @@ This search is to detect modification of registry to bypass UAC windows feature.
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `net_profiler_uac_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md
index eaa34437da..5aa50f657e 100644
--- a/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md
+++ b/docs/_posts/2022-02-18-process_deleting_its_process_file_path.md
@@ -53,8 +53,8 @@ This detection is to identify a suspicious process that tries to delete the proc
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `process_deleting_its_process_file_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-18-rundll32_dnsquery.md b/docs/_posts/2022-02-18-rundll32_dnsquery.md
index 9588759a9b..1e5e974fa6 100644
--- a/docs/_posts/2022-02-18-rundll32_dnsquery.md
+++ b/docs/_posts/2022-02-18-rundll32_dnsquery.md
@@ -56,8 +56,8 @@ This search is to detect a suspicious rundll32.exe process having a http connect
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `rundll32_dnsquery_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md b/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md
index ec47142761..5bb5750524 100644
--- a/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md
+++ b/docs/_posts/2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md
@@ -57,8 +57,8 @@ Monitor for changes of the ExecutionPolicy in the registry to the values "unrest
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md b/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md
index be6cfab2f8..313f7c8dec 100644
--- a/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md
+++ b/docs/_posts/2022-02-22-scheduled_task_deleted_or_created_via_cmd.md
@@ -61,8 +61,8 @@ The following analytic identifies the creation or deletion of a scheduled task u
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `scheduled_task_deleted_or_created_via_cmd_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md
index 52e0318430..21ae87deae 100644
--- a/docs/_posts/2022-02-22-windows_wmi_process_call_create.md
+++ b/docs/_posts/2022-02-22-windows_wmi_process_call_create.md
@@ -52,9 +52,9 @@ This analytic is to look for wmi commandlines to execute or create process. This
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_wmi_process_call_create_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-23-windows_event_for_service_disabled.md b/docs/_posts/2022-02-23-windows_event_for_service_disabled.md
index a3859a0ae9..05472c221d 100644
--- a/docs/_posts/2022-02-23-windows_event_for_service_disabled.md
+++ b/docs/_posts/2022-02-23-windows_event_for_service_disabled.md
@@ -56,8 +56,8 @@ This analytic will identify suspicious system event of services that was modifie
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_event_for_service_disabled_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md b/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md
index 49520c4703..52bb025337 100644
--- a/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md
+++ b/docs/_posts/2022-02-23-windows_excessive_disabled_services_event.md
@@ -57,8 +57,8 @@ This analytic will identify suspicious excessive number of system events of serv
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [wineventlog_system](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_system.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_excessive_disabled_services_event_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md b/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md
index 753121473e..2fccb64af9 100644
--- a/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md
+++ b/docs/_posts/2022-02-23-windows_process_with_namedpipe_commandline.md
@@ -53,8 +53,8 @@ This analytic is to look for process commandline that contains named pipe. This
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_process_with_namedpipe_commandline_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-23-windows_service_creation_using_registry_entry.md b/docs/_posts/2022-02-23-windows_service_creation_using_registry_entry.md
index eac8fe2305..ac3847c0b3 100644
--- a/docs/_posts/2022-02-23-windows_service_creation_using_registry_entry.md
+++ b/docs/_posts/2022-02-23-windows_service_creation_using_registry_entry.md
@@ -89,6 +89,7 @@ Third party tools may used this technique to create services but not so common.
 * [Active Directory Lateral Movement](/stories/active_directory_lateral_movement)
 * [Suspicious Windows Registry Activities](/stories/suspicious_windows_registry_activities)
 * [Windows Persistence Techniques](/stories/windows_persistence_techniques)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-02-25-windows_disable_memory_crash_dump.md b/docs/_posts/2022-02-25-windows_disable_memory_crash_dump.md
index 6a99a51280..807c35dba5 100644
--- a/docs/_posts/2022-02-25-windows_disable_memory_crash_dump.md
+++ b/docs/_posts/2022-02-25-windows_disable_memory_crash_dump.md
@@ -86,6 +86,7 @@ unknown
 * [Data Destruction](/stories/data_destruction)
 * [Ransomware](/stories/ransomware)
 * [Hermetic Wiper](/stories/hermetic_wiper)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md b/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md
index f376ed2933..4f3362e174 100644
--- a/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md
+++ b/docs/_posts/2022-02-25-windows_file_without_extension_in_critical_folder.md
@@ -58,8 +58,8 @@ This analytic is to look for suspicious file creation in the critical folder lik
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_file_without_extension_in_critical_folder_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md
index d80b250b3e..33802684a3 100644
--- a/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md
+++ b/docs/_posts/2022-02-25-windows_raw_access_to_disk_volume_partition.md
@@ -56,8 +56,8 @@ This analytic is to look for suspicious raw access read to device disk partition
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `windows_raw_access_to_disk_volume_partition_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
@@ -79,6 +79,7 @@ To successfully implement this search, you need to be ingesting logs with the ra
 This event is really notable but we found minimal number of normal application from system32 folder like svchost.exe accessing it too. In this case we used 'system32' and 'syswow64' path as a filter for this detection.
 
 #### Associated Analytic story
+* [Caddy Wiper](/stories/caddy_wiper)
 * [Data Destruction](/stories/data_destruction)
 * [Hermetic Wiper](/stories/hermetic_wiper)
 
diff --git a/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md b/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md
index 2ab840a0d8..4d7f888393 100644
--- a/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md
+++ b/docs/_posts/2022-02-28-excessive_distinct_processes_from_windows_temp.md
@@ -53,8 +53,8 @@ This analytic will identify suspicious series of process executions.  We have ob
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `excessive_distinct_processes_from_windows_temp_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-03-02-windows_modify_show_compress_color_and_info_tip_registry.md b/docs/_posts/2022-03-02-windows_modify_show_compress_color_and_info_tip_registry.md
index cb0913661a..81d2f94a08 100644
--- a/docs/_posts/2022-03-02-windows_modify_show_compress_color_and_info_tip_registry.md
+++ b/docs/_posts/2022-03-02-windows_modify_show_compress_color_and_info_tip_registry.md
@@ -76,8 +76,10 @@ To successfully implement this search you need to be ingesting information on pr
 unknown
 
 #### Associated Analytic story
+* [Data Destruction](/stories/data_destruction)
 * [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
 * [Hermetic Wiper](/stories/hermetic_wiper)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-03-08-suspicious_msbuild_path.md b/docs/_posts/2022-03-08-suspicious_msbuild_path.md
new file mode 100644
index 0000000000..48f5300621
--- /dev/null
+++ b/docs/_posts/2022-03-08-suspicious_msbuild_path.md
@@ -0,0 +1,134 @@
+---
+title: "Suspicious msbuild path"
+excerpt: "Masquerading
+, Trusted Developer Utilities Proxy Execution
+, Rename System Utilities
+, MSBuild
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-03-08
+toc: true
+toc_label: ""
+tags:
+  - Masquerading
+  - Trusted Developer Utilities Proxy Execution
+  - Rename System Utilities
+  - MSBuild
+  - Defense Evasion
+  - Defense Evasion
+  - Defense Evasion
+  - Defense Evasion
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+The following analytic identifies msbuild.exe executing from a non-standard path. Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and C:\Windows\Microsoft.NET\Framework64\v4.0.30319. Instances of Visual Studio will run a copy of msbuild.exe. A moved instance of MSBuild is suspicious, however there are instances of build applications that will move or use a copy of MSBuild.
+
+- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Last Updated**: 2022-03-08
+- **Author**: Michael Haag, Splunk
+- **ID**: f5198224-551c-11eb-ae93-0242ac130002
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1036](https://attack.mitre.org/techniques/T1036/) | Masquerading | Defense Evasion |
+
+| [T1127](https://attack.mitre.org/techniques/T1127/) | Trusted Developer Utilities Proxy Execution | Defense Evasion |
+
+| [T1036.003](https://attack.mitre.org/techniques/T1036/003/) | Rename System Utilities | Defense Evasion |
+
+| [T1127.001](https://attack.mitre.org/techniques/T1127/001/) | MSBuild | Defense Evasion |
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_msbuild` AND (Processes.process_path!=*\\framework*\\v*\\*) by Processes.dest Processes.original_file_name Processes.parent_process Processes.user 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)`
+| `suspicious_msbuild_path_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_msbuild](https://github.com/splunk/security_content/blob/develop/macros/process_msbuild.yml)
+
+Note that `suspicious_msbuild_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.dest
+* Processes.user
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.original_file_name
+* Processes.process_name
+* Processes.process
+* Processes.process_id
+* Processes.parent_process_path
+* Processes.process_path
+* Processes.parent_process_id
+
+
+#### How To Implement
+To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
+
+#### Known False Positives
+Some legitimate applications may use a moved copy of msbuild.exe, triggering a false positive. Baselining of MSBuild.exe usage is recommended to better understand it's path usage. Visual Studio runs an instance out of a path that will need to be filtered on.
+
+#### Associated Analytic story
+* [Trusted Developer Utilities Proxy Execution MSBuild](/stories/trusted_developer_utilities_proxy_execution_msbuild)
+* [Cobalt Strike](/stories/cobalt_strike)
+* [Masquerading - Rename System Utilities](/stories/masquerading_-_rename_system_utilities)
+* [Living Off The Land](/stories/living_off_the_land)
+
+
+#### Kill Chain Phase
+* Exploitation
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 49.0 | 70 | 70 | Msbuild.exe ran from an uncommon path on $dest$ execyted by $user$ |
+
+
+
+
+#### Reference
+
+* [https://lolbas-project.github.io/lolbas/Binaries/Msbuild/](https://lolbas-project.github.io/lolbas/Binaries/Msbuild/)
+* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1127.001/T1127.001.md)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1127.001/windows-sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/suspicious_msbuild_path.yml) \| *version*: **3**
\ No newline at end of file
diff --git a/docs/_posts/2022-03-08-windows_disable_change_password_through_registry.md b/docs/_posts/2022-03-08-windows_disable_change_password_through_registry.md
index 2bdcc2c6df..f452b05736 100644
--- a/docs/_posts/2022-03-08-windows_disable_change_password_through_registry.md
+++ b/docs/_posts/2022-03-08-windows_disable_change_password_through_registry.md
@@ -66,7 +66,8 @@ Note that `windows_disable_change_password_through_registry_filter` is a empty m
 * Registry.registry_key_name
 * Registry.registry_path
 * Registry.registry_value_name
-* Registry.dest Registry.user
+* Registry.dest
+* Registry.user
 * Processes.process_id
 * Processes.process_name
 * Processes.process
diff --git a/docs/_posts/2022-03-08-windows_disable_lock_workstation_feature_through_registry.md b/docs/_posts/2022-03-08-windows_disable_lock_workstation_feature_through_registry.md
index 3f7ae776a3..9c7b8ffda9 100644
--- a/docs/_posts/2022-03-08-windows_disable_lock_workstation_feature_through_registry.md
+++ b/docs/_posts/2022-03-08-windows_disable_lock_workstation_feature_through_registry.md
@@ -85,6 +85,7 @@ unknown
 #### Associated Analytic story
 * [Ransomware](/stories/ransomware)
 * [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-03-08-windows_disable_logoff_button_through_registry.md b/docs/_posts/2022-03-08-windows_disable_logoff_button_through_registry.md
index e9bcc91a9b..2c9e6ab677 100644
--- a/docs/_posts/2022-03-08-windows_disable_logoff_button_through_registry.md
+++ b/docs/_posts/2022-03-08-windows_disable_logoff_button_through_registry.md
@@ -84,6 +84,7 @@ This windows feature may implement by administrator in some server where shutdow
 
 #### Associated Analytic story
 * [Ransomware](/stories/ransomware)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-03-08-windows_disable_shutdown_button_through_registry.md b/docs/_posts/2022-03-08-windows_disable_shutdown_button_through_registry.md
index 03cf886687..abbf435529 100644
--- a/docs/_posts/2022-03-08-windows_disable_shutdown_button_through_registry.md
+++ b/docs/_posts/2022-03-08-windows_disable_shutdown_button_through_registry.md
@@ -84,6 +84,7 @@ This windows feature may implement by administrator in some server where shutdow
 
 #### Associated Analytic story
 * [Ransomware](/stories/ransomware)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-03-08-windows_disable_windows_group_policy_features_through_registry.md b/docs/_posts/2022-03-08-windows_disable_windows_group_policy_features_through_registry.md
index 684deccbde..83a428e3fe 100644
--- a/docs/_posts/2022-03-08-windows_disable_windows_group_policy_features_through_registry.md
+++ b/docs/_posts/2022-03-08-windows_disable_windows_group_policy_features_through_registry.md
@@ -85,6 +85,7 @@ unknown
 #### Associated Analytic story
 * [Ransomware](/stories/ransomware)
 * [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-03-08-windows_hide_notification_features_through_registry.md b/docs/_posts/2022-03-08-windows_hide_notification_features_through_registry.md
index 61663944b6..420e91eefe 100644
--- a/docs/_posts/2022-03-08-windows_hide_notification_features_through_registry.md
+++ b/docs/_posts/2022-03-08-windows_hide_notification_features_through_registry.md
@@ -85,6 +85,7 @@ unknown
 #### Associated Analytic story
 * [Ransomware](/stories/ransomware)
 * [Windows Defense Evasion Tactics](/stories/windows_defense_evasion_tactics)
+* [Windows Registry Abuse](/stories/windows_registry_abuse)
 
 
 #### Kill Chain Phase
diff --git a/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md
index 02c48e6638..52471ebfef 100644
--- a/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md
+++ b/docs/_posts/2022-03-15-detect_regasm_with_no_command_line_arguments.md
@@ -58,9 +58,9 @@ The following analytic identifies regasm.exe with no command line arguments. Thi
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_regasm](https://github.com/splunk/security_content/blob/develop/macros/process_regasm.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_regasm](https://github.com/splunk/security_content/blob/develop/macros/process_regasm.yml)
 
 Note that `detect_regasm_with_no_command_line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md
index 02eb1f0c6b..800602ac18 100644
--- a/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md
+++ b/docs/_posts/2022-03-15-detect_regsvcs_with_no_command_line_arguments.md
@@ -58,9 +58,9 @@ The following analytic identifies regsvcs.exe with no command line arguments. Th
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_regsvcs](https://github.com/splunk/security_content/blob/develop/macros/process_regsvcs.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [process_regsvcs](https://github.com/splunk/security_content/blob/develop/macros/process_regsvcs.yml)
 
 Note that `detect_regsvcs_with_no_command_line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md
index 5e406c1dad..70a78ad6a7 100644
--- a/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md
+++ b/docs/_posts/2022-03-15-dllhost_with_no_command_line_arguments_with_network.md
@@ -59,8 +59,8 @@ The following analytic identifies DLLHost.exe with no command line arguments wit
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `dllhost_with_no_command_line_arguments_with_network_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md
index b7638adbb9..29484ff9b1 100644
--- a/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md
+++ b/docs/_posts/2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md
@@ -59,8 +59,8 @@ The following analytic identifies gpupdate.exe with no command line arguments an
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `gpupdate_with_no_command_line_arguments_with_network_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md
index 3f71393d79..adebfdec57 100644
--- a/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md
+++ b/docs/_posts/2022-03-15-rundll32_with_no_command_line_arguments_with_network.md
@@ -64,9 +64,9 @@ The following analytic identifies rundll32.exe with no command line arguments an
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 
 Note that `rundll32_with_no_command_line_arguments_with_network_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md b/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md
index 3fdcedd431..5e89979eb4 100644
--- a/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md
+++ b/docs/_posts/2022-03-15-searchprotocolhost_with_no_command_line_with_network.md
@@ -59,8 +59,8 @@ The following analytic identifies searchprotocolhost.exe with no command line ar
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `searchprotocolhost_with_no_command_line_with_network_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md
index 47b4339f68..2060ab8035 100644
--- a/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md
+++ b/docs/_posts/2022-03-15-suspicious_dllhost_no_command_line_arguments.md
@@ -54,9 +54,9 @@ The following analytic identifies DLLHost.exe with no command line arguments. It
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_dllhost](https://github.com/splunk/security_content/blob/develop/macros/process_dllhost.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_dllhost](https://github.com/splunk/security_content/blob/develop/macros/process_dllhost.yml)
 
 Note that `suspicious_dllhost_no_command_line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md
index 7b8fccfa91..d2be630ef1 100644
--- a/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md
+++ b/docs/_posts/2022-03-15-suspicious_gpupdate_no_command_line_arguments.md
@@ -54,9 +54,9 @@ The following analytic identifies gpupdate.exe with no command line arguments. I
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_gpupdate](https://github.com/splunk/security_content/blob/develop/macros/process_gpupdate.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `suspicious_gpupdate_no_command_line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md
index b8d6b49087..9ec5f18a31 100644
--- a/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md
+++ b/docs/_posts/2022-03-15-suspicious_rundll32_no_command_line_arguments.md
@@ -59,9 +59,9 @@ The following analytic identifies rundll32.exe with no command line arguments. I
 
 #### Macros
 The SPL above uses the following Macros:
-* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
 
 Note that `suspicious_rundll32_no_command_line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md b/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md
index 5586c92696..1bfe86a59a 100644
--- a/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md
+++ b/docs/_posts/2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md
@@ -54,8 +54,8 @@ The following analytic identifies searchprotocolhost.exe with no command line ar
 
 #### Macros
 The SPL above uses the following Macros:
-* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 * [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
 
 Note that `suspicious_searchprotocolhost_no_command_line_arguments_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md
index c7d8605c5c..7b038d2f65 100644
--- a/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md
+++ b/docs/_posts/2022-03-16-windows_installutil_remote_network_connection.md
@@ -65,9 +65,9 @@ During triage review resulting network connections, file modifications, and para
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `windows_installutil_remote_network_connection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md
index 7f7ba9dd60..0603ab54e6 100644
--- a/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md
+++ b/docs/_posts/2022-03-16-windows_installutil_uninstall_option_with_network.md
@@ -66,9 +66,9 @@ During triage review resulting network connections, file modifications, and para
 
 #### Macros
 The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 * [process_installutil](https://github.com/splunk/security_content/blob/develop/macros/process_installutil.yml)
 * [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
-* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
 
 Note that `windows_installutil_uninstall_option_with_network_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
 
diff --git a/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md b/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md
new file mode 100644
index 0000000000..3a90705d39
--- /dev/null
+++ b/docs/_posts/2022-03-17-modify_acl_permission_to_files_or_folder.md
@@ -0,0 +1,109 @@
+---
+title: "Modify ACL permission To Files Or Folder"
+excerpt: "File and Directory Permissions Modification
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-03-17
+toc: true
+toc_label: ""
+tags:
+  - File and Directory Permissions Modification
+  - Defense Evasion
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This analytic identifies suspicious modification of ACL permission to a files or folder to make it available to everyone. This technique may be used by the adversary to evade ACLs or protected files access. This changes is commonly configured by the file or directory owner with appropriate permission. This behavior is a good indicator if this command seen on a machine utilized by an account with no permission to do so.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
+- **Last Updated**: 2022-03-17
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 7e8458cc-acca-11eb-9e3f-acde48001122
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1222](https://attack.mitre.org/techniques/T1222/) | File and Directory Permissions Modification | Defense Evasion |
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "cacls.exe" OR Processes.process_name = "icacls.exe" OR Processes.process_name = "xcacls.exe") AND Processes.process = "*/G*" AND (Processes.process = "* everyone:*"  OR Processes.process = "* SYSTEM:*" OR Processes.process = "* S-1-1-0:*") by Processes.parent_process_name Processes.process_name Processes.dest Processes.user 
+| `drop_dm_object_name(Processes)` 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `modify_acl_permission_to_files_or_folder_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+Note that `modify_acl_permission_to_files_or_folder_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Processes.parent_process_name
+* Processes.process_name
+* Processes.dest
+* Processes.user
+* Processes.process
+* Processes.process_id
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used.
+
+#### Known False Positives
+administrators may use this command. Filter as needed.
+
+#### Associated Analytic story
+* [XMRig](/stories/xmrig)
+
+
+#### Kill Chain Phase
+* Exploitation
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 32.0 | 40 | 80 | Suspicious ACL permission modification on $dest$ |
+
+
+
+
+#### Reference
+
+* [https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/](https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/modify_acl_permission_to_files_or_folder.yml) \| *version*: **2**
\ No newline at end of file
diff --git a/docs/_posts/2022-03-28-windows_deleted_registry_by_a_non_critical_process_file_path.md b/docs/_posts/2022-03-28-windows_deleted_registry_by_a_non_critical_process_file_path.md
new file mode 100644
index 0000000000..d3203f8416
--- /dev/null
+++ b/docs/_posts/2022-03-28-windows_deleted_registry_by_a_non_critical_process_file_path.md
@@ -0,0 +1,119 @@
+---
+title: "Windows Deleted Registry By A Non Critical Process File Path"
+excerpt: "Modify Registry
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-03-28
+toc: true
+toc_label: ""
+tags:
+  - Modify Registry
+  - Defense Evasion
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This analytic is to detect deletion of registry with suspicious process file path. This technique was seen in Double Zero wiper malware where it will delete all the subkey in HKLM, HKCU and HKU registry hive as part of its destructive payload to the targeted hosts. This anomaly detections can catch possible malware or advesaries deleting registry as part of defense evasion or even payload impact but can also catch for third party application updates or installation. In this scenario false positive filter is needed.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+
+- **Last Updated**: 2022-03-28
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 15e70689-f55b-489e-8a80-6d0cd6d8aad2
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1112](https://attack.mitre.org/techniques/T1112/) | Modify Registry | Defense Evasion |
+
+#### Search
+
+```
+
+| tstats `security_content_summariesonly` count from datamodel=Endpoint.Registry where Registry.action=deleted by _time span=1h Registry.dest Registry.user Registry.registry_path Registry.registry_value_name Registry.registry_key_name Registry.process_guid Registry.registry_value_data Registry.action 
+| `drop_dm_object_name(Registry)` 
+|rename process_guid as proc_guid 
+|join proc_guid, _time [
+| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where NOT (Processes.process_path IN ("*\\windows\\*", "*\\program files*")) by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.parent_process_name Processes.parent_process Processes.process_path Processes.process_guid 
+| `drop_dm_object_name(Processes)` 
+|rename process_guid as proc_guid 
+| fields _time dest user parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name action] 
+| table _time parent_process_name parent_process process_name process_path process proc_guid registry_path registry_value_name registry_value_data registry_key_name action dest user 
+| `windows_deleted_registry_by_a_non_critical_process_file_path_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
+
+Note that `windows_deleted_registry_by_a_non_critical_process_file_path_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* Registry.registry_key_name
+* Registry.registry_path
+* Registry.registry_value_name
+* Registry.dest
+* Registry.user
+* Registry.action
+* Processes.process_id
+* Processes.process_name
+* Processes.process
+* Processes.dest
+* Processes.parent_process_name
+* Processes.parent_process
+* Processes.process_guid
+* Processes.process_path
+
+
+#### How To Implement
+To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
+
+#### Known False Positives
+This detection can catch for third party application updates or installation. In this scenario false positive filter is needed.
+
+#### Associated Analytic story
+* [Double Zero Destructor](/stories/double_zero_destructor)
+
+
+#### Kill Chain Phase
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 36.0 | 60 | 60 | registry was deleted by a suspicious $process_name$ with proces path $process_path in $dest$ |
+
+
+
+
+#### Reference
+
+* [https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html](https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/doublezero_wiper/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/doublezero_wiper/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_posts/2022-03-28-windows_terminating_lsass_process.md b/docs/_posts/2022-03-28-windows_terminating_lsass_process.md
new file mode 100644
index 0000000000..8da59e9514
--- /dev/null
+++ b/docs/_posts/2022-03-28-windows_terminating_lsass_process.md
@@ -0,0 +1,114 @@
+---
+title: "Windows Terminating Lsass Process"
+excerpt: "Disable or Modify Tools
+, Impair Defenses
+"
+categories:
+  - Endpoint
+last_modified_at: 2022-03-28
+toc: true
+toc_label: ""
+tags:
+  - Disable or Modify Tools
+  - Impair Defenses
+  - Defense Evasion
+  - Defense Evasion
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+---
+
+
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_splunk_app_enrichmentus/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+This analytic is to detect a suspicious process terminating Lsass process. Lsass process is known to be a critical process that is responsible for enforcing security policy system. This process was commonly targetted by threat actor or red teamer to gain privilege escalation or persistence in the targeted machine because it handles credentials of the logon users. In this analytic we tried to detect a suspicious process having a granted access PROCESS_TERMINATE to lsass process to modify or delete protected registrys. This technique was seen in doublezero malware that tries to wipe files and registry in compromised hosts. This anomaly detection can be a good pivot of incident response for possible credential dumping or evading security policy in a host or network environment.
+
+- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+
+
+- **Last Updated**: 2022-03-28
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 7ab3c319-a4e7-4211-9e8c-40a049d0dba6
+
+
+#### [ATT&CK](https://attack.mitre.org/)
+
+| ID             | Technique        |  Tactic             |
+| -------------- | ---------------- |-------------------- |
+| [T1562.001](https://attack.mitre.org/techniques/T1562/001/) | Disable or Modify Tools | Defense Evasion |
+
+| [T1562](https://attack.mitre.org/techniques/T1562/) | Impair Defenses | Defense Evasion |
+
+#### Search
+
+```
+`sysmon` EventCode=10 TargetImage=*lsass.exe GrantedAccess = 0x1 
+| stats count min(_time) as firstTime max(_time) as lastTime by SourceImage, TargetImage, TargetProcessId, SourceProcessId, GrantedAccess CallTrace, Computer 
+| rename Computer as dest 
+| `security_content_ctime(firstTime)` 
+| `security_content_ctime(lastTime)` 
+| `windows_terminating_lsass_process_filter`
+```
+
+#### Macros
+The SPL above uses the following Macros:
+* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
+* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
+
+Note that `windows_terminating_lsass_process_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
+
+#### Required field
+* _time
+* EventCode
+* TargetImage
+* CallTrace
+* Computer
+* TargetProcessId
+* SourceImage
+* SourceProcessId
+* GrantedAccess
+
+
+#### How To Implement
+This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 10 for lsass.exe. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives.
+
+#### Known False Positives
+unknown
+
+#### Associated Analytic story
+* [Double Zero Destructor](/stories/double_zero_destructor)
+
+
+#### Kill Chain Phase
+
+
+
+#### RBA
+
+| Risk Score  | Impact      | Confidence   | Message      |
+| ----------- | ----------- |--------------|--------------|
+| 64.0 | 80 | 80 | a process $SourceImage$ terminates Lsass process in $dest$ |
+
+
+
+
+#### Reference
+
+* [https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html](https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html)
+
+
+
+#### Test Dataset
+Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
+Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
+
+
+* [https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/doublezero_wiper/sysmon.log](https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/doublezero_wiper/sysmon.log)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/detections/endpoint/windows_terminating_lsass_process.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_stories/caddy_wiper.md b/docs/_stories/caddy_wiper.md
new file mode 100644
index 0000000000..13d1dfb255
--- /dev/null
+++ b/docs/_stories/caddy_wiper.md
@@ -0,0 +1,44 @@
+---
+title: "Caddy Wiper"
+last_modified_at: 2022-03-25
+toc: true
+toc_label: ""
+tags:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+  - Exploitation
+---
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+Caddy Wiper is a destructive payload that detects if its running on a Domain Controller and executes killswitch if detected. If not in a DC it destroys Users and subsequent mapped drives. This wiper also destroys drive partitions inculding boot partitions.
+
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-03-25
+- **Author**: Teoderick Contreras, Rod Soto, Splunk
+- **ID**: 435a156a-8ef1-4184-bd52-22328fb65d3a
+
+#### Narrative
+
+Caddy Wiper is destructive malware operation found by ESET multiple organizations in Ukraine. This malicious payload destroys user files, avoids executing on Dnomain Controllers and destroys boot and drive partitions.
+
+#### Detections
+
+| Name        | Technique   | Type         |
+| ----------- | ----------- |--------------|
+| [Windows Raw Access To Disk Volume Partition](/endpoint/windows_raw_access_to_disk_volume_partition/) | [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe)| Anomaly |
+| [Windows Raw Access To Master Boot Record Drive](/endpoint/windows_raw_access_to_master_boot_record_drive/) | [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe)| TTP |
+
+#### Reference
+
+* [https://twitter.com/ESETresearch/status/1503436420886712321](https://twitter.com/ESETresearch/status/1503436420886712321)
+* [https://www.welivesecurity.com/2022/03/15/caddywiper-new-wiper-malware-discovered-ukraine/](https://www.welivesecurity.com/2022/03/15/caddywiper-new-wiper-malware-discovered-ukraine/)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/stories/caddy_wiper.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_stories/container_implantation_monitoring_and_investigation.md b/docs/_stories/container_implantation_monitoring_and_investigation.md
index d39b89f55d..e5cb771f65 100644
--- a/docs/_stories/container_implantation_monitoring_and_investigation.md
+++ b/docs/_stories/container_implantation_monitoring_and_investigation.md
@@ -30,8 +30,8 @@ Container Registrys provide a way for organizations to keep customized images of
 
 | Name        | Technique   | Type         |
 | ----------- | ----------- |--------------|
-| [GCP GCR container uploaded](/deprecated/gcp_gcr_container_uploaded/) | [Implant Internal Image](/tags/#implant-internal-image)| Hunting |
-| [New container uploaded to AWS ECR](/cloud/new_container_uploaded_to_aws_ecr/) | [Implant Internal Image](/tags/#implant-internal-image)| Hunting |
+| [GCP GCR container uploaded](/deprecated/gcp_gcr_container_uploaded/) | [Implant Container Image](/tags/#implant-container-image)| Hunting |
+| [New container uploaded to AWS ECR](/cloud/new_container_uploaded_to_aws_ecr/) | [Implant Container Image](/tags/#implant-container-image)| Hunting |
 
 #### Reference
 
diff --git a/docs/_stories/darkside_ransomware.md b/docs/_stories/darkside_ransomware.md
index add9b10ea8..def01068ba 100644
--- a/docs/_stories/darkside_ransomware.md
+++ b/docs/_stories/darkside_ransomware.md
@@ -46,8 +46,8 @@ This story addresses Darkside ransomware. This ransomware payload has many simil
 | [Detect Renamed RClone](/endpoint/detect_renamed_rclone/) | [Automated Exfiltration](/tags/#automated-exfiltration)| Hunting |
 | [Extraction of Registry Hives](/endpoint/extraction_of_registry_hives/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping)| TTP |
 | [Ransomware Notes bulk creation](/endpoint/ransomware_notes_bulk_creation/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact)| Anomaly |
-| [SLUI RunAs Elevated](/endpoint/slui_runas_elevated/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
-| [SLUI Spawning a Process](/endpoint/slui_spawning_a_process/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [SLUI RunAs Elevated](/endpoint/slui_runas_elevated/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [SLUI Spawning a Process](/endpoint/slui_spawning_a_process/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
 | [Windows Possible Credential Dumping](/endpoint/windows_possible_credential_dumping/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping)| TTP |
 
 #### Reference
diff --git a/docs/_stories/data_destruction.md b/docs/_stories/data_destruction.md
index 96f86f3a0e..f67f28a163 100644
--- a/docs/_stories/data_destruction.md
+++ b/docs/_stories/data_destruction.md
@@ -31,10 +31,17 @@ Adversaries may use this technique to maximize the impact on the target organiza
 
 | Name        | Technique   | Type         |
 | ----------- | ----------- |--------------|
+| [CMD Carry Out String Command Parameter](/endpoint/cmd_carry_out_string_command_parameter/) | [Windows Command Shell](/tags/#windows-command-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| Hunting |
+| [Executable File Written in Administrative SMB Share](/endpoint/executable_file_written_in_administrative_smb_share/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares)| TTP |
+| [Executables Or Script Creation In Suspicious Path](/endpoint/executables_or_script_creation_in_suspicious_path/) | [Masquerading](/tags/#masquerading)| TTP |
 | [Linux DD File Overwrite](/endpoint/linux_dd_file_overwrite/) | [Data Destruction](/tags/#data-destruction)| TTP |
+| [Regsvr32 Silent and Install Param Dll Loading](/endpoint/regsvr32_silent_and_install_param_dll_loading/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Regsvr32](/tags/#regsvr32)| Anomaly |
+| [Suspicious Process File Path](/endpoint/suspicious_process_file_path/) | [Create or Modify System Process](/tags/#create-or-modify-system-process)| TTP |
 | [Windows Disable Memory Crash Dump](/endpoint/windows_disable_memory_crash_dump/) | [Data Destruction](/tags/#data-destruction)| TTP |
 | [Windows File Without Extension In Critical Folder](/endpoint/windows_file_without_extension_in_critical_folder/) | [Data Destruction](/tags/#data-destruction)| TTP |
+| [Windows Modify Show Compress Color And Info Tip Registry](/endpoint/windows_modify_show_compress_color_and_info_tip_registry/) | [Modify Registry](/tags/#modify-registry)| TTP |
 | [Windows Raw Access To Disk Volume Partition](/endpoint/windows_raw_access_to_disk_volume_partition/) | [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe)| Anomaly |
+| [Windows Raw Access To Master Boot Record Drive](/endpoint/windows_raw_access_to_master_boot_record_drive/) | [Disk Structure Wipe](/tags/#disk-structure-wipe), [Disk Wipe](/tags/#disk-wipe)| TTP |
 
 #### Reference
 
diff --git a/docs/_stories/double_zero_destructor.md b/docs/_stories/double_zero_destructor.md
new file mode 100644
index 0000000000..fe98bd2bd5
--- /dev/null
+++ b/docs/_stories/double_zero_destructor.md
@@ -0,0 +1,46 @@
+---
+title: "Double Zero Destructor"
+last_modified_at: 2022-03-25
+toc: true
+toc_label: ""
+tags:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+  - Exploitation
+---
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+Double Zero Destructor is a destructive payload that enumerates Domain Controllers and executes killswitch if detected. Overwrites files with Zero blocks or using MS Windows API calls such as NtFileOpen, NtFSControlFile. This payload also deletes registry hives HKCU,HKLM, HKU, HKLM BCD.
+
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-03-25
+- **Author**: Teoderick Contreras, Rod Soto, Splunk
+- **ID**: f56e8c00-3224-4955-9a6e-924ec7da1df7
+
+#### Narrative
+
+Double zero destructor enumerates domain controllers, delete registry hives and overwrites files using zero blocks and API calls.
+
+#### Detections
+
+| Name        | Technique   | Type         |
+| ----------- | ----------- |--------------|
+| [Executables Or Script Creation In Suspicious Path](/endpoint/executables_or_script_creation_in_suspicious_path/) | [Masquerading](/tags/#masquerading)| TTP |
+| [Suspicious Process File Path](/endpoint/suspicious_process_file_path/) | [Create or Modify System Process](/tags/#create-or-modify-system-process)| TTP |
+| [Windows Deleted Registry By A Non Critical Process File Path](/endpoint/windows_deleted_registry_by_a_non_critical_process_file_path/) | [Modify Registry](/tags/#modify-registry)| Anomaly |
+| [Windows Terminating Lsass Process](/endpoint/windows_terminating_lsass_process/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| Anomaly |
+
+#### Reference
+
+* [https://cert.gov.ua/article/38088](https://cert.gov.ua/article/38088)
+* [https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html](https://blog.talosintelligence.com/2022/03/threat-advisory-doublezero.html)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/stories/double_zero_destructor.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_stories/fin7.md b/docs/_stories/fin7.md
index 6ebc12420f..bed5ced866 100644
--- a/docs/_stories/fin7.md
+++ b/docs/_stories/fin7.md
@@ -32,10 +32,10 @@ FIN7 is a Russian criminal advanced persistent threat group that has primarily t
 | Name        | Technique   | Type         |
 | ----------- | ----------- |--------------|
 | [Check Elevated CMD using whoami](/endpoint/check_elevated_cmd_using_whoami/) | [System Owner/User Discovery](/tags/#system-owner/user-discovery)| TTP |
-| [Cmdline Tool Not Executed In CMD Shell](/endpoint/cmdline_tool_not_executed_in_cmd_shell/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript)| TTP |
-| [Jscript Execution Using Cscript App](/endpoint/jscript_execution_using_cscript_app/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript)| TTP |
-| [MS Scripting Process Loading Ldap Module](/endpoint/ms_scripting_process_loading_ldap_module/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript)| Anomaly |
-| [MS Scripting Process Loading WMI Module](/endpoint/ms_scripting_process_loading_wmi_module/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript)| Anomaly |
+| [Cmdline Tool Not Executed In CMD Shell](/endpoint/cmdline_tool_not_executed_in_cmd_shell/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript/JScript](/tags/#javascript/jscript)| TTP |
+| [Jscript Execution Using Cscript App](/endpoint/jscript_execution_using_cscript_app/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript/JScript](/tags/#javascript/jscript)| TTP |
+| [MS Scripting Process Loading Ldap Module](/endpoint/ms_scripting_process_loading_ldap_module/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript/JScript](/tags/#javascript/jscript)| Anomaly |
+| [MS Scripting Process Loading WMI Module](/endpoint/ms_scripting_process_loading_wmi_module/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript/JScript](/tags/#javascript/jscript)| Anomaly |
 | [Non Chrome Process Accessing Chrome Default Dir](/endpoint/non_chrome_process_accessing_chrome_default_dir/) | [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers)| Anomaly |
 | [Non Firefox Process Access Firefox Profile Dir](/endpoint/non_firefox_process_access_firefox_profile_dir/) | [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers)| Anomaly |
 | [Office Application Drop Executable](/endpoint/office_application_drop_executable/) | [Phishing](/tags/#phishing), [Spearphishing Attachment](/tags/#spearphishing-attachment)| TTP |
diff --git a/docs/_stories/icedid.md b/docs/_stories/icedid.md
index f0ce4fd07b..fc7b8a05d4 100644
--- a/docs/_stories/icedid.md
+++ b/docs/_stories/icedid.md
@@ -39,8 +39,8 @@ IcedId banking trojan campaigns targeting banks and other vertical sectors.This
 | [Create Remote Thread In Shell Application](/endpoint/create_remote_thread_in_shell_application/) | [Process Injection](/tags/#process-injection)| TTP |
 | [Disable Schedule Task](/endpoint/disable_schedule_task/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
 | [Drop IcedID License dat](/endpoint/drop_icedid_license_dat/) | [User Execution](/tags/#user-execution), [Malicious File](/tags/#malicious-file)| Hunting |
-| [Eventvwr UAC Bypass](/endpoint/eventvwr_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
-| [FodHelper UAC Bypass](/endpoint/fodhelper_uac_bypass/) | [Modify Registry](/tags/#modify-registry), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [Eventvwr UAC Bypass](/endpoint/eventvwr_uac_bypass/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [FodHelper UAC Bypass](/endpoint/fodhelper_uac_bypass/) | [Modify Registry](/tags/#modify-registry), [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
 | [IcedID Exfiltrated Archived File Creation](/endpoint/icedid_exfiltrated_archived_file_creation/) | [Archive via Utility](/tags/#archive-via-utility), [Archive Collected Data](/tags/#archive-collected-data)| Hunting |
 | [Mshta spawning Rundll32 OR Regsvr32 Process](/endpoint/mshta_spawning_rundll32_or_regsvr32_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP |
 | [NLTest Domain Trust Discovery](/endpoint/nltest_domain_trust_discovery/) | [Domain Trust Discovery](/tags/#domain-trust-discovery)| TTP |
diff --git a/docs/_stories/linux_persistence_techniques.md b/docs/_stories/linux_persistence_techniques.md
index 4f18340b94..ba502fc907 100644
--- a/docs/_stories/linux_persistence_techniques.md
+++ b/docs/_stories/linux_persistence_techniques.md
@@ -41,8 +41,8 @@ Maintaining persistence is one of the first steps taken by attackers after the i
 | [Linux Doas Tool Execution](/endpoint/linux_doas_tool_execution/) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| Anomaly |
 | [Linux Edit Cron Table Parameter](/endpoint/linux_edit_cron_table_parameter/) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job)| Hunting |
 | [Linux File Created In Kernel Driver Directory](/endpoint/linux_file_created_in_kernel_driver_directory/) | [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| Anomaly |
-| [Linux File Creation In Init Boot Directory](/endpoint/linux_file_creation_in_init_boot_directory/) | [RC Scripts](/tags/#rc-scripts), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts)| Anomaly |
-| [Linux File Creation In Profile Directory](/endpoint/linux_file_creation_in_profile_directory/) | [Unix Shell Configuration Modification](/tags/#unix-shell-configuration-modification), [Event Triggered Execution](/tags/#event-triggered-execution)| Anomaly |
+| [Linux File Creation In Init Boot Directory](/endpoint/linux_file_creation_in_init_boot_directory/) | [Rc.common](/tags/#rc.common), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts)| Anomaly |
+| [Linux File Creation In Profile Directory](/endpoint/linux_file_creation_in_profile_directory/) | [.bash_profile and .bashrc](/tags/#.bash_profile-and-.bashrc), [Event Triggered Execution](/tags/#event-triggered-execution)| Anomaly |
 | [Linux Insert Kernel Module Using Insmod Utility](/endpoint/linux_insert_kernel_module_using_insmod_utility/) | [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| Anomaly |
 | [Linux Install Kernel Module Using Modprobe Utility](/endpoint/linux_install_kernel_module_using_modprobe_utility/) | [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| Anomaly |
 | [Linux NOPASSWD Entry In Sudoers File](/endpoint/linux_nopasswd_entry_in_sudoers_file/) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| Anomaly |
@@ -50,11 +50,11 @@ Maintaining persistence is one of the first steps taken by attackers after the i
 | [Linux Possible Access To Credential Files](/endpoint/linux_possible_access_to_credential_files/) | [/etc/passwd and /etc/shadow](/tags/#/etc/passwd-and-/etc/shadow), [OS Credential Dumping](/tags/#os-credential-dumping)| Anomaly |
 | [Linux Possible Access To Sudoers File](/endpoint/linux_possible_access_to_sudoers_file/) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| Anomaly |
 | [Linux Possible Append Command To At Allow Config File](/endpoint/linux_possible_append_command_to_at_allow_config_file/) | [At (Linux)](/tags/#at-(linux)), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly |
-| [Linux Possible Append Command To Profile Config File](/endpoint/linux_possible_append_command_to_profile_config_file/) | [Unix Shell Configuration Modification](/tags/#unix-shell-configuration-modification), [Event Triggered Execution](/tags/#event-triggered-execution)| Anomaly |
+| [Linux Possible Append Command To Profile Config File](/endpoint/linux_possible_append_command_to_profile_config_file/) | [.bash_profile and .bashrc](/tags/#.bash_profile-and-.bashrc), [Event Triggered Execution](/tags/#event-triggered-execution)| Anomaly |
 | [Linux Possible Append Cronjob Entry on Existing Cronjob File](/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file/) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job)| Hunting |
 | [Linux Possible Cronjob Modification With Editor](/endpoint/linux_possible_cronjob_modification_with_editor/) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job)| Hunting |
 | [Linux Possible Ssh Key File Creation](/endpoint/linux_possible_ssh_key_file_creation/) | [SSH Authorized Keys](/tags/#ssh-authorized-keys), [Account Manipulation](/tags/#account-manipulation)| Anomaly |
-| [Linux Preload Hijack Library Calls](/endpoint/linux_preload_hijack_library_calls/) | [Dynamic Linker Hijacking](/tags/#dynamic-linker-hijacking), [Hijack Execution Flow](/tags/#hijack-execution-flow)| TTP |
+| [Linux Preload Hijack Library Calls](/endpoint/linux_preload_hijack_library_calls/) | [LD_PRELOAD](/tags/#ld_preload), [Hijack Execution Flow](/tags/#hijack-execution-flow)| TTP |
 | [Linux Service File Created In Systemd Directory](/endpoint/linux_service_file_created_in_systemd_directory/) | [Systemd Timers](/tags/#systemd-timers), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly |
 | [Linux Service Restarted](/endpoint/linux_service_restarted/) | [Systemd Timers](/tags/#systemd-timers), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly |
 | [Linux Service Started Or Enabled](/endpoint/linux_service_started_or_enabled/) | [Systemd Timers](/tags/#systemd-timers), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly |
diff --git a/docs/_stories/linux_privilege_escalation.md b/docs/_stories/linux_privilege_escalation.md
index a81a4e5399..ead1d841bb 100644
--- a/docs/_stories/linux_privilege_escalation.md
+++ b/docs/_stories/linux_privilege_escalation.md
@@ -41,8 +41,8 @@ Privilege escalation is a "land-and-expand" technique, wherein an adversary gain
 | [Linux Doas Tool Execution](/endpoint/linux_doas_tool_execution/) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| Anomaly |
 | [Linux Edit Cron Table Parameter](/endpoint/linux_edit_cron_table_parameter/) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job)| Hunting |
 | [Linux File Created In Kernel Driver Directory](/endpoint/linux_file_created_in_kernel_driver_directory/) | [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| Anomaly |
-| [Linux File Creation In Init Boot Directory](/endpoint/linux_file_creation_in_init_boot_directory/) | [RC Scripts](/tags/#rc-scripts), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts)| Anomaly |
-| [Linux File Creation In Profile Directory](/endpoint/linux_file_creation_in_profile_directory/) | [Unix Shell Configuration Modification](/tags/#unix-shell-configuration-modification), [Event Triggered Execution](/tags/#event-triggered-execution)| Anomaly |
+| [Linux File Creation In Init Boot Directory](/endpoint/linux_file_creation_in_init_boot_directory/) | [Rc.common](/tags/#rc.common), [Boot or Logon Initialization Scripts](/tags/#boot-or-logon-initialization-scripts)| Anomaly |
+| [Linux File Creation In Profile Directory](/endpoint/linux_file_creation_in_profile_directory/) | [.bash_profile and .bashrc](/tags/#.bash_profile-and-.bashrc), [Event Triggered Execution](/tags/#event-triggered-execution)| Anomaly |
 | [Linux Insert Kernel Module Using Insmod Utility](/endpoint/linux_insert_kernel_module_using_insmod_utility/) | [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| Anomaly |
 | [Linux Install Kernel Module Using Modprobe Utility](/endpoint/linux_install_kernel_module_using_modprobe_utility/) | [Kernel Modules and Extensions](/tags/#kernel-modules-and-extensions), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| Anomaly |
 | [Linux NOPASSWD Entry In Sudoers File](/endpoint/linux_nopasswd_entry_in_sudoers_file/) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| Anomaly |
@@ -51,11 +51,11 @@ Privilege escalation is a "land-and-expand" technique, wherein an adversary gain
 | [Linux Possible Access To Credential Files](/endpoint/linux_possible_access_to_credential_files/) | [/etc/passwd and /etc/shadow](/tags/#/etc/passwd-and-/etc/shadow), [OS Credential Dumping](/tags/#os-credential-dumping)| Anomaly |
 | [Linux Possible Access To Sudoers File](/endpoint/linux_possible_access_to_sudoers_file/) | [Sudo and Sudo Caching](/tags/#sudo-and-sudo-caching), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| Anomaly |
 | [Linux Possible Append Command To At Allow Config File](/endpoint/linux_possible_append_command_to_at_allow_config_file/) | [At (Linux)](/tags/#at-(linux)), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly |
-| [Linux Possible Append Command To Profile Config File](/endpoint/linux_possible_append_command_to_profile_config_file/) | [Unix Shell Configuration Modification](/tags/#unix-shell-configuration-modification), [Event Triggered Execution](/tags/#event-triggered-execution)| Anomaly |
+| [Linux Possible Append Command To Profile Config File](/endpoint/linux_possible_append_command_to_profile_config_file/) | [.bash_profile and .bashrc](/tags/#.bash_profile-and-.bashrc), [Event Triggered Execution](/tags/#event-triggered-execution)| Anomaly |
 | [Linux Possible Append Cronjob Entry on Existing Cronjob File](/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file/) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job)| Hunting |
 | [Linux Possible Cronjob Modification With Editor](/endpoint/linux_possible_cronjob_modification_with_editor/) | [Cron](/tags/#cron), [Scheduled Task/Job](/tags/#scheduled-task/job)| Hunting |
 | [Linux Possible Ssh Key File Creation](/endpoint/linux_possible_ssh_key_file_creation/) | [SSH Authorized Keys](/tags/#ssh-authorized-keys), [Account Manipulation](/tags/#account-manipulation)| Anomaly |
-| [Linux Preload Hijack Library Calls](/endpoint/linux_preload_hijack_library_calls/) | [Dynamic Linker Hijacking](/tags/#dynamic-linker-hijacking), [Hijack Execution Flow](/tags/#hijack-execution-flow)| TTP |
+| [Linux Preload Hijack Library Calls](/endpoint/linux_preload_hijack_library_calls/) | [LD_PRELOAD](/tags/#ld_preload), [Hijack Execution Flow](/tags/#hijack-execution-flow)| TTP |
 | [Linux Service File Created In Systemd Directory](/endpoint/linux_service_file_created_in_systemd_directory/) | [Systemd Timers](/tags/#systemd-timers), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly |
 | [Linux Service Restarted](/endpoint/linux_service_restarted/) | [Systemd Timers](/tags/#systemd-timers), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly |
 | [Linux Service Started Or Enabled](/endpoint/linux_service_started_or_enabled/) | [Systemd Timers](/tags/#systemd-timers), [Scheduled Task/Job](/tags/#scheduled-task/job)| Anomaly |
diff --git a/docs/_stories/living_off_the_land.md b/docs/_stories/living_off_the_land.md
index 1e782f2302..f7027c8510 100644
--- a/docs/_stories/living_off_the_land.md
+++ b/docs/_stories/living_off_the_land.md
@@ -63,7 +63,7 @@ Living Off The Land refers to an adversary methodology of using native applicati
 | [Disable Schedule Task](/endpoint/disable_schedule_task/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
 | [Dump LSASS via comsvcs DLL](/endpoint/dump_lsass_via_comsvcs_dll/) | [LSASS Memory](/tags/#lsass-memory), [OS Credential Dumping](/tags/#os-credential-dumping)| TTP |
 | [Esentutl SAM Copy](/endpoint/esentutl_sam_copy/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping)| Hunting |
-| [Eventvwr UAC Bypass](/endpoint/eventvwr_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [Eventvwr UAC Bypass](/endpoint/eventvwr_uac_bypass/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
 | [MacOS LOLbin](/endpoint/macos_lolbin/) | [Unix Shell](/tags/#unix-shell), [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter)| TTP |
 | [Mmc LOLBAS Execution Process Spawn](/endpoint/mmc_lolbas_execution_process_spawn/) | [Remote Services](/tags/#remote-services), [Distributed Component Object Model](/tags/#distributed-component-object-model)| TTP |
 | [Mshta spawning Rundll32 OR Regsvr32 Process](/endpoint/mshta_spawning_rundll32_or_regsvr32_process/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Mshta](/tags/#mshta)| TTP |
@@ -105,7 +105,7 @@ Living Off The Land refers to an adversary methodology of using native applicati
 | [Windows InstallUtil Uninstall Option](/endpoint/windows_installutil_uninstall_option/) | [InstallUtil](/tags/#installutil), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution)| TTP |
 | [Windows InstallUtil Uninstall Option with Network](/endpoint/windows_installutil_uninstall_option_with_network/) | [InstallUtil](/tags/#installutil), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution)| TTP |
 | [Windows InstallUtil URL in Command Line](/endpoint/windows_installutil_url_in_command_line/) | [InstallUtil](/tags/#installutil), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution)| TTP |
-| [WSReset UAC Bypass](/endpoint/wsreset_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [WSReset UAC Bypass](/endpoint/wsreset_uac_bypass/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
 
 #### Reference
 
diff --git a/docs/_stories/remcos.md b/docs/_stories/remcos.md
index aad8b0f1e3..9cb3695799 100644
--- a/docs/_stories/remcos.md
+++ b/docs/_stories/remcos.md
@@ -34,9 +34,9 @@ Remcos or Remote Control and Surveillance, marketed as a legitimate software for
 | Name        | Technique   | Type         |
 | ----------- | ----------- |--------------|
 | [Add or Set Windows Defender Exclusion](/endpoint/add_or_set_windows_defender_exclusion/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
-| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
 | [Executables Or Script Creation In Suspicious Path](/endpoint/executables_or_script_creation_in_suspicious_path/) | [Masquerading](/tags/#masquerading)| TTP |
-| [Jscript Execution Using Cscript App](/endpoint/jscript_execution_using_cscript_app/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript](/tags/#javascript)| TTP |
+| [Jscript Execution Using Cscript App](/endpoint/jscript_execution_using_cscript_app/) | [Command and Scripting Interpreter](/tags/#command-and-scripting-interpreter), [JavaScript/JScript](/tags/#javascript/jscript)| TTP |
 | [Loading Of Dynwrapx Module](/endpoint/loading_of_dynwrapx_module/) | [Process Injection](/tags/#process-injection), [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection)| TTP |
 | [Malicious InProcServer32 Modification](/endpoint/malicious_inprocserver32_modification/) | [Regsvr32](/tags/#regsvr32), [Modify Registry](/tags/#modify-registry)| TTP |
 | [Non Chrome Process Accessing Chrome Default Dir](/endpoint/non_chrome_process_accessing_chrome_default_dir/) | [Credentials from Password Stores](/tags/#credentials-from-password-stores), [Credentials from Web Browsers](/tags/#credentials-from-web-browsers)| Anomaly |
diff --git a/docs/_stories/router_and_infrastructure_security.md b/docs/_stories/router_and_infrastructure_security.md
index 5779c4fc5d..468999493b 100644
--- a/docs/_stories/router_and_infrastructure_security.md
+++ b/docs/_stories/router_and_infrastructure_security.md
@@ -37,10 +37,10 @@ This Analytic Story helps you gain a better understanding of how your network de
 | Name        | Technique   | Type         |
 | ----------- | ----------- |--------------|
 | [Detect New Login Attempts to Routers](/application/detect_new_login_attempts_to_routers/) | None| TTP |
-| [Detect ARP Poisoning](/network/detect_arp_poisoning/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning)| TTP |
-| [Detect IPv6 Network Infrastructure Threats](/network/detect_ipv6_network_infrastructure_threats/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning)| TTP |
-| [Detect Port Security Violation](/network/detect_port_security_violation/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning)| TTP |
-| [Detect Rogue DHCP Server](/network/detect_rogue_dhcp_server/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Adversary-in-the-Middle](/tags/#adversary-in-the-middle)| TTP |
+| [Detect ARP Poisoning](/network/detect_arp_poisoning/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning)| TTP |
+| [Detect IPv6 Network Infrastructure Threats](/network/detect_ipv6_network_infrastructure_threats/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning)| TTP |
+| [Detect Port Security Violation](/network/detect_port_security_violation/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle), [ARP Cache Poisoning](/tags/#arp-cache-poisoning)| TTP |
+| [Detect Rogue DHCP Server](/network/detect_rogue_dhcp_server/) | [Hardware Additions](/tags/#hardware-additions), [Network Denial of Service](/tags/#network-denial-of-service), [Man-in-the-Middle](/tags/#man-in-the-middle)| TTP |
 | [Detect Software Download To Network Device](/network/detect_software_download_to_network_device/) | [TFTP Boot](/tags/#tftp-boot), [Pre-OS Boot](/tags/#pre-os-boot)| TTP |
 | [Detect Traffic Mirroring](/network/detect_traffic_mirroring/) | [Hardware Additions](/tags/#hardware-additions), [Automated Exfiltration](/tags/#automated-exfiltration), [Network Denial of Service](/tags/#network-denial-of-service), [Traffic Duplication](/tags/#traffic-duplication)| TTP |
 
diff --git a/docs/_stories/suspicious_windows_registry_activities.md b/docs/_stories/suspicious_windows_registry_activities.md
index e7dbed4ac2..105f2e8de7 100644
--- a/docs/_stories/suspicious_windows_registry_activities.md
+++ b/docs/_stories/suspicious_windows_registry_activities.md
@@ -37,8 +37,8 @@ Attackers are developing increasingly sophisticated techniques for hijacking tar
 | [Reg exe used to hide files directories via registry keys](/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys/) | [Hidden Files and Directories](/tags/#hidden-files-and-directories)| TTP |
 | [Remote Registry Key modifications](/deprecated/remote_registry_key_modifications/) | None| TTP |
 | [Suspicious Changes to File Associations](/deprecated/suspicious_changes_to_file_associations/) | [Change Default File Association](/tags/#change-default-file-association)| TTP |
-| [Disable UAC Remote Restriction](/endpoint/disable_uac_remote_restriction/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
-| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [Disable UAC Remote Restriction](/endpoint/disable_uac_remote_restriction/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
 | [Monitor Registry Keys for Print Monitors](/endpoint/monitor_registry_keys_for_print_monitors/) | [Port Monitors](/tags/#port-monitors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| TTP |
 | [Registry Keys for Creating SHIM Databases](/endpoint/registry_keys_for_creating_shim_databases/) | [Application Shimming](/tags/#application-shimming), [Event Triggered Execution](/tags/#event-triggered-execution)| TTP |
 | [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| TTP |
diff --git a/docs/_stories/windows_defense_evasion_tactics.md b/docs/_stories/windows_defense_evasion_tactics.md
index a8916f0d49..5275275221 100644
--- a/docs/_stories/windows_defense_evasion_tactics.md
+++ b/docs/_stories/windows_defense_evasion_tactics.md
@@ -41,7 +41,7 @@ Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adve
 | [Disable Registry Tool](/endpoint/disable_registry_tool/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
 | [Disable Security Logs Using MiniNt Registry](/endpoint/disable_security_logs_using_minint_registry/) | [Modify Registry](/tags/#modify-registry)| TTP |
 | [Disable Show Hidden Files](/endpoint/disable_show_hidden_files/) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Hide Artifacts](/tags/#hide-artifacts), [Impair Defenses](/tags/#impair-defenses)| TTP |
-| [Disable UAC Remote Restriction](/endpoint/disable_uac_remote_restriction/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [Disable UAC Remote Restriction](/endpoint/disable_uac_remote_restriction/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
 | [Disable Windows Behavior Monitoring](/endpoint/disable_windows_behavior_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
 | [Disable Windows SmartScreen Protection](/endpoint/disable_windows_smartscreen_protection/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
 | [Disabling CMD Application](/endpoint/disabling_cmd_application/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
@@ -49,22 +49,22 @@ Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adve
 | [Disabling Firewall with Netsh](/endpoint/disabling_firewall_with_netsh/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
 | [Disabling FolderOptions Windows Feature](/endpoint/disabling_folderoptions_windows_feature/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
 | [Disabling NoRun Windows App](/endpoint/disabling_norun_windows_app/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
-| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
-| [Disabling SystemRestore In Registry](/endpoint/disabling_systemrestore_in_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [Disabling SystemRestore In Registry](/endpoint/disabling_systemrestore_in_registry/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery)| TTP |
 | [Disabling Task Manager](/endpoint/disabling_task_manager/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
-| [Eventvwr UAC Bypass](/endpoint/eventvwr_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [Eventvwr UAC Bypass](/endpoint/eventvwr_uac_bypass/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
 | [Excessive number of service control start as disabled](/endpoint/excessive_number_of_service_control_start_as_disabled/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| Anomaly |
 | [Firewall Allowed Program Enable](/endpoint/firewall_allowed_program_enable/) | [Disable or Modify System Firewall](/tags/#disable-or-modify-system-firewall), [Impair Defenses](/tags/#impair-defenses)| Anomaly |
-| [FodHelper UAC Bypass](/endpoint/fodhelper_uac_bypass/) | [Modify Registry](/tags/#modify-registry), [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [FodHelper UAC Bypass](/endpoint/fodhelper_uac_bypass/) | [Modify Registry](/tags/#modify-registry), [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
 | [Hiding Files And Directories With Attrib exe](/endpoint/hiding_files_and_directories_with_attrib_exe/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification), [Windows File and Directory Permissions Modification](/tags/#windows-file-and-directory-permissions-modification)| TTP |
-| [NET Profiler UAC bypass](/endpoint/net_profiler_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [NET Profiler UAC bypass](/endpoint/net_profiler_uac_bypass/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
 | [Powershell Windows Defender Exclusion Commands](/endpoint/powershell_windows_defender_exclusion_commands/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
-| [Sdclt UAC Bypass](/endpoint/sdclt_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
-| [SilentCleanup UAC Bypass](/endpoint/silentcleanup_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
-| [SLUI RunAs Elevated](/endpoint/slui_runas_elevated/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
-| [SLUI Spawning a Process](/endpoint/slui_spawning_a_process/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [Sdclt UAC Bypass](/endpoint/sdclt_uac_bypass/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [SilentCleanup UAC Bypass](/endpoint/silentcleanup_uac_bypass/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [SLUI RunAs Elevated](/endpoint/slui_runas_elevated/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [SLUI Spawning a Process](/endpoint/slui_spawning_a_process/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
 | [Suspicious Reg exe Process](/endpoint/suspicious_reg_exe_process/) | [Modify Registry](/tags/#modify-registry)| TTP |
-| [UAC Bypass MMC Load Unsigned Dll](/endpoint/uac_bypass_mmc_load_unsigned_dll/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [UAC Bypass MMC Load Unsigned Dll](/endpoint/uac_bypass_mmc_load_unsigned_dll/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
 | [Windows Defender Exclusion Registry Entry](/endpoint/windows_defender_exclusion_registry_entry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
 | [Windows Disable Change Password Through Registry](/endpoint/windows_disable_change_password_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly |
 | [Windows Disable Lock Workstation Feature Through Registry](/endpoint/windows_disable_lock_workstation_feature_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly |
@@ -78,7 +78,7 @@ Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adve
 | [Windows Modify Show Compress Color And Info Tip Registry](/endpoint/windows_modify_show_compress_color_and_info_tip_registry/) | [Modify Registry](/tags/#modify-registry)| TTP |
 | [Windows Process With NamedPipe CommandLine](/endpoint/windows_process_with_namedpipe_commandline/) | [Process Injection](/tags/#process-injection)| Anomaly |
 | [Windows Rasautou DLL Execution](/endpoint/windows_rasautou_dll_execution/) | [Dynamic-link Library Injection](/tags/#dynamic-link-library-injection), [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [Process Injection](/tags/#process-injection)| TTP |
-| [WSReset UAC Bypass](/endpoint/wsreset_uac_bypass/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [WSReset UAC Bypass](/endpoint/wsreset_uac_bypass/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
 
 #### Reference
 
diff --git a/docs/_stories/windows_registry_abuse.md b/docs/_stories/windows_registry_abuse.md
new file mode 100644
index 0000000000..43c8aad011
--- /dev/null
+++ b/docs/_stories/windows_registry_abuse.md
@@ -0,0 +1,99 @@
+---
+title: "Windows Registry Abuse"
+last_modified_at: 2022-03-17
+toc: true
+toc_label: ""
+tags:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  - Endpoint
+  - Actions on Objectives
+  - Delivery
+  - Exploitation
+---
+
+[Try in Splunk Security Cloud](https://www.splunk.com/en_us/cyber-security.html){: .btn .btn--success}
+
+#### Description
+
+Windows services are often used by attackers for persistence, privilege escalation, lateral movement, defense evasion, collection of data, a tool for recon, credential dumping and payload impact. This Analytic Story helps you monitor your environment for indications that Windows registry are being modified or created in a suspicious manner.
+
+- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
+- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
+- **Last Updated**: 2022-03-17
+- **Author**: Teoderick Contreras, Splunk
+- **ID**: 78df1df1-25f1-4387-90f9-c4ea31ce6b75
+
+#### Narrative
+
+Windows Registry is one of the powerful and yet still mysterious Windows features that can tweak or manipulate Windows policies and low-level configuration settings. Because of this capability,  most malware, adversaries or threat actors abuse this hierarchical database to do their malicious intent on a targeted host or network environment. In these cases, attackers often use tools to create or modify registry in ways that are not typical for most environments, providing opportunities for detection.
+
+#### Detections
+
+| Name        | Technique   | Type         |
+| ----------- | ----------- |--------------|
+| [Allow Inbound Traffic By Firewall Rule Registry](/endpoint/allow_inbound_traffic_by_firewall_rule_registry/) | [Remote Desktop Protocol](/tags/#remote-desktop-protocol), [Remote Services](/tags/#remote-services)| TTP |
+| [Allow Operation with Consent Admin](/endpoint/allow_operation_with_consent_admin/) | [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [Attempted Credential Dump From Registry via Reg exe](/endpoint/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping)| TTP |
+| [Auto Admin Logon Registry Entry](/endpoint/auto_admin_logon_registry_entry/) | [Credentials in Registry](/tags/#credentials-in-registry), [Unsecured Credentials](/tags/#unsecured-credentials)| TTP |
+| [Change Default File Association](/endpoint/change_default_file_association/) | [Change Default File Association](/tags/#change-default-file-association), [Event Triggered Execution](/tags/#event-triggered-execution)| TTP |
+| [Disable AMSI Through Registry](/endpoint/disable_amsi_through_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disable Defender AntiVirus Registry](/endpoint/disable_defender_antivirus_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disable Defender BlockAtFirstSeen Feature](/endpoint/disable_defender_blockatfirstseen_feature/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disable Defender Enhanced Notification](/endpoint/disable_defender_enhanced_notification/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disable Defender MpEngine Registry](/endpoint/disable_defender_mpengine_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disable Defender Spynet Reporting](/endpoint/disable_defender_spynet_reporting/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disable Defender Submit Samples Consent Feature](/endpoint/disable_defender_submit_samples_consent_feature/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disable ETW Through Registry](/endpoint/disable_etw_through_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disable Registry Tool](/endpoint/disable_registry_tool/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disable Security Logs Using MiniNt Registry](/endpoint/disable_security_logs_using_minint_registry/) | [Modify Registry](/tags/#modify-registry)| TTP |
+| [Disable Show Hidden Files](/endpoint/disable_show_hidden_files/) | [Hidden Files and Directories](/tags/#hidden-files-and-directories), [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Hide Artifacts](/tags/#hide-artifacts), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disable UAC Remote Restriction](/endpoint/disable_uac_remote_restriction/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [Disable Windows App Hotkeys](/endpoint/disable_windows_app_hotkeys/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disable Windows Behavior Monitoring](/endpoint/disable_windows_behavior_monitoring/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disable Windows SmartScreen Protection](/endpoint/disable_windows_smartscreen_protection/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disabling CMD Application](/endpoint/disabling_cmd_application/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disabling ControlPanel](/endpoint/disabling_controlpanel/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disabling Defender Services](/endpoint/disabling_defender_services/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disabling FolderOptions Windows Feature](/endpoint/disabling_folderoptions_windows_feature/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disabling NoRun Windows App](/endpoint/disabling_norun_windows_app/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Disabling Remote User Account Control](/endpoint/disabling_remote_user_account_control/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [Disabling SystemRestore In Registry](/endpoint/disabling_systemrestore_in_registry/) | [Inhibit System Recovery](/tags/#inhibit-system-recovery)| TTP |
+| [Disabling Task Manager](/endpoint/disabling_task_manager/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Enable RDP In Other Port Number](/endpoint/enable_rdp_in_other_port_number/) | [Remote Services](/tags/#remote-services)| TTP |
+| [Enable WDigest UseLogonCredential Registry](/endpoint/enable_wdigest_uselogoncredential_registry/) | [Modify Registry](/tags/#modify-registry), [OS Credential Dumping](/tags/#os-credential-dumping)| TTP |
+| [ETW Registry Disabled](/endpoint/etw_registry_disabled/) | [Indicator Blocking](/tags/#indicator-blocking), [Trusted Developer Utilities Proxy Execution](/tags/#trusted-developer-utilities-proxy-execution), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Eventvwr UAC Bypass](/endpoint/eventvwr_uac_bypass/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [Hide User Account From Sign-In Screen](/endpoint/hide_user_account_from_sign-in_screen/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Modification Of Wallpaper](/endpoint/modification_of_wallpaper/) | [Defacement](/tags/#defacement)| TTP |
+| [Monitor Registry Keys for Print Monitors](/endpoint/monitor_registry_keys_for_print_monitors/) | [Port Monitors](/tags/#port-monitors), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| TTP |
+| [Registry Keys for Creating SHIM Databases](/endpoint/registry_keys_for_creating_shim_databases/) | [Application Shimming](/tags/#application-shimming), [Event Triggered Execution](/tags/#event-triggered-execution)| TTP |
+| [Registry Keys Used For Persistence](/endpoint/registry_keys_used_for_persistence/) | [Registry Run Keys / Startup Folder](/tags/#registry-run-keys-/-startup-folder), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| TTP |
+| [Registry Keys Used For Privilege Escalation](/endpoint/registry_keys_used_for_privilege_escalation/) | [Image File Execution Options Injection](/tags/#image-file-execution-options-injection), [Event Triggered Execution](/tags/#event-triggered-execution)| TTP |
+| [Remcos client registry install entry](/endpoint/remcos_client_registry_install_entry/) | [Modify Registry](/tags/#modify-registry)| TTP |
+| [Revil Registry Entry](/endpoint/revil_registry_entry/) | [Modify Registry](/tags/#modify-registry)| TTP |
+| [Screensaver Event Trigger Execution](/endpoint/screensaver_event_trigger_execution/) | [Event Triggered Execution](/tags/#event-triggered-execution), [Screensaver](/tags/#screensaver)| TTP |
+| [Sdclt UAC Bypass](/endpoint/sdclt_uac_bypass/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [SilentCleanup UAC Bypass](/endpoint/silentcleanup_uac_bypass/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+| [Time Provider Persistence Registry](/endpoint/time_provider_persistence_registry/) | [Time Providers](/tags/#time-providers), [Boot or Logon Autostart Execution](/tags/#boot-or-logon-autostart-execution)| TTP |
+| [Windows Disable Lock Workstation Feature Through Registry](/endpoint/windows_disable_lock_workstation_feature_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly |
+| [Windows Disable LogOff Button Through Registry](/endpoint/windows_disable_logoff_button_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly |
+| [Windows Disable Memory Crash Dump](/endpoint/windows_disable_memory_crash_dump/) | [Data Destruction](/tags/#data-destruction)| TTP |
+| [Windows Disable Notification Center](/endpoint/windows_disable_notification_center/) | [Modify Registry](/tags/#modify-registry)| Anomaly |
+| [Windows Disable Shutdown Button Through Registry](/endpoint/windows_disable_shutdown_button_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly |
+| [Windows Disable Windows Group Policy Features Through Registry](/endpoint/windows_disable_windows_group_policy_features_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly |
+| [Windows DisableAntiSpyware Registry](/endpoint/windows_disableantispyware_registry/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
+| [Windows Hide Notification Features Through Registry](/endpoint/windows_hide_notification_features_through_registry/) | [Modify Registry](/tags/#modify-registry)| Anomaly |
+| [Windows Modify Show Compress Color And Info Tip Registry](/endpoint/windows_modify_show_compress_color_and_info_tip_registry/) | [Modify Registry](/tags/#modify-registry)| TTP |
+| [Windows Service Creation Using Registry Entry](/endpoint/windows_service_creation_using_registry_entry/) | [Services Registry Permissions Weakness](/tags/#services-registry-permissions-weakness)| TTP |
+| [WSReset UAC Bypass](/endpoint/wsreset_uac_bypass/) | [Bypass User Access Control](/tags/#bypass-user-access-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism)| TTP |
+
+#### Reference
+
+* [https://attack.mitre.org/techniques/T1112/](https://attack.mitre.org/techniques/T1112/)
+* [https://redcanary.com/blog/windows-registry-attacks-threat-detection/](https://redcanary.com/blog/windows-registry-attacks-threat-detection/)
+
+
+
+[*source*](https://github.com/splunk/security_content/tree/develop/stories/windows_registry_abuse.yml) \| *version*: **1**
\ No newline at end of file
diff --git a/docs/_stories/xmrig.md b/docs/_stories/xmrig.md
index d3d5244acb..03372557a8 100644
--- a/docs/_stories/xmrig.md
+++ b/docs/_stories/xmrig.md
@@ -49,7 +49,7 @@ XMRig is a high performance, open source, cross platform RandomX, KawPow, Crypto
 | [Hide User Account From Sign-In Screen](/endpoint/hide_user_account_from_sign-in_screen/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
 | [Icacls Deny Command](/endpoint/icacls_deny_command/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification)| TTP |
 | [ICACLS Grant Command](/endpoint/icacls_grant_command/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification)| TTP |
-| [Modify ACL permission To Files Or Folder](/endpoint/modify_acl_permission_to_files_or_folder/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification)| TTP |
+| [Modify ACL permission To Files Or Folder](/endpoint/modify_acl_permission_to_files_or_folder/) | [File and Directory Permissions Modification](/tags/#file-and-directory-permissions-modification)| Anomaly |
 | [Process Kill Base On File Path](/endpoint/process_kill_base_on_file_path/) | [Disable or Modify Tools](/tags/#disable-or-modify-tools), [Impair Defenses](/tags/#impair-defenses)| TTP |
 | [Schtasks Run Task On Demand](/endpoint/schtasks_run_task_on_demand/) | [Scheduled Task/Job](/tags/#scheduled-task/job)| TTP |
 | [Suspicious Driver Loaded Path](/endpoint/suspicious_driver_loaded_path/) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process)| TTP |